jeo-code 0.7.56 → 0.7.57

package/CHANGELOG.md

@@ -6,6 +6,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.57] - 2026-07-07
+_"동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in._
+
+### Added
+- **`routing.crossProviderPool`** (opt-in, default off) — session-STABLE selection across every credentialed provider's EQUIVALENT-class model for a tier (`sizeClassFor`: provider-declared size suffixes — haiku/flash/mini=small, sonnet/pro=mid, opus/fable=large — computed live off `MODEL_CATALOG`, with a strength-tercile fallback for the ~50% of the catalog with no size-suffix naming). The same session always resolves to the same model (preserves provider-side prompt-cache warmth turn-to-turn); different sessions spread across different providers. Purely additive — unset, every existing config's behavior is byte-identical to v0.7.56.
+- **`CatalogModel.limitedAvailability`** — a real bug this work surfaced: invite-only models (`claude-mythos-5`) were reachable by auto-select/pool even though a provider credential doesn't imply access to that specific model. Now excluded from all auto-select paths; still targetable explicitly by id for approved accounts.
+- **`jeo doctor` routing preview** extended with an `"auto-selected: cross-provider pool"` source label when `crossProviderPool` resolved the shown model.
+
+### Verified
+- `bun run typecheck` clean; full suite 2692/2692 pass across 280 files.
+- End-to-end against the real 4-provider production config: `tierModelPool("trivial")` spans gemini/openai/anthropic/antigravity; 5 distinct sessions distribute across 3 different providers while each individual session stays stable across repeated turns.
+
 ## [0.7.56] - 2026-07-07
 _"서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale._
 

package/README.ja.md

@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -264,11 +264,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 - **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.56",
+  "version": "0.7.57",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -186,6 +186,9 @@ export const ConfigSchema = z
     roles: z
       .object({
         smol: z.string().optional(),
+        medium: z.string().optional(),
+        high: z.string().optional(),
+        xhigh: z.string().optional(),
         slow: z.string().optional(),
         plan: z.string().optional(),
       })
@@ -203,9 +206,11 @@ export const ConfigSchema = z
           .object({
             trivial: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
             standard: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
+            high: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
             complex: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
           })
           .optional(),
+        crossProviderPool: z.boolean().optional(),
       })
       .optional(),
     gitAutoCommit: z.boolean().optional(),
@@ -320,6 +325,15 @@ export function parseConfig(raw: unknown): { ok: true; config: ValidatedConfig }
       if (config.roles.smol) {
         config.roles.smol = normalizeModelId(config.roles.smol, aliases);
       }
+      if (config.roles.medium) {
+        config.roles.medium = normalizeModelId(config.roles.medium, aliases);
+      }
+      if (config.roles.high) {
+        config.roles.high = normalizeModelId(config.roles.high, aliases);
+      }
+      if (config.roles.xhigh) {
+        config.roles.xhigh = normalizeModelId(config.roles.xhigh, aliases);
+      }
       if (config.roles.slow) {
         config.roles.slow = normalizeModelId(config.roles.slow, aliases);
       }

package/src/agent/context-files.ts

@@ -264,6 +264,31 @@ export async function loadProjectContext(cwd = process.cwd()): Promise<ProjectCo
   const home = process.env.HOME ? path.resolve(process.env.HOME) : null;
   const collectedItems: ContextItem[] = [];
 
+  // 0. User-global context files (~/.jeo/agent/AGENTS.md) — lowest precedence.
+  // Native user files come first in the result so project files later take precedence.
+  // Only jeo's own user config applies; foreign-provider user files are excluded (e.g.
+  // ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md stay out — only ~/.jeo/* is loaded).
+  //
+  // This is optional: if the user file doesn't exist or is unreadable, we silently skip.
+  // Symlinks are followed (fs.stat resolves them), so ~/.jeo/agent/AGENTS.md can be a link.
+  if (home) {
+    const userAgentFile = path.join(home, ".jeo", "agent", "AGENTS.md");
+    try {
+      const stat = await fs.stat(userAgentFile);
+      // Check: must be a regular file (not directory) and non-empty.
+      // fs.stat follows symlinks, so this works transparently with linked files.
+      if (stat.isFile() && stat.size > 0) {
+        const file = await readContextFile(userAgentFile, "~/.jeo/agent/AGENTS.md", BASE_CONTEXT_CHARS - baseChars);
+        if (file) {
+          result.push(file);
+          baseChars += file.content.length;
+        }
+      }
+    } catch {
+      // User-global file not found, unreadable, or permission denied; silently continue.
+      // User config is optional; its absence is not an error condition.
+    }
+  }
   // 1. CWD 및 부모 walk
   let curr = resolvedCwd;
   let distance = 0;

package/src/agent/engine.ts

@@ -12,7 +12,7 @@ import * as path from "node:path";
 import type { Message } from "./loop";
 import { extractJsonObject } from "./json";
 import { nativeToolSchemasFor, normalizeNativeToolName } from "./tool-schemas";
-import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, type ToolResult } from "./tools";
+import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, bisectTool, type ToolResult } from "./tools";
 import { webSearchTool, setWebSearchActiveModel } from "./web-search";
 import { executeComputerAction } from "../commands/computer";
 import { computerSupervisor } from "./computer-supervisor";
@@ -105,6 +105,7 @@ export const DEFAULT_TOOLS: Record<string, ToolHandler> = {
   lsp_rename: createLspRenameTool(),
   debug: createDebugTool(),
   browser: createBrowserTool(),
+  bisect: (a, cwd) => bisectTool(a.good, a.bad, a.run, !!a.invert, a.maxSteps, a.stepTimeoutMs, cwd),
 };
 /** Tool-protocol description injected into the system prompt. */
 export const TOOL_PROTOCOL = [
@@ -126,7 +127,8 @@ export const TOOL_PROTOCOL = [
   "15. lsp_rename {file, line, symbol?, new_name, apply?} — cross-file TypeScript/JavaScript rename (apply defaults true; apply:false previews only)",
   "16. debug {action, ...} — Node.js debugging (launch/set_breakpoint/continue/step_over/step_in/step_out/pause/evaluate/stack_trace/scopes/variables/threads/output/terminate); one active session, 'launch' spawns 'node --inspect-brk' and pauses at start",
   "17. browser {action:\"open\"|\"close\"|\"run\"|\"act\", name?, url?, actions?} — headless Chromium automation (Playwright); 'act' runs structured steps (navigate/click/type/fill/select/press/scroll/back/wait/observe/extract/screenshot) addressing elements by numeric id from 'observe' or a CSS selector; 'run' executes JS with page/browser/tab/display/assert/wait in scope",
-  "18. done   {reason?}                  — call when the task is fully implemented AND verified",
+  "18. bisect {good, bad?, run, invert?, maxSteps?, stepTimeoutMs?} — binary-search git history to find the commit that introduced a regression; 'good' is a known-good commit, 'bad' defaults to HEAD, 'run' is a test command (exit 0=good, non-zero=bad, 125=skip), 'invert' finds a FIX instead of a regression",
+  "19. done   {reason?}                  — call when the task is fully implemented AND verified",
   "",
   "Reply with STRICT JSON only — no code fences. You MAY include an optional leading",
   '"reasoning" string (one short sentence on your plan) before "tool":',

package/src/agent/prompt-router.ts

@@ -18,17 +18,34 @@
  * `config.roles`/`config.routing.tiers` so a user who already configured
  * `roles.smol`/`roles.slow` (for `--smol`/`--slow` role-tier resolution
  * elsewhere) gets working routing with zero additional config. An unconfigured
- * trivial/complex tier does NOT simply collapse to `defaultModel` (that would
- * defeat cross-provider routing for every user who hasn't hand-tuned
- * `routing.tiers`) — it auto-selects the cheapest (trivial) / most capable
- * (complex) model jeo has a stored credential for, computed LIVE off
- * `MODEL_CATALOG`/`pricing.ts` on every call. This is the "long-term" fix for
- * catalog drift: when jeo ships a new/cheaper/stronger model, auto-select
- * picks it up on the next call automatically — no user config edit, no
- * hand-maintained tier→model table to go stale. "standard" is the one
- * exception: it always falls through to `defaultModel` unless explicitly
- * configured, since routine day-to-day work should stay on the user's
- * deliberately chosen default rather than being silently reassigned.
+ * trivial/high/complex tier does NOT simply collapse to `defaultModel` (that
+ * would defeat cross-provider routing for every user who hasn't hand-tuned
+ * `routing.tiers`) — it auto-selects the cheapest (trivial) / a strong
+ * mid-class model (high) / the most capable (complex) model jeo has a stored
+ * credential for, computed LIVE off `MODEL_CATALOG`/`pricing.ts` on every
+ * call. This is the "long-term" fix for catalog drift: when jeo ships a
+ * new/cheaper/stronger model, auto-select picks it up on the next call
+ * automatically — no user config edit, no hand-maintained tier→model table to
+ * go stale. "standard" is the one exception: it always falls through to
+ * `defaultModel` unless explicitly configured, since routine day-to-day work
+ * should stay on the user's deliberately chosen default rather than being
+ * silently reassigned (unless `routing.crossProviderPool` opts it into the
+ * session-stable cross-provider pool below).
+ *
+ * Four content-based tiers map onto the four `roles.*` price points
+ * (smol/medium/high/xhigh) so automatic routing can actually reach all of
+ * them: `trivial`→smol, `standard`→medium, `high`→roles.high (a single
+ * borderline-complex signal — e.g. one deep-work keyword alone — no longer
+ * jumps straight to the most expensive `complex`/xhigh tier), `complex`→xhigh.
+ *
+ * `routing.crossProviderPool` (opt-in, default off) activates
+ * `tierModelPool`/`selectFromPool` for the `standard`/`high` tiers: instead of
+ * a single deterministic pick, a SESSION-STABLE hash spreads different
+ * sessions across every credentialed provider's equivalent-class model, so
+ * jeo actually captures different providers' respective strengths on
+ * comparably-priced work instead of converging every session onto one
+ * provider. Off by default to preserve the "safe no-op absent configuration"
+ * contract for users who never opted in.
  */
 import { callLlm } from "./loop";
 import { resolveRoleModel } from "../ai/model-manager";
@@ -40,7 +57,7 @@ import type { ThinkLevel } from "../ai/model-catalog";
 import type { ProviderName } from "../ai/types";
 import type { AuthProvider } from "../auth";
 
-export type PromptTier = "trivial" | "standard" | "complex";
+export type PromptTier = "trivial" | "standard" | "high" | "complex";
 
 export interface HeuristicResult {
   tier: PromptTier;
@@ -62,6 +79,12 @@ export interface RouteDecision {
 export interface RoutePromptOptions {
   hasImages?: boolean;
   signal?: AbortSignal;
+  /** Threads through to `selectFromPool` for session-stable cross-provider pool
+   *  selection — the same session always lands on the same pool member (keeps
+   *  provider-side prompt caching warm turn-to-turn), while different sessions
+   *  spread across the pool. Omitted (e.g. a one-shot `jeo chat` call) ->
+   *  deterministic index 0. */
+  sessionId?: string;
 }
 
 // --- Frozen, bilingual-validated classification signals (do not re-derive). ---
@@ -143,7 +166,10 @@ export function classifyPromptHeuristically(prompt: string): HeuristicResult {
     return { tier: "standard", confidence: 0.35, signals }; // conflicting signals -> let escalation decide
   }
   if (complexScore >= 2) return { tier: "complex", confidence: 0.85, signals };
-  if (complexScore === 1) return { tier: "complex", confidence: 0.65, signals };
+  // A single complex signal alone is treated as "high" (elevated but not full complex) —
+  // price efficiency: one weak/borderline signal must not jump straight to the priciest
+  // xhigh tier (that's reserved for >=2 corroborating complex signals).
+  if (complexScore === 1) return { tier: "high", confidence: 0.65, signals };
   if (trivialScore >= 2) return { tier: "trivial", confidence: 0.85, signals };
   if (trivialScore === 1) return { tier: "trivial", confidence: 0.65, signals };
   return { tier: "standard", confidence: 0.9, signals }; // no signals at all -> common case, high confidence
@@ -185,12 +211,95 @@ function isCloudProvider(p: ProviderName): p is AuthProvider {
   return p !== "ollama" && p !== "lmstudio";
 }
 
+/** Size class jeo infers for a catalog model, used to group EQUIVALENT models
+ *  across DIFFERENT providers for pool-based routing (see `tierModelPool`) — the
+ *  cross-provider counterpart to `cheapestCredentialed`/`strongestCredentialed`'s
+ *  single-winner selection. Matches PROVIDER-DECLARED size-tier suffixes
+ *  (Anthropic's haiku/sonnet/opus, Google's flash/pro, OpenAI's mini) against
+ *  hyphen/dot-delimited SEGMENTS of the canonical id — NOT a raw substring match,
+ *  which would false-positive on "gemini" containing "mini" as a substring.
+ *  `null` for ids with no size-tier suffix at all (gpt-5.5, o3, grok-4.3, kimi-*,
+ *  glm-*, deepseek-*, minimax-* — providers whose naming doesn't encode size);
+ *  `tierModelPool` falls those back to a strength-tercile split instead. */
+function sizeClassFor(canonical: string): "small" | "mid" | "large" | null {
+  const id = canonical.toLowerCase();
+  const bare = id.includes("/") ? id.slice(id.indexOf("/") + 1) : id;
+  const segments = bare.split(/[-.]/);
+  if (segments.includes("haiku") || segments.includes("flash") || segments.includes("mini") || segments.includes("nano")) return "small";
+  if (segments.includes("opus") || segments.includes("ultra") || segments.includes("fable") || segments.includes("mythos")) return "large";
+  if (segments.includes("sonnet") || segments.includes("pro")) return "mid";
+  return null;
+}
+
+const TIER_TO_SIZE_CLASS: Record<PromptTier, "small" | "mid" | "large"> = { trivial: "small", standard: "mid", high: "mid", complex: "large" };
+
+/** Multi-key strength comparator (ascending: weakest first) — same ranking signals
+ *  as `strongestCredentialed`'s single-winner tiebreak, reused here to bucket
+ *  UNCLASSIFIED (no size-suffix) models into a tercile fallback. */
+function compareStrengthAscending(a: CatalogModel, b: CatalogModel): number {
+  const xhighA = a.thinking.includes("xhigh") ? 1 : 0;
+  const xhighB = b.thinking.includes("xhigh") ? 1 : 0;
+  if (xhighA !== xhighB) return xhighA - xhighB;
+  if (a.maxOutputTokens !== b.maxOutputTokens) return a.maxOutputTokens - b.maxOutputTokens;
+  if (a.contextTokens !== b.contextTokens) return a.contextTokens - b.contextTokens;
+  return a.canonical < b.canonical ? -1 : a.canonical > b.canonical ? 1 : 0;
+}
+
+/** Cross-provider EQUIVALENCE pool for `tier` — every credentialed cloud model
+ *  jeo classifies as the same size class (trivial→small, standard→mid,
+ *  complex→large), computed LIVE off `MODEL_CATALOG` so it stays correct as the
+ *  catalog evolves. Models with no size-tier-suffix (gpt-5.5, o3, grok-4.3,
+ *  kimi-*, glm-*, …) fall back to a strength-tercile bucket instead of being
+ *  silently excluded from every pool. Returns `[]` when zero credentialed
+ *  models qualify (caller falls back to `defaultModel`). Sorted by canonical id
+ *  for deterministic pool ordering (required by `selectFromPool`'s index math). */
+export function tierModelPool(tier: PromptTier, config: RoutingConfig): string[] {
+  const targetClass = TIER_TO_SIZE_CLASS[tier];
+  const credentialed = MODEL_CATALOG.filter(m => isCloudProvider(m.provider) && !m.limitedAvailability && (config.providers?.[m.provider] || config.oauth?.[m.provider]));
+
+  const suffixPool = credentialed.filter(m => sizeClassFor(m.canonical) === targetClass);
+
+  const unclassified = credentialed.filter(m => sizeClassFor(m.canonical) === null).sort(compareStrengthAscending);
+  const third = Math.ceil(unclassified.length / 3);
+  // "high" shares "standard"'s unclassified-model tercile share: the catalog's
+  // size-suffix classification only has 3 real buckets (small/mid/large — see
+  // sizeClassFor), so there is no distinct 4th tercile to carve out for "high".
+  // resolveTierModel's "high" branch does not currently rely on this tercile
+  // share (it prefers a deterministic strongest-mid-class pick — see
+  // strongestMidTierCredentialed below); kept here only so this `Record<PromptTier,…>`
+  // stays exhaustive for external callers of `tierModelPool("high", …)`.
+  const tercileByTier: Record<PromptTier, CatalogModel[]> = {
+    trivial: unclassified.slice(0, third),
+    standard: unclassified.slice(third, third * 2),
+    high: unclassified.slice(third, third * 2),
+    complex: unclassified.slice(third * 2),
+  };
+
+  const pool = [...suffixPool, ...tercileByTier[tier]];
+  return pool.map(m => m.canonical).sort();
+}
+
+/** Deterministic, SESSION-STABLE pick from `pool` — the same `sessionId` always
+ *  resolves to the same index within one pool (so a session's provider-side
+ *  prompt cache stays warm turn-to-turn, per this file's `deriveCacheSessionKey`
+ *  cache-correlation contract), while DIFFERENT sessions spread across the pool's
+ *  providers (the actual cross-provider distribution this feature exists for).
+ *  No `sessionId` (e.g. a one-shot `jeo chat` call) deterministically picks index
+ *  0 (the pool is canonical-id-sorted, so this is still stable, just unvaried). */
+export function selectFromPool(pool: readonly string[], sessionId: string | undefined): string {
+  if (pool.length === 0) throw new Error("selectFromPool: empty pool");
+  if (pool.length === 1 || !sessionId) return pool[0];
+  let h = 0x811c9dc5 | 0;
+  for (let i = 0; i < sessionId.length; i++) h = Math.imul(h ^ sessionId.charCodeAt(i), 0x01000193);
+  return pool[(h >>> 0) % pool.length];
+}
+
 /** Cheapest cloud model jeo has a credential for, computed LIVE off
  *  `MODEL_CATALOG`/`priceForModel` — picks up new/repriced catalog entries
  *  automatically, never a hand-maintained id. `null` when no credentialed
  *  model has a known price (caller falls back to `defaultModel`). Tiebreak:
  *  canonical id (deterministic across otherwise-equal candidates). */
-function cheapestCredentialed(config: RoutingConfig): string | null {
+export function cheapestCredentialed(config: RoutingConfig): string | null {
   let best: CatalogModel | null = null;
   let bestCost = Infinity;
   for (const m of MODEL_CATALOG) {
@@ -199,7 +308,7 @@ function cheapestCredentialed(config: RoutingConfig): string | null {
     // wins (unlike provider-status.ts's `configuredCredential` precedence). The
     // real veto gate in launch.ts's `runTurn` re-verifies full readiness (including
     // live OAuth expiry) before a turn actually uses the model.
-    if (!isCloudProvider(m.provider) || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (!isCloudProvider(m.provider) || m.limitedAvailability || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
     const price = priceForModel(m.canonical);
     if (!price) continue;
     const cost = price.inPerM + price.outPerM;
@@ -216,14 +325,19 @@ function cheapestCredentialed(config: RoutingConfig): string | null {
  *  output tokens, then context window, so a newly catalogued frontier model
  *  is picked up automatically without a hand-maintained id. `null` when no
  *  credentialed model qualifies (caller falls back to `defaultModel`).
- *  Tiebreak: canonical id (deterministic; also happens to prefer widely-
- *  available ids like `claude-fable-5` alphabetically ahead of limited-
- *  availability siblings such as `claude-mythos-5`). */
-function strongestCredentialed(config: RoutingConfig): string | null {
+ *  Tiebreak: canonical id (deterministic). Excludes `limitedAvailability`
+ *  models (e.g. `claude-mythos-5`) — a provider credential doesn't imply
+ *  access to a specific invite-only model; explicit `/model`/`routing.tiers`
+ *  can still target one by id for approved accounts. */
+export function strongestCredentialed(
+  config: RoutingConfig,
+  filter?: (m: CatalogModel) => boolean
+): string | null {
   let best: CatalogModel | null = null;
   for (const m of MODEL_CATALOG) {
     // "ANY stored credential" is enough (see cheapestCredentialed's comment above).
-    if (!isCloudProvider(m.provider) || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (!isCloudProvider(m.provider) || m.limitedAvailability || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (filter && !filter(m)) continue;
     if (!best) { best = m; continue; }
     const xhighM = m.thinking.includes("xhigh") ? 1 : 0;
     const xhighBest = best.thinking.includes("xhigh") ? 1 : 0;
@@ -235,24 +349,59 @@ function strongestCredentialed(config: RoutingConfig): string | null {
   return best?.canonical ?? null;
 }
 
+/** Strongest credentialed model restricted to the SAME "mid" size class
+ *  `tierModelPool` uses for `standard` (sonnet/pro-suffixed families) — the
+ *  auto-select fallback for the `high` tier. Deliberately narrower than
+ *  `strongestCredentialed`'s catalog-wide search: an unrestricted search would
+ *  frequently tie with (or even prefer) `complex`'s own pick, since several
+ *  "unclassified" frontier ids (gpt-5.5, grok-4.3, …) publish flagship-tier
+ *  specs under a name with no size-suffix at all and would otherwise win over
+ *  a genuinely mid-class model like `claude-sonnet-4-6`. `null` when no
+ *  mid-class-suffixed model is credentialed (caller falls through to
+ *  `roles.medium`/`defaultModel` — never to `complex`'s flagship pick). */
+function strongestMidTierCredentialed(config: RoutingConfig): string | null {
+  const midClass = MODEL_CATALOG.filter(
+    m => isCloudProvider(m.provider) && !m.limitedAvailability && sizeClassFor(m.canonical) === "mid" && (config.providers?.[m.provider] || config.oauth?.[m.provider]),
+  );
+  if (midClass.length === 0) return null;
+  return midClass.sort(compareStrengthAscending).at(-1)!.canonical;
+}
+
+/** `routing.crossProviderPool` (opt-in, default off) fallback for ALL FOUR tiers:
+ *  a SESSION-STABLE pick from `tierModelPool(tier, config)` instead of each
+ *  tier's deterministic single-winner pick (`cheapestCredentialed`/
+ *  `strongestMidTierCredentialed`/`strongestCredentialed`). Off (or an empty
+ *  pool) returns `null` so the caller's next fallback applies unchanged — this
+ *  is purely additive: a user who has not set the flag keeps v0.7.56's exact
+ *  single-winner behavior; setting it distributes qualifying tiers across
+ *  every credentialed provider's equivalent-class model instead of always
+ *  resolving to the one deterministic winner. */
+function crossProviderPoolPick(tier: PromptTier, config: RoutingConfig, sessionId: string | undefined): string | null {
+  if (!config.routing?.crossProviderPool) return null;
+  const pool = tierModelPool(tier, config);
+  return pool.length > 0 ? selectFromPool(pool, sessionId) : null;
+}
+
 // --- Tier -> model/thinking resolution (inline off config.roles/config.routing.tiers; no static map). ---
 
 /** Exported for `jeo doctor`'s routing-preview diagnostic (same resolution the real
  *  `routePrompt` uses — no duplicated logic between "what WILL routing pick" and
  *  "what does doctor SHOW the user routing will pick"). */
-export function resolveTierModel(tier: PromptTier, config: RoutingConfig): string {
+export function resolveTierModel(tier: PromptTier, config: RoutingConfig, sessionId?: string): string {
   const configured = config.routing?.tiers?.[tier]?.model;
   if (configured) return configured;
-  if (tier === "trivial") return config.roles?.smol || cheapestCredentialed(config) || config.defaultModel;
-  if (tier === "complex") return config.roles?.slow || strongestCredentialed(config) || config.defaultModel;
-  return config.defaultModel; // "standard" always falls through to defaultModel unless explicitly configured
+  if (tier === "trivial") return config.roles?.smol || crossProviderPoolPick(tier, config, sessionId) || cheapestCredentialed(config) || config.defaultModel;
+  if (tier === "standard") return config.roles?.medium || config.roles?.high || crossProviderPoolPick(tier, config, sessionId) || config.defaultModel;
+  if (tier === "high") return config.roles?.high || config.roles?.medium || crossProviderPoolPick(tier, config, sessionId) || strongestMidTierCredentialed(config) || config.defaultModel;
+  if (tier === "complex") return config.roles?.xhigh || config.roles?.slow || crossProviderPoolPick(tier, config, sessionId) || strongestCredentialed(config) || config.defaultModel;
+  return config.defaultModel;
 }
 
 function resolveTierThinking(tier: PromptTier, config: RoutingConfig): ThinkLevel | undefined {
   return config.routing?.tiers?.[tier]?.thinking; // undefined = no override, caller keeps session/global level
 }
 
-const VALID_TIERS: readonly PromptTier[] = ["trivial", "standard", "complex"];
+const VALID_TIERS: readonly PromptTier[] = ["trivial", "standard", "high", "complex"];
 function isPromptTier(value: unknown): value is PromptTier {
   return typeof value === "string" && (VALID_TIERS as readonly string[]).includes(value);
 }
@@ -266,8 +415,9 @@ function buildClassifierPrompt(prompt: string): string {
   return (
     `Classify the complexity of the following user request for a coding assistant into exactly one ` +
     `tier: "trivial" (a quick factual lookup, no repo work), "standard" (routine coding/editing work), ` +
-    `or "complex" (multi-file, architectural, or root-cause debugging work). ` +
-    `Respond with ONLY a JSON object of the shape {"tier":"trivial"|"standard"|"complex"}.\n\n` +
+    `"high" (a single moderately complex change — one non-trivial refactor/debug in one area, not yet ` +
+    `multi-file or architectural), or "complex" (multi-file, architectural, or root-cause debugging work). ` +
+    `Respond with ONLY a JSON object of the shape {"tier":"trivial"|"standard"|"high"|"complex"}.\n\n` +
     `Request:\n${capped}`
   );
 }
@@ -336,7 +486,7 @@ export async function routePrompt(
       }
     }
 
-    const model = resolveTierModel(tier, config);
+    const model = resolveTierModel(tier, config, opts.sessionId);
     if (opts.hasImages && catalogMetadata(model)?.images === false) return null;
 
     const decision: RouteDecision = {

package/src/agent/state.ts

@@ -130,7 +130,14 @@ export interface Config {
    * Model role tiers (gjc `--smol`/`--slow`/`--plan` parity). Each falls back to
    * `defaultModel`. Env `JEO_SMOL_MODEL`/`JEO_SLOW_MODEL`/`JEO_PLAN_MODEL` fill gaps.
    */
-  roles?: { smol?: string; slow?: string; plan?: string };
+  roles?: {
+    smol?: string;
+    medium?: string;
+    high?: string;
+    xhigh?: string;
+    slow?: string;
+    plan?: string;
+  };
   /** Prompt-content-based per-turn model routing (PromptRouter) — see prompt-router.ts.
    *  Opt-in (undefined/false = off). Never affects subagent/role-tier model resolution. */
   routing?: {
@@ -139,8 +146,19 @@ export interface Config {
     tiers?: {
       trivial?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
       standard?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
+      /** A single borderline-complex signal (see prompt-router.ts's `classifyPromptHeuristically`)
+       *  — routes to `roles.high` by default instead of jumping straight to `complex`/xhigh. */
+      high?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
       complex?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
     };
+    /** Opt-in (default off): for `standard`/`high` tiers left unconfigured (no
+     *  `routing.tiers.*.model`, no `roles.medium`/`roles.high`), pick a SESSION-STABLE
+     *  model from the cross-provider equivalence pool (`tierModelPool`/`selectFromPool`)
+     *  instead of falling straight to `defaultModel` — spreads different sessions across
+     *  every credentialed provider's comparable-tier model so jeo actually captures each
+     *  provider's respective strengths on comparably-priced work, rather than every
+     *  session converging on one provider. */
+    crossProviderPool?: boolean;
   };
   gitAutoCommit?: boolean;
   hooks?: HookConfig;
@@ -284,6 +302,9 @@ function withEnvOverlay(cfg: Config): Config {
     lmstudioBaseUrl: cfg.lmstudioBaseUrl || process.env.LMSTUDIO_BASE_URL || "http://localhost:1234/v1",
     roles: {
       smol: cfg.roles?.smol || jeoEnv("SMOL_MODEL"),
+      medium: cfg.roles?.medium || jeoEnv("MEDIUM_MODEL"),
+      high: cfg.roles?.high || jeoEnv("HIGH_MODEL"),
+      xhigh: cfg.roles?.xhigh || jeoEnv("XHIGH_MODEL"),
       slow: cfg.roles?.slow || jeoEnv("SLOW_MODEL"),
       plan: cfg.roles?.plan || jeoEnv("PLAN_MODEL"),
     },

package/src/agent/subagents.ts

@@ -11,6 +11,7 @@
  */
 import { DEFAULT_TOOLS, TOOL_PROTOCOL, READONLY_TOOL_PROTOCOL, WORKING_DISCIPLINE, type ToolHandler } from "./engine";
 import type { Config } from "./state";
+import type { CatalogModel } from "../ai/model-catalog";
 import architectPrompt from "../prompts/agents/architect.md" with { type: "text" };
 import criticPrompt from "../prompts/agents/critic.md" with { type: "text" };
 import executorPrompt from "../prompts/agents/executor.md" with { type: "text" };
@@ -158,9 +159,42 @@ export function defaultSubagentRole(): SubagentRole {
 export type SubagentConfig = NonNullable<Config["subagents"]>;
 
 /** Per-role model override → falls back to the global default model. */
-export function resolveSubagentModel(roleId: string, config: Pick<Config, "defaultModel" | "subagents">): string {
-  const entry = config.subagents?.[normalizeRoleId(roleId)];
-  return entry?.model || config.defaultModel;
+export function resolveSubagentModel(
+  roleId: string,
+  config: {
+    defaultModel: string;
+    subagents?: Config["subagents"];
+    roles?: Config["roles"];
+    providers?: Config["providers"];
+    oauth?: Config["oauth"];
+  },
+): string {
+  const normalized = normalizeRoleId(roleId);
+  const entry = config.subagents?.[normalized];
+  if (entry?.model) return entry.model;
+
+  // Exception: load strongestCredentialed dynamically using require to prevent eager loading and circular dependency issues that break test mocking.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { strongestCredentialed } = require("./prompt-router");
+  if (normalized === "executor") {
+    return config.roles?.xhigh || config.roles?.slow || strongestCredentialed(config) || config.defaultModel;
+  }
+  if (normalized === "architect") {
+    return config.roles?.xhigh || strongestCredentialed(config, (m: CatalogModel) => m.thinking.includes("xhigh") || m.thinking.includes("high")) || config.defaultModel;
+  }
+  if (normalized === "planner") {
+    return config.roles?.high || strongestCredentialed(config) || config.defaultModel;
+  }
+  if (normalized === "critic") {
+    return (
+      config.roles?.medium ||
+      config.roles?.smol ||
+      strongestCredentialed(config, (m: CatalogModel) => m.canonical === "o3-mini") ||
+      strongestCredentialed(config, (m: CatalogModel) => m.canonical === "gemini-2.5-flash") ||
+      config.defaultModel
+    );
+  }
+  return config.defaultModel;
 }
 
 /** Per-role step budget → config override, else the role default, else 15. */

package/src/agent/tools.ts

@@ -1130,3 +1130,172 @@ export async function deleteTool(
     return { success: false, output: "", error: err.message };
   }
 }
+
+
+/**
+ * Binary-search git history to find the commit that introduced a regression.
+ * Uses `git bisect run <predicate>` to automate the search.
+ * Exit codes: 0=good, non-zero=bad, 125=skip.
+ */
+export async function bisectTool(
+  good: string,
+  bad: string = "HEAD",
+  run: string = "",
+  invert: boolean = false,
+  maxSteps: number = 40,
+  stepTimeoutMs: number = 600000,
+  cwd: string = process.cwd()
+): Promise<ToolResult> {
+  try {
+    if (!good || !good.trim()) {
+      return { success: false, output: "", error: 'bisect requires "good" (a known-good commit)' };
+    }
+    if (!run || !run.trim()) {
+      return { success: false, output: "", error: 'bisect requires "run" (a shell command to test)' };
+    }
+    if (maxSteps <= 0) {
+      return { success: false, output: "", error: 'maxSteps must be > 0' };
+    }
+    if (stepTimeoutMs <= 0) {
+      return { success: false, output: "", error: 'stepTimeoutMs must be > 0' };
+    }
+
+    // Helper to run a command with timeout support and resilient error handling
+    const runCmd = async (args: string[], timeoutMs?: number): Promise<{ code: number; out: string; err: string }> => {
+      const timeout = timeoutMs || stepTimeoutMs;
+      let timeoutOccurred = false;
+      const timeoutHandle = setTimeout(() => {
+        timeoutOccurred = true;
+      }, timeout);
+
+      try {
+        const proc = Bun.spawn(args, {
+          cwd,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        
+        let out = "";
+        let err = "";
+        
+        const stdoutReader = (proc.stdout as ReadableStream<Uint8Array>).getReader();
+        const stderrReader = (proc.stderr as ReadableStream<Uint8Array>).getReader();
+        
+        // Read stdout with resilience: stream errors don't fail the entire call.
+        // If a reader encounters an error, we continue with partial output, as
+        // git bisect can still function with partial stdout/stderr.
+        try {
+          while (!timeoutOccurred) {
+            const { done, value } = await stdoutReader.read();
+            if (done) break;
+            out += new TextDecoder().decode(value);
+          }
+        } catch (e) {
+          // Stream read error; continue with partial output.
+          // This is acceptable because git bisect may still be usable.
+        }
+        
+        // Read stderr with resilience: same strategy as stdout.
+        try {
+          while (!timeoutOccurred) {
+            const { done, value } = await stderrReader.read();
+            if (done) break;
+            err += new TextDecoder().decode(value);
+          }
+        } catch (e) {
+          // Stream read error; continue with partial output.
+        }
+        
+        if (timeoutOccurred) {
+          return { code: 124, out, err: `Command timeout after ${timeout}ms` };
+        }
+        
+        const code = await proc.exited;
+        return { code: typeof code === 'number' ? code : 0, out, err };
+      } finally {
+        clearTimeout(timeoutHandle);
+      }
+    };
+
+    // Validate commits exist (quick validation with shorter timeout)
+    const goodRes = await runCmd(["git", "rev-parse", good], 10000);
+    const badRes = await runCmd(["git", "rev-parse", bad], 10000);
+
+    if (goodRes.code !== 0) {
+      return { success: false, output: "", error: `Invalid or non-existent commit: ${good}` };
+    }
+    if (badRes.code !== 0) {
+      return { success: false, output: "", error: `Invalid or non-existent commit: ${bad}` };
+    }
+
+    const goodSha = goodRes.out.trim();
+    const badSha = badRes.out.trim();
+
+    // Start bisect session
+    const initRes = await runCmd(["sh", "-c", `git bisect start "${badSha}" "${goodSha}"`], 10000);
+    if (initRes.code !== 0) {
+      return { success: false, output: "", error: `Failed to start bisect: ${initRes.err || initRes.out}` };
+    }
+
+    // Run bisect with the predicate command.
+    // Shell escaping: single quotes in sh -c context need special care.
+    // 'text' -> '\''text'\'' (end quote, escaped quote, start quote, content, end quote, escaped quote, start quote)
+    const escapedRun = run.replace(/'/g, "'\''");
+    const runCmd2 = invert
+      ? `git bisect run sh -c '${escapedRun} && exit 1 || exit 0'`
+      : `git bisect run sh -c '${escapedRun}'`;
+
+    const runRes = await runCmd(["sh", "-c", runCmd2]);
+
+    // Parse result: look for "XXXX is the first bad/good commit"
+    const badCommitMatch = runRes.out.match(/^([0-9a-f]{7,40}) is the first (bad|good) commit$/m);
+    let culprit: string | null = null;
+    let concluded = false;
+
+    if (badCommitMatch) {
+      culprit = badCommitMatch[1];
+      concluded = true;
+    } else if (runRes.out.includes("only 'skip'ped commits left")) {
+      concluded = false;
+    }
+
+    // Cleanup: always attempt to reset bisect and working tree (best-effort).
+    // Errors here are non-critical; if reset fails, the user can manually run
+    // 'git bisect reset' to recover. We don't throw on cleanup errors.
+    try {
+      await runCmd(["git", "bisect", "reset"], 10000);
+    } catch {}
+    try {
+      await runCmd(["git", "reset", "--hard"], 10000);
+    } catch {}
+
+    if (!concluded) {
+      return {
+        success: false,
+        output: `Bisect did not converge. Output:\n${runRes.out}`,
+        error: "",
+      };
+    }
+
+    if (culprit) {
+      // Get commit details (use shorter timeout for metadata lookup)
+      const detailsRes = await runCmd(["git", "show", "-s", "--format=%aN|%ai|%s", culprit], 10000);
+      const [author, date, subject] = detailsRes.out.trim().split("|");
+      const message = [
+        invert ? `First fixing commit: ${culprit}` : `First bad commit: ${culprit}`,
+        author ? `Author:  ${author}` : "",
+        date ? `Date:    ${date}` : "",
+        subject ? `Subject: ${subject}` : "",
+      ]
+        .filter(Boolean)
+        .join("\n");
+
+      return { success: true, output: message };
+    }
+
+    return { success: false, output: "Bisect completed but found no culprit.", error: "" };
+  } catch (err: any) {
+    return { success: false, output: "", error: err.message || String(err) };
+  }
+}
+

package/src/ai/model-catalog.ts

@@ -29,6 +29,13 @@ export interface CatalogModel {
   images: boolean;
   /** Optional company override. */
   company?: string;
+  /** True for models requiring separate approval/waitlist beyond the provider's
+   *  base credential (e.g. Anthropic's invite-only Project Glasswing models) — a
+   *  user with a valid API key/OAuth for the PROVIDER may still lack access to
+   *  this SPECIFIC model. Auto-select (prompt-router.ts's pool/single-winner
+   *  selection) excludes these; explicit `/model` or `routing.tiers.*.model`
+   *  can still target them by id for approved accounts. */
+  limitedAvailability?: boolean;
 }
 
 const FULL: ThinkLevel[] = ["low", "medium", "high", "xhigh"];
@@ -73,7 +80,7 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
   // Fable 5 = Anthropic's most capable widely-released model (adaptive thinking always on);
   // Mythos 5 is limited-availability (Project Glasswing) but callable by id for approved accounts.
   { canonical: "claude-fable-5", provider: "anthropic", providerModel: "claude-fable-5", contextTokens: 1_000_000, maxOutputTokens: 128_000, thinking: FULL, images: true },
-  { canonical: "claude-mythos-5", provider: "anthropic", providerModel: "claude-mythos-5", contextTokens: 1_000_000, maxOutputTokens: 128_000, thinking: FULL, images: true },
+  { canonical: "claude-mythos-5", provider: "anthropic", providerModel: "claude-mythos-5", contextTokens: 1_000_000, maxOutputTokens: 128_000, thinking: FULL, images: true, limitedAvailability: true },
   // OpenAI
   { canonical: "gpt-4o", provider: "openai", providerModel: "gpt-4o", contextTokens: 128_000, maxOutputTokens: 16_384, thinking: [], images: true },
   { canonical: "gpt-4o-mini", provider: "openai", providerModel: "gpt-4o-mini", contextTokens: 128_000, maxOutputTokens: 16_384, thinking: [], images: true },

package/src/ai/model-discovery.ts

@@ -60,7 +60,11 @@ const ANTIGRAVITY_MODEL_DENYLIST = new Set([
 
 function anthropicHeaders(cred: Credential): Record<string, string> {
   if (cred.kind === "oauth") {
-    return { authorization: `Bearer ${cred.token}`, "anthropic-version": "2023-06-01", "anthropic-beta": "oauth-2025-04-20" };
+    // NOTE: The oauth-2025-04-20 beta is for the messages endpoint, not the models endpoint.
+    // The models endpoint does not support this beta, so we omit it here to avoid
+    // potential 400/403 errors. The fallback to catalog ensures Anthropic models
+    // are always available even if the live endpoint fails.
+    return { authorization: `Bearer ${cred.token}`, "anthropic-version": "2023-06-01" };
   }
   if (cred.kind === "api_key") {
     return { "x-api-key": cred.token, "anthropic-version": "2023-06-01" };

package/src/ai/model-manager.ts

@@ -146,10 +146,23 @@ export async function describeModel(
   return { input, resolved, provider: resolveProvider(resolved) };
 }
 
-export type ModelRole = "smol" | "slow" | "plan";
-
-/** Resolve a model role tier (smol/slow/plan) → configured tier model, else defaultModel. */
-export function resolveRoleModel(role: ModelRole, config: { defaultModel: string; roles?: { smol?: string; slow?: string; plan?: string } }): string {
+export type ModelRole = "smol" | "medium" | "high" | "xhigh" | "slow" | "plan";
+
+/** Resolve a model role tier (smol/medium/high/xhigh/slow/plan) → configured tier model, else defaultModel. */
+export function resolveRoleModel(
+  role: ModelRole,
+  config: {
+    defaultModel: string;
+    roles?: {
+      smol?: string;
+      medium?: string;
+      high?: string;
+      xhigh?: string;
+      slow?: string;
+      plan?: string;
+    };
+  },
+): string {
   return config.roles?.[role] || config.defaultModel;
 }
 

package/src/auth/callback-server.ts

@@ -58,13 +58,15 @@ h1.ok{color:#22d3ee}h1.fail{color:#f472b6}
 p{margin:.25rem 0;color:#8b8b96;font-size:.92rem}
 button{margin-top:1.5rem;padding:.55rem 1.6rem;border-radius:999px;border:1px solid #2a2a35;background:transparent;color:#e7e7ec;font:inherit;font-size:.88rem;cursor:pointer}
 button:hover{background:#1b1c27}
-.hint{margin-top:.9rem;font-size:.78rem;color:#5f5f6b}</style></head>
+.hint{margin-top:.9rem;font-size:.78rem;color:#5f5f6b}
+.closed{display:none}</style></head>
 <body><div class="card">
 <img class="wordmark" alt="jeo" src="${JEO_WORDMARK_DATA_URI}">
 <h1 class="__STATUS__">__TITLE__</h1>
 <p>__MSG__</p>
 <button id="jeo-close" type="button">Close</button>
 <p class="hint">Closing automatically in <span id="jeo-countdown">__SECONDS__</span>s…</p>
+<p class="hint closed" id="jeo-closed-msg">Window closed. You can close this tab.</p>
 </div>
 <script>__SCRIPT__</script>
 </body></html>`;
@@ -78,8 +80,16 @@ const AUTO_CLOSE_SECONDS = 5;
 
 function renderHtml(ok: boolean, msg: string): string {
   const script = `(function(){
-    var n=${AUTO_CLOSE_SECONDS},el=document.getElementById("jeo-countdown"),btn=document.getElementById("jeo-close"),t;
-    function closeNow(){clearInterval(t);window.close();}
+    var n=${AUTO_CLOSE_SECONDS},el=document.getElementById("jeo-countdown"),btn=document.getElementById("jeo-close"),closedMsg=document.getElementById("jeo-closed-msg"),t;
+    function closeNow(){
+      clearInterval(t);
+      var closed=window.close();
+      if(!closed){
+        btn.style.display="none";
+        el.parentElement.style.display="none";
+        closedMsg.classList.remove("closed");
+      }
+    }
     t=setInterval(function(){n-=1;if(el)el.textContent=String(Math.max(n,0));if(n<=0)closeNow();},1000);
     if(btn)btn.addEventListener("click",closeNow);
   })();`;

package/src/commands/doctor.ts

@@ -8,7 +8,7 @@ import { meter } from "../tui/components/meter";
 import { size } from "../tui/terminal";
 import chalk from "chalk";
 import { extractChatgptAccountId, CODEX_RESPONSES_URL } from "../ai/providers/openai-responses";
-import { resolveTierModel } from "../agent/prompt-router";
+import { resolveTierModel, tierModelPool } from "../agent/prompt-router";
 
 interface ProbeResult {
   status: "ok" | "fail" | "skipped";
@@ -197,8 +197,9 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
   if (routingEnabled) {
     const tierCandidates: { tier: string; model: string | undefined }[] = [
       { tier: "trivial", model: config.routing?.tiers?.trivial?.model || config.roles?.smol },
-      { tier: "standard", model: config.routing?.tiers?.standard?.model },
-      { tier: "complex", model: config.routing?.tiers?.complex?.model || config.roles?.slow },
+      { tier: "standard", model: config.routing?.tiers?.standard?.model || config.roles?.medium || config.roles?.high },
+      { tier: "high", model: config.routing?.tiers?.high?.model || config.roles?.high || config.roles?.medium },
+      { tier: "complex", model: config.routing?.tiers?.complex?.model || config.roles?.xhigh || config.roles?.slow },
     ];
     for (const { tier, model } of tierCandidates) {
       if (!model) continue;
@@ -220,11 +221,36 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
   // informational — never affects ready/--strict, same contract as routingNotes.
   const routingPreview: { tier: string; model: string; provider: string; source: string }[] = [];
   if (routingEnabled) {
-    for (const tier of ["trivial", "standard", "complex"] as const) {
-      const explicit = config.routing?.tiers?.[tier]?.model || (tier === "trivial" ? config.roles?.smol : tier === "complex" ? config.roles?.slow : undefined);
+    // Legacy role-tier fallback per tier, mirroring resolveTierModel's OWN precedence
+    // (not just the id it happens to already show up under `routing.tiers.*.model`) —
+    // so e.g. a `roles.medium`-only config correctly shows "configured", not
+    // "auto-selected", for `standard`.
+
+    for (const tier of ["trivial", "standard", "high", "complex"] as const) {
+      const legacyRole =
+        tier === "trivial" ? config.roles?.smol
+        : tier === "standard" ? config.roles?.medium || config.roles?.high
+        : tier === "high" ? config.roles?.high || config.roles?.medium
+        : config.roles?.xhigh || config.roles?.slow;
+      const explicit = config.routing?.tiers?.[tier]?.model || legacyRole;
       const model = resolveTierModel(tier, config);
       const provider = resolveProvider(model);
-      const source = explicit ? "configured" : model === config.defaultModel ? "defaultModel" : tier === "trivial" ? "auto-selected: cheapest credentialed" : "auto-selected: strongest credentialed";
+      // crossProviderPoolPick (prompt-router.ts) is tried BEFORE every tier's own
+      // cheapest/strongest/mid-tier fallback, so a non-empty pool always wins over
+      // those once the flag is on — `.length > 0` alone is enough to know the pool,
+      // not the tier-specific fallback, produced `model`.
+      const pooled = !explicit && model !== config.defaultModel && !!config.routing?.crossProviderPool && tierModelPool(tier, config).length > 0;
+      const source = explicit
+        ? "configured"
+        : model === config.defaultModel
+          ? "defaultModel"
+          : pooled
+            ? "auto-selected: cross-provider pool"
+            : tier === "trivial"
+              ? "auto-selected: cheapest credentialed"
+              : tier === "high"
+                ? "auto-selected: strongest mid-tier credentialed"
+                : "auto-selected: strongest credentialed";
       routingPreview.push({ tier, model, provider, source });
     }
   }

package/src/commands/launch.ts

@@ -885,7 +885,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // selection must stay session-local: running sessions never influence each other.
     const routingEnabled = sessionRouteOverride ?? !!turnConfig.routing?.enabled;
     let routed = routingEnabled && !sessionModel
-      ? await routePrompt(userInput, turnConfig, { hasImages: !!images?.length }).catch(() => null)
+      ? await routePrompt(userInput, turnConfig, { hasImages: !!images?.length, sessionId }).catch(() => null)
       : null;
     // Fail-open credential gate: `routePrompt` only resolves a tier's model from
     // config (routing.tiers/roles.smol/roles.slow/defaultModel) — it deliberately

package/src/tui/app.ts

@@ -73,7 +73,7 @@ export interface LaunchTuiOptions {
    *  gate fell back). Renders a persistent `⚡tier` marker in the status bar so the
    *  routed model stays visible without depending on the transient `[route]`
    *  console notice. See `StatusBarData.routedTier` in components/status.ts. */
-  routedTier?: "trivial" | "standard" | "complex";
+  routedTier?: "trivial" | "standard" | "high" | "complex";
 }
 
 export interface AgentEventsLike {
@@ -375,7 +375,7 @@ export class LaunchTui {
   private readonly thinkingLevel?: string;
   // PromptRouter's resolved tier when routing chose this turn's model; undefined when
   // routing didn't engage. Renders the persistent `⚡tier` marker in the status bar.
-  private readonly routedTier?: "trivial" | "standard" | "complex";
+  private readonly routedTier?: "trivial" | "standard" | "high" | "complex";
 
   constructor(opts: LaunchTuiOptions) {
     // Backpressure-aware wrapper around the underlying writer (real stdout, or the

package/src/tui/components/status.ts

@@ -24,7 +24,7 @@ export interface StatusBarData {
    *  marker so the routed model stays visible without depending on the transient
    *  `[route] …` console notice, which intentionally stays silent for routine
    *  unescalated `standard`-tier turns. */
-  routedTier?: "trivial" | "standard" | "complex";
+  routedTier?: "trivial" | "standard" | "high" | "complex";
   branch?: string;
   /** Uncommitted-change count for the `?N` dirty flag; omit/0 = clean. */
   dirtyCount?: number;