jeo-code 0.8.15 → 0.8.16

package/CHANGELOG.md

@@ -6,6 +6,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.16] - 2026-07-09
+_"jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind._
+
+### Added
+- **`/computer [status|on|off]` slash command** (`src/commands/launch/computer-slash.ts`, `src/commands/launch.ts`, `src/tui/components/slash.ts`) — mirrors `/route`'s session-local-override pattern. `executeComputerAction` (`src/commands/computer.ts`) now accepts an `opts.enabledOverride` that wins over `config.computer.enabled` when set, and forwards through batched sub-actions. `/computer on|off` sets a REPL-local override for the current session only (never persisted); `/computer status` reports the effective on/off state and reminds the caller that the fail-closed `computerSupervisor` kill-switch/heartbeat gate still applies independently to every non-read-only action.
+- **New mascot artwork** (`assets/character-v2.png`) — a second character illustration (god-tibo-imagen / `gti`, same crimson-shell/cyan-magenta-glasses/purple-DNA-robe identity as `character.png`) depicting the mascot piloting the desktop-automation control panel while juggling provider-routing nodes, tying the two headline features (prompt routing, computer use) into one image.
+
+### Verified
+- `bun run typecheck` — no errors.
+- `bun test test/computer-slash.test.ts test/computer.test.ts test/computer-supervisor.test.ts test/engine-computer-wiring.test.ts` — 25 pass / 0 fail (new `/computer` subcommand coverage + `enabledOverride` true/false end-to-end execution cases).
+- `bun test test/slash.test.ts` — 30 pass / 0 fail (palette prefix-match fixture updated for the new `/computer` entry).
+- Full `bun test` — 2843 pass / 1 pre-existing unrelated flake (`reachability veto: ...unreachable ollama model...`), 0 fail introduced by this change.
+
+
 ## [0.8.15] - 2026-07-09
 _"api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed._
 

package/README.ja.md

@@ -262,11 +262,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 - **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 - **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
-- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -263,11 +263,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 - **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 - **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
-- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -17,8 +17,10 @@
 
 <p align="center">
   <img src="assets/character.gif" alt="animated jeo-code red crayfish mascot smart-routing a prompt to the cheapest provider and saving coins" width="320" />
+  <img src="assets/character-v2.png" alt="jeo-code red crayfish mascot piloting the computer-use desktop-automation control panel while juggling prompt-routing provider nodes" width="320" />
 </p>
 
+
 <p align="center">
   <b>English</b> ·
   <a href="README.ko.md">한국어</a> ·
@@ -38,7 +40,10 @@ Run `jeo` inside a repository and it reads files, edits them, runs commands, and
 
 ## Highlights
 
+- **Prompt routing (cost-aware, credential-aware)** — every turn can auto-route to a tier-appropriate model among only the providers your configured credentials actually serve (`/route [status|on|off|why]`), with a live equivalent-model fallback whenever a routed provider is rate-limited, unauthenticated, unreachable, or silently times out — see `/route why` for the last decision.
+- **Computer use (desktop automation)** — a fail-closed `computer` tool (screenshot/click/type/scroll/drag/batch) gated by both a config flag and an independent kill-switch/heartbeat supervisor; toggle it for the current session with `/computer [status|on|off]` without touching `~/.jeo/config.json`.
 - **Multi-provider, one loop** — Anthropic / OpenAI (+Codex) / Gemini / Antigravity / Ollama / LM Studio, plus 20+ OpenAI- and Anthropic-compatible clouds (Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai, …), all behind one uniform JSON tool loop. OAuth login happens from the input box (`/provider login`), every model pick persists as the new default, and prompt routing only auto-selects usable credentialed paths: Gemini OAuth goes through the provider-qualified `antigravity/*` agent set (Gemini 3.5 Flash tiers, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6), never public `google/gemini-*` rows that require `GEMINI_API_KEY`; if a configured route points at an unready provider, jeo switches to an equivalent credentialed tier model before falling back to the default.
+
 - **Edit integrity** — read output carries content anchors (`42ab|`); anchored edits are verified against the current file, re-mapped when lines shifted, and rejected with fresh content instead of corrupting.
 - **Self-correcting verification loop** — configure a post-edit hook (tsc / eslint / tests) and the agent *sees* the diagnostics and fixes them in-loop; a red hook blocks `done` until resolved.
 - **Real gates, no theater** — `ralplan` consensus is a repo-grounded critic subagent whose `[OKAY]` verdict is persisted and *required* by `jeo approve`; `ultragoal` reports honestly (a suite run is a global signal, never fabricated per-criterion passes).
@@ -265,11 +270,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 - **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 - **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
-- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -262,11 +262,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 - **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 - **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
-- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.15",
+  "version": "0.8.16",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/prompt-router.ts

@@ -58,6 +58,8 @@ import type { AuthProvider } from "../auth";
 
 export type PromptTier = "trivial" | "standard" | "high" | "complex";
 
+export const PROMPT_TIERS = ["trivial", "standard", "high", "complex"] as const satisfies readonly PromptTier[];
+
 export interface HeuristicResult {
   tier: PromptTier;
   confidence: number; // 0..1
@@ -93,7 +95,7 @@ const RE_CAUSAL_KR = /(왜\s|근본\s*원인|이유가|어떻게|이유|어째
 const RE_TRIVIAL_QUESTION_WORD = /\b(what|who|when|where|which)\b/i;
 const RE_TRIVIAL_QUESTION_WORD_KR = /(뭐|뭔가요|무엇|언제|어디|누구|몇\s|인가요|있나요|냐|음\?|인가)/;
 const RE_CODE_FENCE = /```/;
-const RE_CODE_SNIPPET = /(?:const|let|var|import|export|function|class|if\s*\(|try\s*{|=>|\{\s*[\w\d_]+\s*\})/;
+const RE_CODE_SNIPPET = /(?:\b(?:const|let|var)\s+\w+\s*=|\bimport\s+.*?\s+from\s+['"`\.\/]|\bexport\s+(?:const|let|var|function|class|default)\b|\b(?:function|class)\s+\w+|if\s*\(|try\s*{|=>|\{\s*[\w\d_]+\s*\})/;
 const RE_PATH_TOKEN = /(?:^|[\s"'`(])@?(?:\.{0,2}[\w-]*[\/\\])+[\w-]+(?:\.[\w-]+)*(?:\.[A-Za-z]\w{0,7}|[\/\\])\b/g;
 const RE_CLI_COMMAND = /(?:^|\s)(git|npm|bun|docker-compose|pip|cargo)\s+[a-z-_]+/i;
 const RE_DEEP_KEYWORDS_EN = /\b(design|architecture|refactor|debug|deep\s*dive|investigate|diagnose|redesign)\b/i;
@@ -118,12 +120,12 @@ export function classifyPromptHeuristically(prompt: string): HeuristicResult {
     signals.push("short-question");
   }
 
-  // trivial signal 2: no code fence AND no code snippet AND no file path mention AND no CLI command.
+  // trivial signal 2: no code fence AND no code snippet AND no file path mention.
   const hasCodeFence = RE_CODE_FENCE.test(trimmed);
   const hasCodeSnippet = RE_CODE_SNIPPET.test(trimmed);
   const hasCliCommand = RE_CLI_COMMAND.test(trimmed);
   const pathMatches = [...trimmed.matchAll(RE_PATH_TOKEN)];
-  if (!hasCodeFence && !hasCodeSnippet && !hasCliCommand && pathMatches.length === 0) {
+  if (!hasCodeFence && !hasCodeSnippet && pathMatches.length === 0) {
     trivialScore++;
     signals.push("no-code-no-path");
   }
@@ -261,6 +263,24 @@ function sizeClassFor(model: CatalogModel): "small" | "mid" | "large" | null {
   if (segments.includes("sonnet") || segments.includes("pro")) return "mid";
   return null;
 }
+const SIZE_CLASS_TO_TIER: Record<"small" | "mid" | "large", PromptTier> = { small: "trivial", mid: "standard", large: "complex" };
+
+/** Infers the `PromptTier` whose equivalence pool matches `model`'s size class — lets a
+ *  NON-ROUTED turn (routing disabled, or the user pinned a model via `/model`) reuse the
+ *  same cross-provider equivalent-pool fallback (`tierModelPool`/`equivalentRouteFallback`
+ *  in launch.ts) that a routed turn already gets on a usage-limit/rate-limit/credential
+ *  failure — without silently downgrading a pinned flagship (e.g. opus) to a cheap
+ *  trivial-tier substitute, or promoting a pinned cheap model to an expensive one. `null`
+ *  sizeClass (no size-tier suffix — gpt-5.5/o3/grok-4.3/kimi-* / glm-* / …) and an
+ *  uncatalogued model id both default to "standard" (the mid pool) as a reasonable
+ *  middle ground rather than guessing complex/trivial. */
+export function inferTierForModel(model: string): PromptTier {
+  const meta = catalogMetadata(model);
+  if (!meta) return "standard";
+  const cls = sizeClassFor(meta);
+  return cls ? SIZE_CLASS_TO_TIER[cls] : "standard";
+}
+
 
 const TIER_TO_SIZE_CLASS: Record<PromptTier, "small" | "mid" | "large"> = { trivial: "small", standard: "mid", high: "mid", complex: "large" };
 
@@ -455,9 +475,30 @@ function resolveTierThinking(tier: PromptTier, config: RoutingConfig): ThinkLeve
   return config.routing?.tiers?.[tier]?.thinking; // undefined = no override, caller keeps session/global level
 }
 
-const VALID_TIERS: readonly PromptTier[] = ["trivial", "standard", "high", "complex"];
+/** Apply one interactive `/model` pick to a PromptRouter tier without touching the
+ *  global model registry. The write enables routing because a configured tier is
+ *  otherwise invisible until `routing.enabled` is set. */
+export function withRoutingTierSetting(
+  config: Pick<Config, "routing">,
+  tier: PromptTier,
+  patch: { model: string; thinking?: ThinkLevel },
+): NonNullable<Config["routing"]> {
+  return {
+    ...(config.routing ?? {}),
+    enabled: true,
+    tiers: {
+      ...(config.routing?.tiers ?? {}),
+      [tier]: {
+        ...(config.routing?.tiers?.[tier] ?? {}),
+        model: patch.model,
+        thinking: patch.thinking,
+      },
+    },
+  };
+}
+
 function isPromptTier(value: unknown): value is PromptTier {
-  return typeof value === "string" && (VALID_TIERS as readonly string[]).includes(value);
+  return typeof value === "string" && (PROMPT_TIERS as readonly string[]).includes(value);
 }
 
 /** Hard cap on how much of the prompt is embedded in the escalation classifier call —

package/src/commands/computer.ts

@@ -53,16 +53,21 @@ async function runCommand(cmd: string[]): Promise<{ success: boolean; stdout: st
   }
 }
 
-export async function executeComputerAction(action: ComputerAction): Promise<{ success: boolean; output: string; error?: string }> {
-  const config = await readGlobalConfig().catch(() => null);
-  if (!config?.computer?.enabled) {
+export async function executeComputerAction(action: ComputerAction, opts?: { enabledOverride?: boolean }): Promise<{ success: boolean; output: string; error?: string }> {
+  let enabled = opts?.enabledOverride;
+  if (enabled === undefined) {
+    const config = await readGlobalConfig().catch(() => null);
+    enabled = !!config?.computer?.enabled;
+  }
+  if (!enabled) {
     return {
       success: false,
       output: "",
-      error: "Computer use is disabled. Enable it by setting 'computer.enabled: true' in ~/.jeo/config.json",
+      error: "Computer use is disabled. Enable it by running '/computer on' this session, or setting 'computer.enabled: true' in ~/.jeo/config.json",
     };
   }
 
+
   // Read-only actions don't need supervisor inputAllowed check
   const isReadOnly = action.action === "screenshot" || action.action === "wait";
   if (!isReadOnly) {
@@ -247,7 +252,8 @@ export async function executeComputerAction(action: ComputerAction): Promise<{ s
       const results: string[] = [];
       for (let i = 0; i < action.actions.length; i++) {
         const subAction = action.actions[i];
-        const res = await executeComputerAction(subAction);
+        const res = await executeComputerAction(subAction, opts);
+
         if (!res.success) {
           const err = `Batch failed at step ${i}: ${res.error}`;
           await logAudit(action, false, err);

package/src/commands/launch/computer-slash.ts

@@ -0,0 +1,61 @@
+/**
+ * `/computer` slash-command handler, mirroring `/route`'s extraction pattern
+ * (see `route-slash.ts`). Handles `/computer [status|on|off]` — toggles a
+ * SESSION-LOCAL override of `config.computer.enabled` (the safety-gated
+ * desktop-automation tool executed by `executeComputerAction` in
+ * `../computer.ts`), without requiring the user to hand-edit
+ * `~/.jeo/config.json`.
+ *
+ * Session-level toggle only — `sessionComputerOverride` is never persisted
+ * (mirrors `/route`'s `sessionRouteOverride`). Turning it on for a session
+ * does NOT relax the fail-closed `computerSupervisor` kill-switch/heartbeat
+ * gate inside `executeComputerAction` — it only satisfies the separate
+ * `config.computer.enabled` config gate that sits in front of it. Both gates
+ * must pass for any non-read-only action to actually execute.
+ */
+
+export interface ComputerSlashCtx {
+  sessionComputerOverride: boolean | undefined;
+  /** `turnConfig.computer?.enabled ?? false`, read fresh by the caller. */
+  computerConfigEnabled: boolean;
+}
+
+export interface ComputerSlashResult {
+  /** Present only when changed by "on"/"off". */
+  sessionComputerOverride?: boolean | undefined;
+  /** Lines to print. */
+  lines: string[];
+}
+
+const USAGE = "Usage: /computer [status|on|off]";
+
+/**
+ * Handle `/computer [status|on|off]`. Extracted for the same reason as
+ * `/route`: shares REPL-local computer-use state with `runTurn` via an
+ * explicit ctx/result object rather than closing over it.
+ */
+export function runComputerSlash(input: string, ctx: ComputerSlashCtx): ComputerSlashResult {
+  const rest = input.slice("/computer".length).trim();
+  const [sub] = rest.split(/\s+/).filter(Boolean);
+  const effective = ctx.sessionComputerOverride ?? ctx.computerConfigEnabled;
+
+  if (!sub || sub === "status") {
+    const lines = [`computer use: ${effective ? "on" : "off"} (this session)`];
+    if (!effective) {
+      lines.push("note: the 'computer' tool is fail-closed while off — run '/computer on' to enable it for this session, or set 'computer.enabled: true' in ~/.jeo/config.json to enable it by default.");
+    } else {
+      lines.push("note: the fail-closed kill-switch/heartbeat supervisor still gates every non-read-only action (screenshot/wait are exempt) independently of this toggle.");
+    }
+    return { lines };
+  }
+
+  if (sub === "on") {
+    return { sessionComputerOverride: true, lines: ["computer use: on (this session)"] };
+  }
+
+  if (sub === "off") {
+    return { sessionComputerOverride: false, lines: ["computer use: off (this session)"] };
+  }
+
+  return { lines: [`Unknown /computer subcommand: ${sub}`, USAGE] };
+}

package/src/commands/launch.ts

@@ -2,6 +2,9 @@ import { createInterface } from "node:readline/promises";
 import { emitKeypressEvents } from "node:readline";
 import { PassThrough } from "node:stream";
 import { runAgentLoop, DEFAULT_TOOLS, TOOL_PROTOCOL, WORKING_DISCIPLINE, OUTPUT_DISCIPLINE, VERIFICATION_DIRECTIVE, type AgentLoopEvents } from "../agent/engine";
+import { computerSupervisor } from "../agent/computer-supervisor";
+import { executeComputerAction } from "./computer";
+
 import { createOpikTracer, wrapEvents } from "../agent/opik-tracer";
 import { initialDynamicStepLimit } from "../agent/step-budget";
 import { memoryPromptSection, spawnDetachedDistill, recordFailedAttempt } from "../agent/memory";
@@ -48,8 +51,10 @@ import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recen
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal } from "../agent/goal-verifier";
-import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, type RouteDecision } from "../agent/prompt-router";
-import { isRateLimitError, isUsageLimitError } from "../util/retry";
+import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, type PromptTier, type RouteDecision } from "../agent/prompt-router";
+
+import { isRateLimitError, isUsageLimitError, isConnectionError } from "../util/retry";
+
 
 import { listAliases } from "../ai/model-registry";
 import { openaiCompatDef, SUBSCRIPTION_PROVIDER_NAMES } from "../ai/providers/openai-compatible-catalog";
@@ -206,6 +211,8 @@ import { handleUndoSlash } from "./launch/git-slash";
 import { runSessionSlash } from "./launch/session-slash";
 import { runModelSlash } from "./launch/model-slash";
 import { runRouteSlash } from "./launch/route-slash";
+import { runComputerSlash } from "./launch/computer-slash";
+
 import { runAgentsSlash, runRolesSlash, runFastSlash, runThinkingSlash } from "./launch/agents-slash";
 import { wikiRootPromptLine, decideWikiSlash } from "./launch/wiki-slash";
 import { decideThemeSlash, buildConfigPanelLines, runEvolveSimulation } from "./launch/system-slash";
@@ -652,6 +659,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let sessionRouteOverride: boolean | undefined;
   // Last routing decision (or the reason none applied) — /route why reads this.
   let lastRouteDecision: RouteDecision | { note: string } | null = null;
+  // Computer-use session override: undefined = follow config.computer.enabled, true/false = /computer on|off wins this session.
+  let sessionComputerOverride: boolean | undefined;
+
   // Cache of live, credential-validated models per provider (refreshed by live pickers).
   let liveModelsCache: ProviderModelsResult[] | null = null;
   const getLiveModels = async (force = false): Promise<ProviderModelsResult[]> => {
@@ -887,9 +897,26 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     let routeVetoNote: string | undefined;
     const equivalentRouteFallback = async (decision: RouteDecision, reason: string, exclude: readonly string[] = []): Promise<string | null> => {
       const excluded = new Set([decision.model, ...exclude]);
-      const candidates = tierModelPool(decision.tier, turnConfig)
-        .filter(model => !excluded.has(model))
-        .filter(model => !images?.length || catalogMetadata(model)?.images !== false);
+      const poolCandidates = (): string[] =>
+        tierModelPool(decision.tier, turnConfig)
+          .filter(model => !excluded.has(model))
+          .filter(model => !images?.length || catalogMetadata(model)?.images !== false);
+      let candidates = poolCandidates();
+      // The static MODEL_CATALOG only lists a couple of OpenAI-compatible clouds by
+      // name (tencent, xai) — every other API-key provider (groq, deepseek, mistral,
+      // openrouter, …) only enters `tierModelPool` once its `/models` endpoint has
+      // been discovered THIS session (`recordLiveProviderModels`, driven by
+      // `getLiveModels`). Interactive sessions warm that cache in the background at
+      // startup, but a ONE-SHOT invocation (`jeo -p`/piped input) never calls
+      // `getLiveModels()` at all — so a credentialed-but-undiscovered API provider
+      // had ZERO fallback candidates even though the user's key works. Warming here
+      // is cheap: `getLiveModels()` caches its result (`liveModelsCache`), so this
+      // only pays real discovery latency once per cold session, exactly when the
+      // primary model already failed and a fallback is genuinely needed.
+      if (candidates.length === 0) {
+        await getLiveModels().catch(() => []);
+        candidates = poolCandidates();
+      }
       if (candidates.length === 0) return null;
       const selected = selectFromPool(candidates, sessionId ? `${sessionId}:fallback:${decision.model}:${reason}` : undefined);
       const start = Math.max(0, candidates.indexOf(selected));
@@ -919,9 +946,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       routeCredentialNotice = warnOnce(noticeKey, `${notice} Switching to equivalent '${fallback}' for this turn.`);
       return { ...decision, model: fallback, warning: decision.warning ? `${decision.warning}; ${routeVetoNote}` : routeVetoNote };
     };
-    let routed = routingEnabled && !sessionModel
+    // `sessionRouteOverride === true` means the user explicitly ran `/route on` —
+    // that explicit request wins over a prior model pin (`sessionModel`, from
+    // `--model`/`/model`) so routing actually evaluates every prompt as asked,
+    // instead of being silently blocked by a pin the user may have forgotten about.
+    // Routing enabled only via config (`routing.enabled: true`, no explicit /route
+    // toggle this session) still respects an existing pin, as before.
+    const routeOverridesPin = sessionRouteOverride === true;
+    let routed = routingEnabled && (routeOverridesPin || !sessionModel)
       ? await routePrompt(userInput, turnConfig, { hasImages: !!images?.length, sessionId }).catch(() => null)
       : null;
+
     // Fail-open credential gate: `routePrompt` only resolves a tier's model from
     // config (routing.tiers/roles.smol/roles.slow/defaultModel) — it deliberately
     // stays pure/config-only (see its narrowed `Pick<Config,...>` param) and never
@@ -989,8 +1024,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         }
       }
     }
-    lastRouteDecision = routed ?? (routeVetoNote ? { note: routeVetoNote } : routingEnabled && !sessionModel ? { note: "routing produced no decision (fail-open)" } : { note: "routing not active this turn" });
-    // Explicit /model always wins: `routed` is only ever computed when `!sessionModel`.
+    lastRouteDecision = routed ?? (routeVetoNote ? { note: routeVetoNote } : routingEnabled && (routeOverridesPin || !sessionModel) ? { note: "routing produced no decision (fail-open)" } : { note: "routing not active this turn" });
+    // Explicit /model always wins UNLESS an explicit `/route on` this session opted
+    // back into per-prompt routing (`routeOverridesPin`); otherwise `routed` is only
+    // ever computed when `!sessionModel`.
+
     let activeModel = routed?.model ?? (sessionModel || defaultModel);
     let activeThinking = routed?.thinking ?? sessionThinking;
     // Provider-side prompt caches are keyed PER MODEL — reusing the bare `sessionId`
@@ -1296,6 +1334,15 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           irc: createIrcTool(subagentRegistry),
           goal: createGoalTool(),
           approve: createApproveTool(),
+          // `/computer on|off` session override wins over `config.computer.enabled`
+          // (see `sessionComputerOverride`/`computer-slash.ts`); undefined = fall
+          // through to DEFAULT_TOOLS' own config-only gate inside executeComputerAction.
+          computer: (a: Record<string, any>) => {
+            computerSupervisor.setKillSwitchLive(true);
+            computerSupervisor.heartbeat();
+            return executeComputerAction(a as any, { enabledOverride: sessionComputerOverride });
+          },
+
         };
         const tools = filterToolMap(fullTools, Array.from(allowedTools));
         // Opik observability (opt-in via JEO_OPIK): one trace per turn, spans per
@@ -1327,6 +1374,46 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           const asError = new Error(message);
           if (isRateLimitError(asError)) return "hit a rate limit";
           if (isUsageLimitError(asError)) return "hit a usage/quota limit";
+          // Auth/credential failures (401/403 rejection, missing/expired credential) are
+          // an operational fault of THIS provider, not the prompt or the model's
+          // capability — the equivalent-pool fallback exists precisely to route around a
+          // provider whose credential just broke (expired OAuth token, revoked key, no
+          // key configured) mid-session, instead of failing the whole turn.
+          if (/rejected the credential|no credential for provider|no usable credential|\b401\b|\b403\b/i.test(message)) {
+            return "is unauthenticated for this session";
+          }
+          // Pre-response connection failures (refused/unresolvable host, local
+          // ollama/lmstudio server down, unreachable custom base URL) — see
+          // isConnectionError's docs. Distinct from a mid-stream drop (transient,
+          // already retried by the engine) or a genuine timeout (handled below).
+          if (isConnectionError(asError) || /could not connect|is unreachable at/i.test(message)) {
+            return "is unreachable";
+          }
+          // A silent/no-response provider (the call ran the full wall-clock timeout
+          // with no usable output) is exactly the "no response" exception the
+          // equivalent-pool fallback exists to route around.
+          if (/did not complete the request within the call timeout|the operation timed out|exceeded the overall deadline/i.test(message)) {
+            return "did not respond in time";
+          }
+          // Billing/payment failures (HTTP 402 — quota exhausted with postpaid billing
+          // off, insufficient credit, free-trial exhausted) are a provider-account
+          // fault, not a prompt/model problem: the SAME account's other models are
+          // often unaffected (observed: Tencent's kimi-k2.5/deepseek-v3.2 402 while
+          // deepseek-v4-flash/glm-5.2 on the SAME key kept working). Reroute exactly
+          // like a rate/usage limit instead of leaving a configured-but-billing-blocked
+          // model dead for the rest of the session.
+          if (/\b402\b|payment required|insufficient credit|billing (?:is )?not enabled|free trial quota/i.test(message)) {
+            return "requires billing/payment on this provider account";
+          }
+          // A persistent 5xx that SURVIVED the model-manager's own retry budget
+          // (withRetry already backed off 500/502/503/504/529 internally — see
+          // defaultRetryable's RETRYABLE_STATUS) means the provider's server itself
+          // is down/overloaded beyond what backoff can recover from THIS session.
+          // Equally a provider-side fault as the classes above, not a prompt issue.
+          if (/\b(?:500|502|503|504|529)\b/.test(message)) {
+            return "hit a persistent server-side error";
+          }
+
           if (/does not recognize the requested model|model .*?(?:not found|not available|unavailable|unsupported|retired|gated)|\b(?:400|404)\b/i.test(message)) {
             return "is unavailable";
           }
@@ -1351,23 +1438,39 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           ? Math.floor(routeFallbackMaxRaw)
           : 3;
         const attemptedRouteModels = new Set<string>([activeModel]);
-        for (let routeFallbackAttempt = 0; routed && routeFallbackAttempt < routeFallbackMax; routeFallbackAttempt++) {
+        // A NON-routed turn (routing disabled, or the user pinned a model via /model)
+        // still needs the equivalent-pool fallback on a usage-limit/rate-limit/credential
+        // failure — the exact "5-hour usage window exhausted, model just stops working"
+        // case this loop exists to fix. Synthesize a same-size-class RouteDecision
+        // (inferTierForModel) so `equivalentRouteFallback` has a tier/pool to search even
+        // with routing off; a real `routed` decision (routing enabled) is used unchanged.
+        let fallbackBaseDecision: RouteDecision = routed ?? {
+          model: activeModel,
+          thinking: activeThinking,
+          tier: inferTierForModel(activeModel),
+          confidence: 1,
+          source: "heuristic",
+          signals: [],
+        };
+        for (let routeFallbackAttempt = 0; routeFallbackAttempt < routeFallbackMax; routeFallbackAttempt++) {
           const routedFailureReason = !result.done ? routeFailureReason(result.doneReason) : null;
           if (!routedFailureReason) break;
-          const fallback = await equivalentRouteFallback(routed, routedFailureReason, [...attemptedRouteModels]);
+          const fallback = await equivalentRouteFallback(fallbackBaseDecision, routedFailureReason, [...attemptedRouteModels]);
           if (!fallback) break;
           const previousModel = activeModel;
           attemptedRouteModels.add(fallback);
           activeModel = fallback;
-          activeThinking = routed.thinking ?? sessionThinking;
+          activeThinking = fallbackBaseDecision.thinking ?? sessionThinking;
           turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
           contextTokens = catalogMetadata(activeModel)?.contextTokens;
-          lastRouteDecision = { ...routed, model: activeModel, warning: `routed model '${previousModel}' ${routedFailureReason}; switched to equivalent '${activeModel}'` };
-          const notice = `[route] routed model '${previousModel}' ${routedFailureReason}; switching to equivalent '${activeModel}' for this turn.`;
+          fallbackBaseDecision = { ...fallbackBaseDecision, model: activeModel };
+          lastRouteDecision = { ...fallbackBaseDecision, warning: `model '${previousModel}' ${routedFailureReason}; switched to equivalent '${activeModel}'` };
+          const notice = `[route] model '${previousModel}' ${routedFailureReason}; switching to equivalent '${activeModel}' for this turn.`;
           if (tui) tui.events().onNotice?.(notice);
           else console.log(notice);
           result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
         }
+
         if (result.done && looksLikeSkillEcho(result.doneReason ?? "", resolvedSkills)) {
           history.push({
             role: "user",
@@ -2845,6 +2948,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         color: "default",
       },
     ];
+    for (const tier of PROMPT_TIERS) {
+      const configured = cfg.routing?.tiers?.[tier];
+      if (!configured?.model) continue;
+      assignments.push({
+        role: `routing:${tier}`,
+        label: `ROUTE:${tier}`,
+        model: configured.model,
+        thinking: configured.thinking ?? "auto",
+        color: "default",
+      });
+    }
     for (const roleId of orderedRoleIds) {
       const role = byId.get(roleId);
       if (!role) continue;
@@ -2950,9 +3064,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     title: string,
     current: ThinkLevel | undefined,
     inheritLabel?: string,
+    supportedLevels?: readonly ThinkLevel[],
   ): Promise<ThinkLevel | "inherit" | undefined> => {
     const levels = buildThinkingLevelChoices(current, {
       inheritLabel,
+      levels: supportedLevels,
       tokenHint: lvl => `~${Math.round(thinkingMaxTokens(lvl as ThinkLevel) / 1000)}k tokens`,
     });
     const picked = await pickFromOptions(title, levels);
@@ -3023,6 +3139,35 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       return true;
     }
 
+    if (targetId.startsWith("routing:")) {
+      const tier = targetId.slice("routing:".length) as PromptTier;
+      if (!PROMPT_TIERS.includes(tier)) return false;
+      const meta = catalogMetadata(target);
+      const supportedThinking = meta?.thinking ?? [];
+      const currentRouteThinking = cfgForPick.routing?.tiers?.[tier]?.thinking;
+      let thinking: ThinkLevel | undefined;
+      if (supportedThinking.length > 0) {
+        const level = await pickThinkingLevel(
+          `Reasoning for route ${tier}: ${target}`,
+          currentRouteThinking,
+          undefined,
+          supportedThinking,
+        );
+        if (level === undefined) {
+          console.log("(cancelled)");
+          return true;
+        }
+        thinking = isThinkingLevel(level) ? level : undefined;
+      }
+      await saveConfigPatch(raw => ({
+        routing: withRoutingTierSetting(raw, tier, { model: target, thinking }),
+      }));
+      const { provider } = await describeModel(target);
+      const thinkingLabel = supportedThinking.length > 0 ? ` · thinking ${thinking}` : " · no thinking override (model does not advertise thinking)";
+      console.log(`Prompt route ${tier} set to ${target} (${provider})${thinkingLabel} — routing enabled in ~/.jeo/config.json. Clear any session model pin with /model auto to let routing evaluate prompts.`);
+      return true;
+    }
+
     const role = getSubagentRole(targetId, cfgForPick);
     if (!role) return false;
     const currentRoleThinking = resolveSubagentThinking(role.id, cfgForPick) as ThinkLevel | undefined;
@@ -4295,6 +4440,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         for (const line of routeResult.lines) console.log(line);
         continue;
       }
+      if (input.startsWith("/computer") && (input === "/computer" || input[9] === " ")) {
+        const cfgNow = await readGlobalConfig();
+        const computerResult = runComputerSlash(input, {
+          sessionComputerOverride,
+          computerConfigEnabled: !!cfgNow.computer?.enabled,
+        });
+        if (computerResult.sessionComputerOverride !== undefined) sessionComputerOverride = computerResult.sessionComputerOverride;
+        for (const line of computerResult.lines) console.log(line);
+        continue;
+      }
+
       if (input.startsWith("/view") && (input === "/view" || input[5] === " ")) {
         for (const line of await handleViewSlash(input, cwd)) console.log(line);
         continue;

package/src/tui/components/live-model-picker.ts

@@ -20,9 +20,9 @@ function liveModelHint(model: string, current?: string): string {
 }
 
 export interface ModelAssignmentBadge {
-  /** Stable target id: "default" or a subagent role id. */
+  /** Stable target id: "default", a subagent role id, or "routing:<tier>". */
   role: string;
-  /** Short badge text shown beside a matching model (DEFAULT, EXECUTOR, ...). */
+  /** Short badge text shown beside a matching model (DEFAULT, EXECUTOR, ROUTE:HIGH, ...). */
   label: string;
   /** Configured model id for this target, qualified (`provider/model`) when possible. */
   model: string;
@@ -120,6 +120,8 @@ const THINKING_LEVEL_DESCRIPTION: Record<string, string> = {
 export interface ThinkingLevelChoiceOptions {
   /** Prepend an "inherit" row (role targets only, which can follow the default). */
   inheritLabel?: string;
+  /** Restrict visible reasoning levels to the selected model's supported levels. */
+  levels?: readonly string[];
   /** Per-level reasoning-budget hint, e.g. "~32k tokens". Return undefined to omit. */
   tokenHint?: (level: string) => string | undefined;
 }
@@ -138,7 +140,8 @@ export function buildThinkingLevelChoices(
   if (opts.inheritLabel) {
     items.push({ value: "inherit", label: opts.inheritLabel, hint: current === undefined ? "current" : "" });
   }
-  for (const level of THINKING_LEVEL_ORDER) {
+  const levels = opts.levels?.length ? THINKING_LEVEL_ORDER.filter(level => opts.levels!.includes(level)) : THINKING_LEVEL_ORDER;
+  for (const level of levels) {
     const tokens = opts.tokenHint?.(level);
     const label = `${level} — ${THINKING_LEVEL_DESCRIPTION[level]}${tokens ? ` (${tokens})` : ""}`;
     items.push({ value: level, label, hint: current === level ? "current" : "" });

package/src/tui/components/slash.ts

@@ -55,6 +55,8 @@ export const SLASH_COMMAND_DETAILS: readonly SlashCommandInfo[] = [
   { command: "/usage", usage: "/usage", description: "Show cumulative token usage for this session", group: "system" },
   { command: "/context", usage: "/context", description: "Show context token usage breakdown", group: "system" },
   { command: "/tools", usage: "/tools", description: "Show the tools currently visible to the agent", group: "system" },
+  { command: "/computer", usage: "/computer [on|off]", description: "Show/toggle the desktop-automation 'computer' tool (screenshot/click/type/etc) for this session", group: "system" },
+
   { command: "/hotkeys", usage: "/hotkeys", description: "Show keyboard shortcuts", group: "system" },
   { command: "/theme", usage: "/theme [name]", description: "Show or set the TUI theme (cosmic/matrix/solar/mono)", group: "system" },
   { command: "/wiki", usage: "/wiki [path|off]", description: "Show or set the global llm-wiki vault root (shared across all sessions)", group: "system" },