jeo-code 0.7.56 → 0.7.58

package/CHANGELOG.md

@@ -6,6 +6,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.58] - 2026-07-07
+_Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after._
+
+### Added
+- **`CatalogModel.releaseDate`** (`"YYYY-MM"`) on every catalog entry — deep-research sourced from each provider's own announcement (Anthropic/OpenAI/Google/xAI/Moonshot direct web_search per family; Tencent-hosted rebrands (DeepSeek/MiniMax/Zhipu GLM/Hunyuan) traced to the ORIGINAL developer's release, not Tencent's hosting-catalog appearance date). `gpt-5.4-mini` was never added to the catalog — confirmed absent both before and after this pass, per explicit request.
+
+### Changed
+- **`MODEL_CATALOG` reordered newest-first within every provider block** for human readability (routing correctness never depended on array order — the ranking functions below now sort/tiebreak explicitly).
+- **Recency tiebreak replaces the arbitrary alphabetical one** in `cheapestCredentialed`/`strongestCredentialed`/`compareStrengthAscending` (`src/agent/prompt-router.ts`) — on an exact capability/cost tie, the NEWER `releaseDate` now wins (a missing date always sorts as oldest, so an unconfirmed date can never silently outrank a verified-newer model). Fixes the confirmed opus-4-6/4-7/4-8 bug above.
+- **`catalogForProvider`'s secondary sort** (`src/ai/model-catalog-compat.ts`) now orders by `releaseDate` (newest first) instead of alphabetical id — this is the actual list order `/model`'s live picker and `jeo setup` show a user, so "정렬" now reaches the real user-facing surface, not just the raw catalog array.
+- **`RECOMMENDED` provider defaults refreshed** to the current (2026-07) general-availability flagship per provider: `claude-sonnet-5` (was `claude-sonnet-4-6`), `gpt-5.5` (was `gpt-4o`), `gemini-3-flash` (was `gemini-2.0-flash`), `antigravity/gpt-5.5` (was `antigravity/gemini-3-pro-low`).
+
+### Verified
+- `bun run typecheck` clean; full suite 2710/2710 pass across 281 files (1 pre-existing unrelated flaky test — `session.test.ts`'s global-`JSON.parse`-mock count assertion, confirmed passing in isolation and on rerun — not a regression from this change).
+- Live-executed the exact reported bug before AND after the fix: `strongestCredentialed(anthropicOnlyConfig, m => m.canonical.startsWith("claude-opus"))` returned `claude-opus-4-6` (oldest) before, `claude-opus-4-8` (newest, correct) after.
+- Re-applied `routing.crossProviderPool: true` to the live user config (a concurrent interactive session had reset it via an unrelated `/model` command mid-turn) and reconfirmed via `jeo doctor`: all 4 tiers correctly resolve through the cross-provider pool across anthropic/gemini/antigravity.
+
+## [0.7.57] - 2026-07-07
+_"동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in._
+
+### Added
+- **`routing.crossProviderPool`** (opt-in, default off) — session-STABLE selection across every credentialed provider's EQUIVALENT-class model for a tier (`sizeClassFor`: provider-declared size suffixes — haiku/flash/mini=small, sonnet/pro=mid, opus/fable=large — computed live off `MODEL_CATALOG`, with a strength-tercile fallback for the ~50% of the catalog with no size-suffix naming). The same session always resolves to the same model (preserves provider-side prompt-cache warmth turn-to-turn); different sessions spread across different providers. Purely additive — unset, every existing config's behavior is byte-identical to v0.7.56.
+- **`CatalogModel.limitedAvailability`** — a real bug this work surfaced: invite-only models (`claude-mythos-5`) were reachable by auto-select/pool even though a provider credential doesn't imply access to that specific model. Now excluded from all auto-select paths; still targetable explicitly by id for approved accounts.
+- **`jeo doctor` routing preview** extended with an `"auto-selected: cross-provider pool"` source label when `crossProviderPool` resolved the shown model.
+
+### Verified
+- `bun run typecheck` clean; full suite 2692/2692 pass across 280 files.
+- End-to-end against the real 4-provider production config: `tierModelPool("trivial")` spans gemini/openai/anthropic/antigravity; 5 distinct sessions distribute across 3 different providers while each individual session stays stable across repeated turns.
+
 ## [0.7.56] - 2026-07-07
 _"서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale._
 

package/README.ja.md

@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
-- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
-- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -264,11 +264,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
-- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
+- **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
 - **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
 - **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
-- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
-- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.56",
+  "version": "0.7.58",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -186,6 +186,9 @@ export const ConfigSchema = z
     roles: z
       .object({
         smol: z.string().optional(),
+        medium: z.string().optional(),
+        high: z.string().optional(),
+        xhigh: z.string().optional(),
         slow: z.string().optional(),
         plan: z.string().optional(),
       })
@@ -203,9 +206,11 @@ export const ConfigSchema = z
           .object({
             trivial: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
             standard: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
+            high: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
             complex: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
           })
           .optional(),
+        crossProviderPool: z.boolean().optional(),
       })
       .optional(),
     gitAutoCommit: z.boolean().optional(),
@@ -320,6 +325,15 @@ export function parseConfig(raw: unknown): { ok: true; config: ValidatedConfig }
       if (config.roles.smol) {
         config.roles.smol = normalizeModelId(config.roles.smol, aliases);
       }
+      if (config.roles.medium) {
+        config.roles.medium = normalizeModelId(config.roles.medium, aliases);
+      }
+      if (config.roles.high) {
+        config.roles.high = normalizeModelId(config.roles.high, aliases);
+      }
+      if (config.roles.xhigh) {
+        config.roles.xhigh = normalizeModelId(config.roles.xhigh, aliases);
+      }
       if (config.roles.slow) {
         config.roles.slow = normalizeModelId(config.roles.slow, aliases);
       }

package/src/agent/context-files.ts

@@ -264,6 +264,31 @@ export async function loadProjectContext(cwd = process.cwd()): Promise<ProjectCo
   const home = process.env.HOME ? path.resolve(process.env.HOME) : null;
   const collectedItems: ContextItem[] = [];
 
+  // 0. User-global context files (~/.jeo/agent/AGENTS.md) — lowest precedence.
+  // Native user files come first in the result so project files later take precedence.
+  // Only jeo's own user config applies; foreign-provider user files are excluded (e.g.
+  // ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md stay out — only ~/.jeo/* is loaded).
+  //
+  // This is optional: if the user file doesn't exist or is unreadable, we silently skip.
+  // Symlinks are followed (fs.stat resolves them), so ~/.jeo/agent/AGENTS.md can be a link.
+  if (home) {
+    const userAgentFile = path.join(home, ".jeo", "agent", "AGENTS.md");
+    try {
+      const stat = await fs.stat(userAgentFile);
+      // Check: must be a regular file (not directory) and non-empty.
+      // fs.stat follows symlinks, so this works transparently with linked files.
+      if (stat.isFile() && stat.size > 0) {
+        const file = await readContextFile(userAgentFile, "~/.jeo/agent/AGENTS.md", BASE_CONTEXT_CHARS - baseChars);
+        if (file) {
+          result.push(file);
+          baseChars += file.content.length;
+        }
+      }
+    } catch {
+      // User-global file not found, unreadable, or permission denied; silently continue.
+      // User config is optional; its absence is not an error condition.
+    }
+  }
   // 1. CWD 및 부모 walk
   let curr = resolvedCwd;
   let distance = 0;

package/src/agent/engine.ts

@@ -12,7 +12,7 @@ import * as path from "node:path";
 import type { Message } from "./loop";
 import { extractJsonObject } from "./json";
 import { nativeToolSchemasFor, normalizeNativeToolName } from "./tool-schemas";
-import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, type ToolResult } from "./tools";
+import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, bisectTool, type ToolResult } from "./tools";
 import { webSearchTool, setWebSearchActiveModel } from "./web-search";
 import { executeComputerAction } from "../commands/computer";
 import { computerSupervisor } from "./computer-supervisor";
@@ -105,6 +105,7 @@ export const DEFAULT_TOOLS: Record<string, ToolHandler> = {
   lsp_rename: createLspRenameTool(),
   debug: createDebugTool(),
   browser: createBrowserTool(),
+  bisect: (a, cwd) => bisectTool(a.good, a.bad, a.run, !!a.invert, a.maxSteps, a.stepTimeoutMs, cwd),
 };
 /** Tool-protocol description injected into the system prompt. */
 export const TOOL_PROTOCOL = [
@@ -126,7 +127,8 @@ export const TOOL_PROTOCOL = [
   "15. lsp_rename {file, line, symbol?, new_name, apply?} — cross-file TypeScript/JavaScript rename (apply defaults true; apply:false previews only)",
   "16. debug {action, ...} — Node.js debugging (launch/set_breakpoint/continue/step_over/step_in/step_out/pause/evaluate/stack_trace/scopes/variables/threads/output/terminate); one active session, 'launch' spawns 'node --inspect-brk' and pauses at start",
   "17. browser {action:\"open\"|\"close\"|\"run\"|\"act\", name?, url?, actions?} — headless Chromium automation (Playwright); 'act' runs structured steps (navigate/click/type/fill/select/press/scroll/back/wait/observe/extract/screenshot) addressing elements by numeric id from 'observe' or a CSS selector; 'run' executes JS with page/browser/tab/display/assert/wait in scope",
-  "18. done   {reason?}                  — call when the task is fully implemented AND verified",
+  "18. bisect {good, bad?, run, invert?, maxSteps?, stepTimeoutMs?} — binary-search git history to find the commit that introduced a regression; 'good' is a known-good commit, 'bad' defaults to HEAD, 'run' is a test command (exit 0=good, non-zero=bad, 125=skip), 'invert' finds a FIX instead of a regression",
+  "19. done   {reason?}                  — call when the task is fully implemented AND verified",
   "",
   "Reply with STRICT JSON only — no code fences. You MAY include an optional leading",
   '"reasoning" string (one short sentence on your plan) before "tool":',

package/src/agent/prompt-router.ts

@@ -18,17 +18,34 @@
  * `config.roles`/`config.routing.tiers` so a user who already configured
  * `roles.smol`/`roles.slow` (for `--smol`/`--slow` role-tier resolution
  * elsewhere) gets working routing with zero additional config. An unconfigured
- * trivial/complex tier does NOT simply collapse to `defaultModel` (that would
- * defeat cross-provider routing for every user who hasn't hand-tuned
- * `routing.tiers`) — it auto-selects the cheapest (trivial) / most capable
- * (complex) model jeo has a stored credential for, computed LIVE off
- * `MODEL_CATALOG`/`pricing.ts` on every call. This is the "long-term" fix for
- * catalog drift: when jeo ships a new/cheaper/stronger model, auto-select
- * picks it up on the next call automatically — no user config edit, no
- * hand-maintained tier→model table to go stale. "standard" is the one
- * exception: it always falls through to `defaultModel` unless explicitly
- * configured, since routine day-to-day work should stay on the user's
- * deliberately chosen default rather than being silently reassigned.
+ * trivial/high/complex tier does NOT simply collapse to `defaultModel` (that
+ * would defeat cross-provider routing for every user who hasn't hand-tuned
+ * `routing.tiers`) — it auto-selects the cheapest (trivial) / a strong
+ * mid-class model (high) / the most capable (complex) model jeo has a stored
+ * credential for, computed LIVE off `MODEL_CATALOG`/`pricing.ts` on every
+ * call. This is the "long-term" fix for catalog drift: when jeo ships a
+ * new/cheaper/stronger model, auto-select picks it up on the next call
+ * automatically — no user config edit, no hand-maintained tier→model table to
+ * go stale. "standard" is the one exception: it always falls through to
+ * `defaultModel` unless explicitly configured, since routine day-to-day work
+ * should stay on the user's deliberately chosen default rather than being
+ * silently reassigned (unless `routing.crossProviderPool` opts it into the
+ * session-stable cross-provider pool below).
+ *
+ * Four content-based tiers map onto the four `roles.*` price points
+ * (smol/medium/high/xhigh) so automatic routing can actually reach all of
+ * them: `trivial`→smol, `standard`→medium, `high`→roles.high (a single
+ * borderline-complex signal — e.g. one deep-work keyword alone — no longer
+ * jumps straight to the most expensive `complex`/xhigh tier), `complex`→xhigh.
+ *
+ * `routing.crossProviderPool` (opt-in, default off) activates
+ * `tierModelPool`/`selectFromPool` for the `standard`/`high` tiers: instead of
+ * a single deterministic pick, a SESSION-STABLE hash spreads different
+ * sessions across every credentialed provider's equivalent-class model, so
+ * jeo actually captures different providers' respective strengths on
+ * comparably-priced work instead of converging every session onto one
+ * provider. Off by default to preserve the "safe no-op absent configuration"
+ * contract for users who never opted in.
  */
 import { callLlm } from "./loop";
 import { resolveRoleModel } from "../ai/model-manager";
@@ -40,7 +57,7 @@ import type { ThinkLevel } from "../ai/model-catalog";
 import type { ProviderName } from "../ai/types";
 import type { AuthProvider } from "../auth";
 
-export type PromptTier = "trivial" | "standard" | "complex";
+export type PromptTier = "trivial" | "standard" | "high" | "complex";
 
 export interface HeuristicResult {
   tier: PromptTier;
@@ -62,6 +79,12 @@ export interface RouteDecision {
 export interface RoutePromptOptions {
   hasImages?: boolean;
   signal?: AbortSignal;
+  /** Threads through to `selectFromPool` for session-stable cross-provider pool
+   *  selection — the same session always lands on the same pool member (keeps
+   *  provider-side prompt caching warm turn-to-turn), while different sessions
+   *  spread across the pool. Omitted (e.g. a one-shot `jeo chat` call) ->
+   *  deterministic index 0. */
+  sessionId?: string;
 }
 
 // --- Frozen, bilingual-validated classification signals (do not re-derive). ---
@@ -143,7 +166,10 @@ export function classifyPromptHeuristically(prompt: string): HeuristicResult {
     return { tier: "standard", confidence: 0.35, signals }; // conflicting signals -> let escalation decide
   }
   if (complexScore >= 2) return { tier: "complex", confidence: 0.85, signals };
-  if (complexScore === 1) return { tier: "complex", confidence: 0.65, signals };
+  // A single complex signal alone is treated as "high" (elevated but not full complex) —
+  // price efficiency: one weak/borderline signal must not jump straight to the priciest
+  // xhigh tier (that's reserved for >=2 corroborating complex signals).
+  if (complexScore === 1) return { tier: "high", confidence: 0.65, signals };
   if (trivialScore >= 2) return { tier: "trivial", confidence: 0.85, signals };
   if (trivialScore === 1) return { tier: "trivial", confidence: 0.65, signals };
   return { tier: "standard", confidence: 0.9, signals }; // no signals at all -> common case, high confidence
@@ -185,12 +211,114 @@ function isCloudProvider(p: ProviderName): p is AuthProvider {
   return p !== "ollama" && p !== "lmstudio";
 }
 
+/** Size class jeo infers for a catalog model, used to group EQUIVALENT models
+ *  across DIFFERENT providers for pool-based routing (see `tierModelPool`) — the
+ *  cross-provider counterpart to `cheapestCredentialed`/`strongestCredentialed`'s
+ *  single-winner selection. Matches PROVIDER-DECLARED size-tier suffixes
+ *  (Anthropic's haiku/sonnet/opus, Google's flash/pro, OpenAI's mini) against
+ *  hyphen/dot-delimited SEGMENTS of the canonical id — NOT a raw substring match,
+ *  which would false-positive on "gemini" containing "mini" as a substring.
+ *  `null` for ids with no size-tier suffix at all (gpt-5.5, o3, grok-4.3, kimi-*,
+ *  glm-*, deepseek-*, minimax-* — providers whose naming doesn't encode size);
+ *  `tierModelPool` falls those back to a strength-tercile split instead. */
+function sizeClassFor(canonical: string): "small" | "mid" | "large" | null {
+  const id = canonical.toLowerCase();
+  const bare = id.includes("/") ? id.slice(id.indexOf("/") + 1) : id;
+  const segments = bare.split(/[-.]/);
+  if (segments.includes("haiku") || segments.includes("flash") || segments.includes("mini") || segments.includes("nano")) return "small";
+  if (segments.includes("opus") || segments.includes("ultra") || segments.includes("fable") || segments.includes("mythos")) return "large";
+  if (segments.includes("sonnet") || segments.includes("pro")) return "mid";
+  return null;
+}
+
+const TIER_TO_SIZE_CLASS: Record<PromptTier, "small" | "mid" | "large"> = { trivial: "small", standard: "mid", high: "mid", complex: "large" };
+
+/** Compares `releaseDate` ("YYYY-MM", lexicographically sortable). `>0` when `a`
+ *  is NEWER than `b`. A missing date sorts as OLDEST on that side — an
+ *  unconfirmed date can never silently outrank a verified-newer model. Shared
+ *  recency tiebreak for `compareStrengthAscending`/`cheapestCredentialed`/
+ *  `strongestCredentialed`, replacing the arbitrary alphabetical canonical-id
+ *  tiebreak those used before (which, on a full capability tie, picked the
+ *  OLDEST id alphabetically — e.g. `claude-opus-4-6` beating `claude-opus-4-8`
+ *  as "strongest" purely because "4-6" < "4-8" as a string). */
+function compareRecency(a: CatalogModel, b: CatalogModel): number {
+  if (a.releaseDate === b.releaseDate) return 0;
+  if (!a.releaseDate) return -1;
+  if (!b.releaseDate) return 1;
+  return a.releaseDate < b.releaseDate ? -1 : 1;
+}
+
+/** Multi-key strength comparator (ascending: weakest first) — same ranking signals
+ *  as `strongestCredentialed`'s single-winner tiebreak, reused here to bucket
+ *  UNCLASSIFIED (no size-suffix) models into a tercile fallback. */
+function compareStrengthAscending(a: CatalogModel, b: CatalogModel): number {
+  const xhighA = a.thinking.includes("xhigh") ? 1 : 0;
+  const xhighB = b.thinking.includes("xhigh") ? 1 : 0;
+  if (xhighA !== xhighB) return xhighA - xhighB;
+  if (a.maxOutputTokens !== b.maxOutputTokens) return a.maxOutputTokens - b.maxOutputTokens;
+  if (a.contextTokens !== b.contextTokens) return a.contextTokens - b.contextTokens;
+  const recency = compareRecency(a, b);
+  if (recency !== 0) return recency;
+  return a.canonical < b.canonical ? -1 : a.canonical > b.canonical ? 1 : 0;
+}
+
+/** Cross-provider EQUIVALENCE pool for `tier` — every credentialed cloud model
+ *  jeo classifies as the same size class (trivial→small, standard→mid,
+ *  complex→large), computed LIVE off `MODEL_CATALOG` so it stays correct as the
+ *  catalog evolves. Models with no size-tier-suffix (gpt-5.5, o3, grok-4.3,
+ *  kimi-*, glm-*, …) fall back to a strength-tercile bucket instead of being
+ *  silently excluded from every pool. Returns `[]` when zero credentialed
+ *  models qualify (caller falls back to `defaultModel`). Sorted by canonical id
+ *  for deterministic pool ordering (required by `selectFromPool`'s index math). */
+export function tierModelPool(tier: PromptTier, config: RoutingConfig): string[] {
+  const targetClass = TIER_TO_SIZE_CLASS[tier];
+  const credentialed = MODEL_CATALOG.filter(m => isCloudProvider(m.provider) && !m.limitedAvailability && (config.providers?.[m.provider] || config.oauth?.[m.provider]));
+
+  const suffixPool = credentialed.filter(m => sizeClassFor(m.canonical) === targetClass);
+
+  const unclassified = credentialed.filter(m => sizeClassFor(m.canonical) === null).sort(compareStrengthAscending);
+  const third = Math.ceil(unclassified.length / 3);
+  // "high" shares "standard"'s unclassified-model tercile share: the catalog's
+  // size-suffix classification only has 3 real buckets (small/mid/large — see
+  // sizeClassFor), so there is no distinct 4th tercile to carve out for "high".
+  // resolveTierModel's "high" branch does not currently rely on this tercile
+  // share (it prefers a deterministic strongest-mid-class pick — see
+  // strongestMidTierCredentialed below); kept here only so this `Record<PromptTier,…>`
+  // stays exhaustive for external callers of `tierModelPool("high", …)`.
+  const tercileByTier: Record<PromptTier, CatalogModel[]> = {
+    trivial: unclassified.slice(0, third),
+    standard: unclassified.slice(third, third * 2),
+    high: unclassified.slice(third, third * 2),
+    complex: unclassified.slice(third * 2),
+  };
+
+  const pool = [...suffixPool, ...tercileByTier[tier]];
+  return pool.map(m => m.canonical).sort();
+}
+
+/** Deterministic, SESSION-STABLE pick from `pool` — the same `sessionId` always
+ *  resolves to the same index within one pool (so a session's provider-side
+ *  prompt cache stays warm turn-to-turn, per this file's `deriveCacheSessionKey`
+ *  cache-correlation contract), while DIFFERENT sessions spread across the pool's
+ *  providers (the actual cross-provider distribution this feature exists for).
+ *  No `sessionId` (e.g. a one-shot `jeo chat` call) deterministically picks index
+ *  0 (the pool is canonical-id-sorted, so this is still stable, just unvaried). */
+export function selectFromPool(pool: readonly string[], sessionId: string | undefined): string {
+  if (pool.length === 0) throw new Error("selectFromPool: empty pool");
+  if (pool.length === 1 || !sessionId) return pool[0];
+  let h = 0x811c9dc5 | 0;
+  for (let i = 0; i < sessionId.length; i++) h = Math.imul(h ^ sessionId.charCodeAt(i), 0x01000193);
+  return pool[(h >>> 0) % pool.length];
+}
+
 /** Cheapest cloud model jeo has a credential for, computed LIVE off
  *  `MODEL_CATALOG`/`priceForModel` — picks up new/repriced catalog entries
  *  automatically, never a hand-maintained id. `null` when no credentialed
- *  model has a known price (caller falls back to `defaultModel`). Tiebreak:
- *  canonical id (deterministic across otherwise-equal candidates). */
-function cheapestCredentialed(config: RoutingConfig): string | null {
+ *  model has a known price (caller falls back to `defaultModel`). Tiebreak on
+ *  an exact cost tie: NEWER `releaseDate` wins (a same-priced newer model is
+ *  likely a refined successor), then canonical id (deterministic fallback
+ *  when recency also ties or is unconfirmed on both sides). */
+export function cheapestCredentialed(config: RoutingConfig): string | null {
   let best: CatalogModel | null = null;
   let bestCost = Infinity;
   for (const m of MODEL_CATALOG) {
@@ -199,13 +327,16 @@ function cheapestCredentialed(config: RoutingConfig): string | null {
     // wins (unlike provider-status.ts's `configuredCredential` precedence). The
     // real veto gate in launch.ts's `runTurn` re-verifies full readiness (including
     // live OAuth expiry) before a turn actually uses the model.
-    if (!isCloudProvider(m.provider) || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (!isCloudProvider(m.provider) || m.limitedAvailability || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
     const price = priceForModel(m.canonical);
     if (!price) continue;
     const cost = price.inPerM + price.outPerM;
-    if (cost < bestCost || (cost === bestCost && best && m.canonical < best.canonical)) {
+    if (cost < bestCost) {
       best = m;
       bestCost = cost;
+    } else if (cost === bestCost && best) {
+      const recency = compareRecency(m, best);
+      if (recency > 0 || (recency === 0 && m.canonical < best.canonical)) best = m;
     }
   }
   return best?.canonical ?? null;
@@ -213,46 +344,91 @@ function cheapestCredentialed(config: RoutingConfig): string | null {
 
 /** Most capable cloud model jeo has a credential for, computed LIVE off
  *  `MODEL_CATALOG` — ranks by full (xhigh) thinking support first, then max
- *  output tokens, then context window, so a newly catalogued frontier model
- *  is picked up automatically without a hand-maintained id. `null` when no
- *  credentialed model qualifies (caller falls back to `defaultModel`).
- *  Tiebreak: canonical id (deterministic; also happens to prefer widely-
- *  available ids like `claude-fable-5` alphabetically ahead of limited-
- *  availability siblings such as `claude-mythos-5`). */
-function strongestCredentialed(config: RoutingConfig): string | null {
+ *  output tokens, then context window, then NEWER `releaseDate` (a same-specs
+ *  model with a later release date is presumptively a refined successor — e.g.
+ *  `claude-opus-4-8` over `claude-opus-4-6`, which the OLD alphabetical
+ *  canonical-id tiebreak got backwards, since `"4-6" < "4-8"` picked the
+ *  OLDEST opus as "strongest"), then canonical id (final deterministic
+ *  fallback). `null` when no credentialed model qualifies (caller falls back
+ *  to `defaultModel`). Excludes `limitedAvailability` models (e.g.
+ *  `claude-mythos-5`) — a provider credential doesn't imply access to a
+ *  specific invite-only model; explicit `/model`/`routing.tiers` can still
+ *  target one by id for approved accounts. */
+export function strongestCredentialed(
+  config: RoutingConfig,
+  filter?: (m: CatalogModel) => boolean
+): string | null {
   let best: CatalogModel | null = null;
   for (const m of MODEL_CATALOG) {
     // "ANY stored credential" is enough (see cheapestCredentialed's comment above).
-    if (!isCloudProvider(m.provider) || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (!isCloudProvider(m.provider) || m.limitedAvailability || !(config.providers?.[m.provider] || config.oauth?.[m.provider])) continue;
+    if (filter && !filter(m)) continue;
     if (!best) { best = m; continue; }
     const xhighM = m.thinking.includes("xhigh") ? 1 : 0;
     const xhighBest = best.thinking.includes("xhigh") ? 1 : 0;
     if (xhighM !== xhighBest) { if (xhighM > xhighBest) best = m; continue; }
     if (m.maxOutputTokens !== best.maxOutputTokens) { if (m.maxOutputTokens > best.maxOutputTokens) best = m; continue; }
     if (m.contextTokens !== best.contextTokens) { if (m.contextTokens > best.contextTokens) best = m; continue; }
+    const recency = compareRecency(m, best);
+    if (recency !== 0) { if (recency > 0) best = m; continue; }
     if (m.canonical < best.canonical) best = m;
   }
   return best?.canonical ?? null;
 }
 
+/** Strongest credentialed model restricted to the SAME "mid" size class
+ *  `tierModelPool` uses for `standard` (sonnet/pro-suffixed families) — the
+ *  auto-select fallback for the `high` tier. Deliberately narrower than
+ *  `strongestCredentialed`'s catalog-wide search: an unrestricted search would
+ *  frequently tie with (or even prefer) `complex`'s own pick, since several
+ *  "unclassified" frontier ids (gpt-5.5, grok-4.3, …) publish flagship-tier
+ *  specs under a name with no size-suffix at all and would otherwise win over
+ *  a genuinely mid-class model like `claude-sonnet-4-6`. `null` when no
+ *  mid-class-suffixed model is credentialed (caller falls through to
+ *  `roles.medium`/`defaultModel` — never to `complex`'s flagship pick). */
+function strongestMidTierCredentialed(config: RoutingConfig): string | null {
+  const midClass = MODEL_CATALOG.filter(
+    m => isCloudProvider(m.provider) && !m.limitedAvailability && sizeClassFor(m.canonical) === "mid" && (config.providers?.[m.provider] || config.oauth?.[m.provider]),
+  );
+  if (midClass.length === 0) return null;
+  return midClass.sort(compareStrengthAscending).at(-1)!.canonical;
+}
+
+/** `routing.crossProviderPool` (opt-in, default off) fallback for ALL FOUR tiers:
+ *  a SESSION-STABLE pick from `tierModelPool(tier, config)` instead of each
+ *  tier's deterministic single-winner pick (`cheapestCredentialed`/
+ *  `strongestMidTierCredentialed`/`strongestCredentialed`). Off (or an empty
+ *  pool) returns `null` so the caller's next fallback applies unchanged — this
+ *  is purely additive: a user who has not set the flag keeps v0.7.56's exact
+ *  single-winner behavior; setting it distributes qualifying tiers across
+ *  every credentialed provider's equivalent-class model instead of always
+ *  resolving to the one deterministic winner. */
+function crossProviderPoolPick(tier: PromptTier, config: RoutingConfig, sessionId: string | undefined): string | null {
+  if (!config.routing?.crossProviderPool) return null;
+  const pool = tierModelPool(tier, config);
+  return pool.length > 0 ? selectFromPool(pool, sessionId) : null;
+}
+
 // --- Tier -> model/thinking resolution (inline off config.roles/config.routing.tiers; no static map). ---
 
 /** Exported for `jeo doctor`'s routing-preview diagnostic (same resolution the real
  *  `routePrompt` uses — no duplicated logic between "what WILL routing pick" and
  *  "what does doctor SHOW the user routing will pick"). */
-export function resolveTierModel(tier: PromptTier, config: RoutingConfig): string {
+export function resolveTierModel(tier: PromptTier, config: RoutingConfig, sessionId?: string): string {
   const configured = config.routing?.tiers?.[tier]?.model;
   if (configured) return configured;
-  if (tier === "trivial") return config.roles?.smol || cheapestCredentialed(config) || config.defaultModel;
-  if (tier === "complex") return config.roles?.slow || strongestCredentialed(config) || config.defaultModel;
-  return config.defaultModel; // "standard" always falls through to defaultModel unless explicitly configured
+  if (tier === "trivial") return config.roles?.smol || crossProviderPoolPick(tier, config, sessionId) || cheapestCredentialed(config) || config.defaultModel;
+  if (tier === "standard") return config.roles?.medium || config.roles?.high || crossProviderPoolPick(tier, config, sessionId) || config.defaultModel;
+  if (tier === "high") return config.roles?.high || config.roles?.medium || crossProviderPoolPick(tier, config, sessionId) || strongestMidTierCredentialed(config) || config.defaultModel;
+  if (tier === "complex") return config.roles?.xhigh || config.roles?.slow || crossProviderPoolPick(tier, config, sessionId) || strongestCredentialed(config) || config.defaultModel;
+  return config.defaultModel;
 }
 
 function resolveTierThinking(tier: PromptTier, config: RoutingConfig): ThinkLevel | undefined {
   return config.routing?.tiers?.[tier]?.thinking; // undefined = no override, caller keeps session/global level
 }
 
-const VALID_TIERS: readonly PromptTier[] = ["trivial", "standard", "complex"];
+const VALID_TIERS: readonly PromptTier[] = ["trivial", "standard", "high", "complex"];
 function isPromptTier(value: unknown): value is PromptTier {
   return typeof value === "string" && (VALID_TIERS as readonly string[]).includes(value);
 }
@@ -266,8 +442,9 @@ function buildClassifierPrompt(prompt: string): string {
   return (
     `Classify the complexity of the following user request for a coding assistant into exactly one ` +
     `tier: "trivial" (a quick factual lookup, no repo work), "standard" (routine coding/editing work), ` +
-    `or "complex" (multi-file, architectural, or root-cause debugging work). ` +
-    `Respond with ONLY a JSON object of the shape {"tier":"trivial"|"standard"|"complex"}.\n\n` +
+    `"high" (a single moderately complex change — one non-trivial refactor/debug in one area, not yet ` +
+    `multi-file or architectural), or "complex" (multi-file, architectural, or root-cause debugging work). ` +
+    `Respond with ONLY a JSON object of the shape {"tier":"trivial"|"standard"|"high"|"complex"}.\n\n` +
     `Request:\n${capped}`
   );
 }
@@ -336,7 +513,7 @@ export async function routePrompt(
       }
     }
 
-    const model = resolveTierModel(tier, config);
+    const model = resolveTierModel(tier, config, opts.sessionId);
     if (opts.hasImages && catalogMetadata(model)?.images === false) return null;
 
     const decision: RouteDecision = {