jeo-code 0.7.54 → 0.7.56

package/CHANGELOG.md

@@ -6,6 +6,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.56] - 2026-07-07
+_"서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale._
+
+### Added
+- **Cross-provider tier auto-select** (`src/agent/prompt-router.ts`) — an unconfigured `trivial` tier now auto-selects the CHEAPEST model jeo has a stored credential for; an unconfigured `complex` tier auto-selects the most CAPABLE one (full/xhigh thinking support, then max output tokens, then context window). Both are computed LIVE off `MODEL_CATALOG`/`pricing.ts` on every call — a new/repriced/stronger catalog entry is picked up automatically on the next turn, with zero user config edit and no hand-maintained id table to go stale. `standard` is unchanged (always `defaultModel` unless explicitly configured — routine work stays on the user's deliberate default). Precedence unchanged and fully backward-compatible: explicit `routing.tiers.*.model` > legacy `roles.smol`/`roles.slow` > auto-select > `defaultModel`. Verified end-to-end against the real 4-provider production config: `trivial` → `gemini-2.0-flash` (gemini, cheapest), `complex` → `claude-fable-5` (anthropic, strongest available — matches current external SWE-Bench Pro agentic-benchmark leadership).
+- **`jeo doctor` routing preview** (`--json`'s `routing.preview` / human output's "Routing preview" block) — surfaces what each tier ACTUALLY resolves to right now (model, provider, and source: `configured` / legacy role / `auto-selected: cheapest credentialed` / `auto-selected: strongest credentialed` / `defaultModel`), so the cross-provider split is visible without reading source. Purely informational, same as the existing routing notes — never affects `ready`/`--strict`.
+
+### Verified
+- `bun run typecheck` clean; full suite 2684/2684 pass across 280 files (+9 new tests: 7 in `prompt-router.test.ts` covering cheapest/strongest selection, single-provider constraint, explicit-config precedence, legacy-role precedence, zero-credential fallback, and OAuth-credential recognition; 2 in `doctor.test.ts` proving the preview surfaces a real cross-provider split in both `--json` and human output).
+- A genuine tie case was found and deliberately left unresolved rather than "fixed" with a regression: `gemini-2.5-flash` vs `gemini-2.5-pro` have identical catalogued thinking/output/context metadata, so the canonical-id tiebreak (ascending, chosen specifically to never prefer a limited-availability sibling like `claude-mythos-5` over the widely-available `claude-fable-5`) picks `flash`. A price-descending tiebreak was prototyped and rejected: it fixed the synthetic gemini-only tie but broke the real 4-provider production case by preferring `claude-opus-4-6` (uncatalogued price, falls to a generic-family price higher than `claude-fable-5`'s dedicated price) over `claude-fable-5` — the actual current agentic-benchmark leader per external verification. Documented as a known limitation rather than silently traded for a worse regression.
+
+## [0.7.55] - 2026-07-07
+_Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end._
+
+### Added
+- **`modelProviderLabel()` helper** (`src/tui/app.ts`) — DRY "model (provider)" formatting shared with the existing `renderModelBar`/status-bar convention, now threaded through all three Thinking-related surfaces: the live `currentActivity()` status line ("reasoning (…)"/"calling model (…)"), the live streaming Thinking block header, and the live placeholder Thinking block (signature-only reasoning models like opus-4-8 that stream no thought text).
+- **`thinkingHeader()` optional 3rd param** (`modelLabel?: string`) for the persisted (scrollback-committed) Thinking header — fully backward-compatible; existing 2-arg call sites are unchanged and produce byte-identical output.
+
+### Verified
+- `bun run typecheck` clean; full suite 2675/2675 pass across 280 files (+3 new tests: `thinkingHeader` 3-arg unit test, a real `LaunchTui` persisted-header integration test, and a live-frame streaming-block test).
+- End-to-end proof with a real `LaunchTui` instance (not just the pure function) across a cross-provider two-turn session: turn 1 (claude-haiku-4-5/anthropic) and turn 2 (gemini-2.5-pro/gemini) each show their own correct model+provider in both the live and persisted Thinking headers, confirming the label updates turn-to-turn rather than being fixed at session start.
+- A pre-existing test asserting the OLD bare `"thinking · Ns"` format (`streaming-reasoning.test.ts`) was updated to the new model-labeled format — an intentional format change, not a loosened assertion.
+
 ## [0.7.54] - 2026-07-06
 _Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead._
 

package/README.ja.md

@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
+- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
-- **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
-- **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
+- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
-- **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
-- **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -264,11 +264,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
+- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
-- **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
-- **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
+- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
-- **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
-- **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.54",
+  "version": "0.7.56",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/prompt-router.ts

@@ -14,19 +14,31 @@
  * failures and falls back to a safe default, and the top-level export wraps
  * everything again as a final backstop.
  *
- * Why no static tier→model map: `resolveTierModel` computes inline off
+ * Why no STATIC tier→model map: `resolveTierModel` computes inline off
  * `config.roles`/`config.routing.tiers` so a user who already configured
  * `roles.smol`/`roles.slow` (for `--smol`/`--slow` role-tier resolution
- * elsewhere) gets working routing with zero additional config, and an
- * unconfigured role falls through to `defaultModel` exactly like every other
- * role-tier consumer in this codebase (see `resolveRoleModel`).
+ * elsewhere) gets working routing with zero additional config. An unconfigured
+ * trivial/complex tier does NOT simply collapse to `defaultModel` (that would
+ * defeat cross-provider routing for every user who hasn't hand-tuned
+ * `routing.tiers`) — it auto-selects the cheapest (trivial) / most capable
+ * (complex) model jeo has a stored credential for, computed LIVE off
+ * `MODEL_CATALOG`/`pricing.ts` on every call. This is the "long-term" fix for
+ * catalog drift: when jeo ships a new/cheaper/stronger model, auto-select
+ * picks it up on the next call automatically — no user config edit, no
+ * hand-maintained tier→model table to go stale. "standard" is the one
+ * exception: it always falls through to `defaultModel` unless explicitly
+ * configured, since routine day-to-day work should stay on the user's
+ * deliberately chosen default rather than being silently reassigned.
  */
 import { callLlm } from "./loop";
 import { resolveRoleModel } from "../ai/model-manager";
-import { catalogMetadata } from "../ai/model-catalog";
+import { catalogMetadata, MODEL_CATALOG, type CatalogModel } from "../ai/model-catalog";
+import { priceForModel } from "../ai/pricing";
 import { tryExtractJsonObject } from "./json";
 import type { Config } from "./state";
 import type { ThinkLevel } from "../ai/model-catalog";
+import type { ProviderName } from "../ai/types";
+import type { AuthProvider } from "../auth";
 
 export type PromptTier = "trivial" | "standard" | "complex";
 
@@ -156,17 +168,87 @@ export function resetPromptRouterWarnings(): void {
   warnedKeys.clear();
 }
 
+/** `resolveTierModel`'s config requirement: `providers`/`oauth` are OPTIONAL (not
+ *  just a `Pick`) so callers/tests that never touch credentials (e.g. this file's
+ *  own tests, which only exercise heuristic/escalation logic) keep compiling
+ *  unchanged — omitting the keys entirely still satisfies this type, and
+ *  `config.providers?.[p]` / `config.oauth?.[p]` are safe on the resulting
+ *  `undefined`. Production callers (`readGlobalConfig()`'s real `Config`) always
+ *  provide both. */
+export type RoutingConfig = Pick<Config, "defaultModel" | "roles" | "routing"> &
+  Partial<Pick<Config, "providers" | "oauth">>;
+
+/** Cloud providers eligible for cross-provider auto-select (excludes local
+ *  ollama/lmstudio, which are never a sensible "route to the cheapest/strongest"
+ *  target — a local model's cost/capability isn't comparable to a hosted one). */
+function isCloudProvider(p: ProviderName): p is AuthProvider {
+  return p !== "ollama" && p !== "lmstudio";
+}
+
+/** Cheapest cloud model jeo has a credential for, computed LIVE off
+ *  `MODEL_CATALOG`/`priceForModel` — picks up new/repriced catalog entries
+ *  automatically, never a hand-maintained id. `null` when no credentialed
+ *  model has a known price (caller falls back to `defaultModel`). Tiebreak:
+ *  canonical id (deterministic across otherwise-equal candidates). */
+function cheapestCredentialed(config: RoutingConfig): string | null {
+  let best: CatalogModel | null = null;
+  let bestCost = Infinity;
+  for (const m of MODEL_CATALOG) {
+    // "ANY stored credential" (API key OR OAuth) is enough here — auto-select only
+    // needs "can this provider serve a request at all", not WHICH credential kind
+    // wins (unlike provider-status.ts's `configuredCredential` precedence). The
+    // real veto gate in launch.ts's `runTurn` re-verifies full readiness (including
+    // live OAuth expiry) before a turn actually uses the model.
+    if (!isCloudProvider(m.provider) || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    const price = priceForModel(m.canonical);
+    if (!price) continue;
+    const cost = price.inPerM + price.outPerM;
+    if (cost < bestCost || (cost === bestCost && best && m.canonical < best.canonical)) {
+      best = m;
+      bestCost = cost;
+    }
+  }
+  return best?.canonical ?? null;
+}
+
+/** Most capable cloud model jeo has a credential for, computed LIVE off
+ *  `MODEL_CATALOG` — ranks by full (xhigh) thinking support first, then max
+ *  output tokens, then context window, so a newly catalogued frontier model
+ *  is picked up automatically without a hand-maintained id. `null` when no
+ *  credentialed model qualifies (caller falls back to `defaultModel`).
+ *  Tiebreak: canonical id (deterministic; also happens to prefer widely-
+ *  available ids like `claude-fable-5` alphabetically ahead of limited-
+ *  availability siblings such as `claude-mythos-5`). */
+function strongestCredentialed(config: RoutingConfig): string | null {
+  let best: CatalogModel | null = null;
+  for (const m of MODEL_CATALOG) {
+    // "ANY stored credential" is enough (see cheapestCredentialed's comment above).
+    if (!isCloudProvider(m.provider) || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (!best) { best = m; continue; }
+    const xhighM = m.thinking.includes("xhigh") ? 1 : 0;
+    const xhighBest = best.thinking.includes("xhigh") ? 1 : 0;
+    if (xhighM !== xhighBest) { if (xhighM > xhighBest) best = m; continue; }
+    if (m.maxOutputTokens !== best.maxOutputTokens) { if (m.maxOutputTokens > best.maxOutputTokens) best = m; continue; }
+    if (m.contextTokens !== best.contextTokens) { if (m.contextTokens > best.contextTokens) best = m; continue; }
+    if (m.canonical < best.canonical) best = m;
+  }
+  return best?.canonical ?? null;
+}
+
 // --- Tier -> model/thinking resolution (inline off config.roles/config.routing.tiers; no static map). ---
 
-function resolveTierModel(tier: PromptTier, config: Pick<Config, "defaultModel" | "roles" | "routing">): string {
+/** Exported for `jeo doctor`'s routing-preview diagnostic (same resolution the real
+ *  `routePrompt` uses — no duplicated logic between "what WILL routing pick" and
+ *  "what does doctor SHOW the user routing will pick"). */
+export function resolveTierModel(tier: PromptTier, config: RoutingConfig): string {
   const configured = config.routing?.tiers?.[tier]?.model;
   if (configured) return configured;
-  if (tier === "trivial") return config.roles?.smol || config.defaultModel;
-  if (tier === "complex") return config.roles?.slow || config.defaultModel;
+  if (tier === "trivial") return config.roles?.smol || cheapestCredentialed(config) || config.defaultModel;
+  if (tier === "complex") return config.roles?.slow || strongestCredentialed(config) || config.defaultModel;
   return config.defaultModel; // "standard" always falls through to defaultModel unless explicitly configured
 }
 
-function resolveTierThinking(tier: PromptTier, config: Pick<Config, "defaultModel" | "roles" | "routing">): ThinkLevel | undefined {
+function resolveTierThinking(tier: PromptTier, config: RoutingConfig): ThinkLevel | undefined {
   return config.routing?.tiers?.[tier]?.thinking; // undefined = no override, caller keeps session/global level
 }
 
@@ -224,7 +306,7 @@ const SMOL_UNCONFIGURED_WARNING_KEY = "prompt-router:smol-unconfigured";
  */
 export async function routePrompt(
   prompt: string,
-  config: Pick<Config, "defaultModel" | "roles" | "routing">,
+  config: RoutingConfig,
   opts: RoutePromptOptions = {},
 ): Promise<RouteDecision | null> {
   try {

package/src/commands/doctor.ts

@@ -8,6 +8,7 @@ import { meter } from "../tui/components/meter";
 import { size } from "../tui/terminal";
 import chalk from "chalk";
 import { extractChatgptAccountId, CODEX_RESPONSES_URL } from "../ai/providers/openai-responses";
+import { resolveTierModel } from "../agent/prompt-router";
 
 interface ProbeResult {
   status: "ok" | "fail" | "skipped";
@@ -211,6 +212,23 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
     }
   }
 
+  // Routing PREVIEW (long-term visibility for cross-provider auto-select, v0.7.56):
+  // for each tier, show what resolveTierModel() ACTUALLY resolves to right now —
+  // explicitly configured, legacy role-tier, auto-selected (cheapest/strongest
+  // credentialed, computed live off MODEL_CATALOG), or the defaultModel fallback
+  // (no credentialed alternative, or "standard" which never auto-selects). Purely
+  // informational — never affects ready/--strict, same contract as routingNotes.
+  const routingPreview: { tier: string; model: string; provider: string; source: string }[] = [];
+  if (routingEnabled) {
+    for (const tier of ["trivial", "standard", "complex"] as const) {
+      const explicit = config.routing?.tiers?.[tier]?.model || (tier === "trivial" ? config.roles?.smol : tier === "complex" ? config.roles?.slow : undefined);
+      const model = resolveTierModel(tier, config);
+      const provider = resolveProvider(model);
+      const source = explicit ? "configured" : model === config.defaultModel ? "defaultModel" : tier === "trivial" ? "auto-selected: cheapest credentialed" : "auto-selected: strongest credentialed";
+      routingPreview.push({ tier, model, provider, source });
+    }
+  }
+
 
   // --- Gather (probes run concurrently → ~1× the slowest timeout, not N×) ---
   const probes: { name: string; credKind: string; result: ProbeResult }[] = [];
@@ -277,7 +295,7 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
       })),
       oauth: oauthHealth,
       ready,
-      ...(routingEnabled ? { routing: { enabled: true, smolConfigured, ...(routingNotes.length ? { notes: routingNotes } : {}) } } : {}),
+      ...(routingEnabled ? { routing: { enabled: true, smolConfigured, preview: routingPreview, ...(routingNotes.length ? { notes: routingNotes } : {}) } } : {}),
 
     };
     console.log(JSON.stringify(report, null, 2));
@@ -327,6 +345,10 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
     } else {
       console.log(`${chalk.green("[routing]")} enabled, roles.smol configured — LLM escalation available on ambiguous prompts.`);
     }
+    console.log("Routing preview (what each tier resolves to right now):");
+    for (const p of routingPreview) {
+      console.log(`  ${p.tier.padEnd(9)} → ${p.model} (${p.provider}) ${chalk.dim(`[${p.source}]`)}`);
+    }
 
     console.log("");
   }

package/src/tui/app.ts

@@ -158,11 +158,17 @@ export function clipReasoningLines(text: string, cap = THINKING_COMMIT_MAX_LINES
 }
 
 /** gjc-style "thought for Ns" header for a committed/streaming Thinking block. Omits the
- *  duration when no step start is known (e.g. resumed/exported records). */
-export function thinkingHeader(elapsedMs: number | undefined, unicode: boolean): string {
+ *  duration when no step start is known (e.g. resumed/exported records). The optional
+ *  `modelLabel` (e.g. "gpt-4o-mini (openai)", built by `modelProviderLabel()`) names
+ *  which routed model actually produced this committed thought — a cross-provider
+ *  routed turn's scrollback record otherwise gives no way to tell, after the fact,
+ *  which provider reasoned about which step. Omitted entirely when absent (e.g. the
+ *  2-arg legacy call, or a resumed/exported record with no model context). */
+export function thinkingHeader(elapsedMs: number | undefined, unicode: boolean, modelLabel?: string): string {
   const diamond = unicode ? "◇" : "*";
   const secs = elapsedMs !== undefined && elapsedMs >= 0 ? `${(elapsedMs / 1000).toFixed(1)}s` : null;
-  return `${diamond} thinking${secs ? ` · ${secs}` : ""}`;
+  const model = modelLabel ? ` · ${modelLabel}` : "";
+  return `${diamond} thinking${model}${secs ? ` · ${secs}` : ""}`;
 }
 
 /** Status animation palette while a tool/process runs (background verification): an
@@ -553,8 +559,10 @@ export class LaunchTui {
           const style = (prose: string) => prose.split("\n").map(styleThought).join("\n");
           const parts: string[] = [this.agentLabel()];
           // gjc "thought for Ns" header: step-start → commit ≈ the model's think+gen time.
+          // Names the routed model/provider so a cross-provider routed turn's scrollback
+          // record stays legible after the fact, not just live in the model bar.
           const elapsedMs = this.currentStepStartedAt ? Date.now() - this.currentStepStartedAt : undefined;
-          const header = thinkingHeader(elapsedMs, this.unicode);
+          const header = thinkingHeader(elapsedMs, this.unicode, this.modelProviderLabel());
           parts.push(this.theme.color ? chalk.dim(header) : header);
           if (willFlushThought) {
             this.flushedThought = this.streamingThought;
@@ -943,6 +951,15 @@ export class LaunchTui {
    * Replaces the per-tick cycling status text so the line shows genuine content (thinking
    * about a real file/step) instead of churning decorative messages every 120ms.
    */
+  /** `model (provider)` — the same convention `renderModelBar` uses for the persistent
+   *  status bar, reused here so the live/persisted "thinking" surfaces name which
+   *  routed model+provider is actually reasoning right now (not just the bare model id,
+   *  which alone doesn't distinguish e.g. a `gpt-4o-mini` served via openai vs. a
+   *  same-named alias on an OpenAI-compatible provider). */
+  private modelProviderLabel(): string {
+    return `${this.footer.model}${this.footer.provider ? ` (${this.footer.provider})` : ""}`;
+  }
+
   private currentActivity(): string {
     const running = this.tools.currentTool();
     // An in-flight tool's real target beats the workflow phase banner (gjc-style:
@@ -974,14 +991,14 @@ export class LaunchTui {
       if (this.retryNotice) return `${this.retryNotice} (${elapsed}s)`;
       // Reasoning is streaming → the live thought block already shows it; label the row.
       if (this.streamingThought.trim() || this.streamingReasoning.trim()) {
-        return `reasoning (${this.footer.model}) (${elapsed}s)…`;
+        return `reasoning (${this.modelProviderLabel()}) (${elapsed}s)…`;
       }
       // No tokens after a few seconds: the model is almost certainly reasoning
       // server-side (e.g. OpenAI hidden reasoning), NOT hung — say so instead of a
       // frozen "calling model …" so a long silent wait still reads as progress.
       const waited = this.currentStepStartedAt ? (Date.now() - this.currentStepStartedAt) / 1000 : 0;
-      if (waited >= 8) return `thinking (${this.footer.model}) — reasoning, no token stream yet (${elapsed}s)…`;
-      return `calling model (${this.footer.model}) (${elapsed}s)…`;
+      if (waited >= 8) return `thinking (${this.modelProviderLabel()}) — reasoning, no token stream yet (${elapsed}s)…`;
+      return `calling model (${this.modelProviderLabel()}) (${elapsed}s)…`;
     }
     if (running) {
       const last = this.forgeSummaries[this.forgeSummaries.length - 1];
@@ -1567,17 +1584,20 @@ export class LaunchTui {
     // rectangle, so a short trace leaves no padded "hole" and a short terminal is spared.
     const liveThink = this.streamingThought.trim() || this.streamingReasoning.trim();
     if (isThinking && liveThink) {
-      // gjc-parity: the Thinking block label carries a running timer ("Thinking · Ns").
-      // Cache key stays the constant "Thinking" so the per-frame wrap memo is unaffected.
+      // gjc-parity: the Thinking block label carries the routed model/provider and a
+      // running timer ("Thinking · gpt-4o-mini (openai) · Ns") — names which model is
+      // actually reasoning right now, so a cross-provider routed turn is legible mid-turn,
+      // not just after the fact in the status bar. Cache key stays the constant "Thinking"
+      // so the per-frame wrap memo is unaffected by the model/provider text.
       const liveMs = this.currentStepStartedAt ? Date.now() - this.currentStepStartedAt : undefined;
-      const liveLabel = liveMs !== undefined ? `Thinking · ${(liveMs / 1000).toFixed(1)}s` : "Thinking";
+      const liveLabel = `Thinking · ${this.modelProviderLabel()}${liveMs !== undefined ? ` · ${(liveMs / 1000).toFixed(1)}s` : ""}`;
       tail.push(...this.renderLiveBlock(liveLabel, liveThink, cols, rows, 6, "Thinking"));
     } else if (isThinking && this.thinkingActive) {
       // Signature-only reasoning models (opus-4-7/4-8) open a thinking block but stream no
       // thought text — show a live placeholder so the wait reads as active thinking, not a
       // frozen screen. Replaced the instant any real thought/answer text streams (branch above).
       const liveMs = this.currentStepStartedAt ? Date.now() - this.currentStepStartedAt : undefined;
-      const liveLabel = liveMs !== undefined ? `Thinking · ${(liveMs / 1000).toFixed(1)}s` : "Thinking";
+      const liveLabel = `Thinking · ${this.modelProviderLabel()}${liveMs !== undefined ? ` · ${(liveMs / 1000).toFixed(1)}s` : ""}`;
       tail.push(...this.renderLiveBlock(liveLabel, "(thinking…)", cols, rows, 6, "Thinking"));
     }
 
@@ -1645,7 +1665,7 @@ export class LaunchTui {
         ? Math.round((this.footer.contextUsedTokens / this.footer.contextMaxTokens) * 100)
         : undefined;
     return renderStatusBar({
-      model: `${this.footer.model}${this.footer.provider ? ` (${this.footer.provider})` : ""}`,
+      model: this.modelProviderLabel(),
       thinking: this.thinkingLevel,
       routedTier: this.routedTier,
       branch: this.footer.branch,