lynkr 9.14.9 → 9.14.11

package/config/model-capability-seeds.json

@@ -1,13 +1,15 @@
 {
   "version": 1,
-  "updatedAt": "2026-09-08",
-  "notes": "Reviewed per-family capability seeds. Values are curated estimates triangulated from SWE-Bench Verified, TerminalBench, LiveCodeBench/BigCodeBench and Artificial Analysis coding index (see scripts/seed-capabilities.js to regenerate from live sources). Heads: reasoning/codegen/debugging/tool_use in [0,1]. Keys are normalized family ids (see capability-seeds/family.js) with trailing-* wildcards matched longest-first. Quantized self-hosted servings take an automatic -0.02 haircut at resolve time. Unknown families fall through to the family heuristic, then tier-slot caps.",
+  "updatedAt": "2026-09-16",
+  "notes": "Reviewed per-family capability seeds. Values are curated estimates triangulated from SWE-Bench Verified, TerminalBench, LiveCodeBench/BigCodeBench and Artificial Analysis coding index (see scripts/seed-capabilities.js to regenerate from live sources). Heads: reasoning/codegen/debugging/tool_use in [0,1]. Keys are normalized family ids (see capability-seeds/family.js) with trailing-* wildcards matched longest-first. Quantized self-hosted servings take an automatic -0.02 haircut at resolve time. Unknown families fall through to the family heuristic, then tier-slot caps. 2026-09-16: added local-runtime + tier-catalog gaps (ornith, qwen2.5 base sizes, qwen3.5 sizes, spark-x2.5, gemma4, minimax-m3, versioned claude-3.5/gpt-4o/gpt-4.1 names, mistral bare, deepseek-coder, codellama, llama-3.1-8b, gemini-1.5-flash, amazon nova, gpt-4-turbo, gpt-3.5-turbo). Entries without benchmark rows are marked provisional — promote on data.",
   "seeds": {
     "claude-opus-4*": { "caps": { "reasoning": 0.9, "codegen": 0.9, "debugging": 0.9, "tool_use": 0.9 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate: flagship tier" },
     "claude-opus-3*": { "caps": { "reasoning": 0.8, "codegen": 0.82, "debugging": 0.8, "tool_use": 0.78 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "claude-sonnet-4*": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.78 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate" },
     "claude-sonnet-3.5": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "claude-3.5-sonnet*": { "caps": { "reasoning": 0.72, "codegen": 0.75, "debugging": 0.72, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-sonnet-20241022) shares claude-sonnet-3.5 caps" },
     "claude-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "claude-3.5-haiku*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "alias: dated/provider form (claude-3-5-haiku-20241022) shares claude-haiku caps" },
     "gpt-5.6*": { "caps": { "reasoning": 0.85, "codegen": 0.85, "debugging": 0.85, "tool_use": 0.82 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: flagship tier" },
     "gpt-5.4*": { "caps": { "reasoning": 0.85, "codegen": 0.85, "debugging": 0.85, "tool_use": 0.82 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: flagship tier" },
     "gpt-5.3*": { "caps": { "reasoning": 0.82, "codegen": 0.85, "debugging": 0.82, "tool_use": 0.8 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
@@ -15,10 +17,12 @@
     "gpt-5.1*": { "caps": { "reasoning": 0.7, "codegen": 0.72, "debugging": 0.7, "tool_use": 0.68 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gpt-5-mini*": { "caps": { "reasoning": 0.6, "codegen": 0.65, "debugging": 0.6, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gpt-5-nano*": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.45 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
-    "gpt-4o": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.68 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
+    "gpt-4o*": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.68 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate; wildcard also covers dated snapshots (gpt-4o-2024-*). Exact gpt-4o-mini still wins via exact-first lookup." },
     "gpt-4o-mini": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.48 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
-    "gpt-4.1": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "gpt-4.1*": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate; wildcard also covers dated snapshots. Exact gpt-4.1-mini still wins via exact-first lookup." },
     "gpt-4.1-mini": { "caps": { "reasoning": 0.5, "codegen": 0.55, "debugging": 0.5, "tool_use": 0.52 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "gpt-4-turbo*": { "caps": { "reasoning": 0.62, "codegen": 0.68, "debugging": 0.62, "tool_use": 0.64 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (MEDIUM openai slot); sized just below gpt-4o — promote on benchmark rows" },
+    "gpt-3.5-turbo": { "caps": { "reasoning": 0.3, "codegen": 0.35, "debugging": 0.3, "tool_use": 0.33 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (SIMPLE openai slot); matches tiny/small ladder rung" },
     "o3": { "caps": { "reasoning": 0.88, "codegen": 0.8, "debugging": 0.85, "tool_use": 0.7 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: reasoning tilt" },
     "o3-mini": { "caps": { "reasoning": 0.72, "codegen": 0.68, "debugging": 0.7, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: reasoning tilt" },
     "o4-mini": { "caps": { "reasoning": 0.7, "codegen": 0.66, "debugging": 0.68, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
@@ -28,11 +32,16 @@
     "gemini-3-pro*": { "caps": { "reasoning": 0.85, "codegen": 0.83, "debugging": 0.85, "tool_use": 0.78 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gemini-2.5-flash": { "caps": { "reasoning": 0.55, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.58 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gemini-2.0-flash": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.5 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "gemini-1.5-flash*": { "caps": { "reasoning": 0.42, "codegen": 0.48, "debugging": 0.42, "tool_use": 0.46 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (openrouter google/gemini-flash-1.5); sized just below gemini-2.0-flash" },
     "gemini-1.5-pro": { "caps": { "reasoning": 0.6, "codegen": 0.62, "debugging": 0.6, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "amazon.nova-lite*": { "caps": { "reasoning": 0.35, "codegen": 0.4, "debugging": 0.35, "tool_use": 0.38 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (bedrock SIMPLE slot); dotted key matches normalized amazon.nova-lite-v1-0 form" },
+    "amazon.nova-pro*": { "caps": { "reasoning": 0.5, "codegen": 0.55, "debugging": 0.5, "tool_use": 0.52 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (bedrock MEDIUM slot)" },
     "deepseek-r1": { "caps": { "reasoning": 0.82, "codegen": 0.78, "debugging": 0.8, "tool_use": 0.6 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate: reasoning tilt, weak tool-use" },
     "deepseek-reasoner": { "caps": { "reasoning": 0.82, "codegen": 0.78, "debugging": 0.8, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "deepseek-chat": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.62 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "deepseek-v3*": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.62 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
+    "deepseek-coder*": { "caps": { "reasoning": 0.5, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog legacy (MEDIUM/COMPLEX ollama slots: 33b, v2:236b); coder tilt, sized below qwen2.5-coder-32b" },
+    "codellama*": { "caps": { "reasoning": 0.45, "codegen": 0.55, "debugging": 0.5, "tool_use": 0.45 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog legacy (MEDIUM ollama slot: 34b); coder tilt" },
     "qwen3-max": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.72 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
     "qwen3-235b*": { "caps": { "reasoning": 0.78, "codegen": 0.8, "debugging": 0.78, "tool_use": 0.7 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "qwen3-32b": { "caps": { "reasoning": 0.65, "codegen": 0.7, "debugging": 0.65, "tool_use": 0.6 }, "sources": ["livecodebench"], "note": "curated-estimate" },
@@ -40,8 +49,18 @@
     "qwen2.5-coder-32b*": { "caps": { "reasoning": 0.55, "codegen": 0.68, "debugging": 0.6, "tool_use": 0.55 }, "sources": ["livecodebench"], "note": "curated-estimate: coder tilt" },
     "qwen2.5-coder-14b*": { "caps": { "reasoning": 0.45, "codegen": 0.58, "debugging": 0.5, "tool_use": 0.45 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "qwen2.5-coder-7b*": { "caps": { "reasoning": 0.35, "codegen": 0.48, "debugging": 0.4, "tool_use": 0.38 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "qwen2.5-72b*": { "caps": { "reasoning": 0.55, "codegen": 0.62, "debugging": 0.55, "tool_use": 0.52 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (COMPLEX ollama slot); sized at llama-3.1-70b rung" },
+    "qwen2.5-32b*": { "caps": { "reasoning": 0.5, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (MEDIUM ollama slot); sized just below qwen2.5-coder-32b" },
+    "qwen2.5-14b*": { "caps": { "reasoning": 0.42, "codegen": 0.55, "debugging": 0.48, "tool_use": 0.42 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: sized between qwen2.5-7b and qwen2.5-32b rungs" },
+    "qwen2.5-7b*": { "caps": { "reasoning": 0.33, "codegen": 0.45, "debugging": 0.38, "tool_use": 0.36 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (SIMPLE ollama slot); sized just below qwen2.5-coder-7b" },
+    "qwen2.5-3b*": { "caps": { "reasoning": 0.28, "codegen": 0.35, "debugging": 0.3, "tool_use": 0.3 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama qwen2.5:3b); small-ladder rung" },
+    "qwen2.5-1.5b*": { "caps": { "reasoning": 0.22, "codegen": 0.28, "debugging": 0.24, "tool_use": 0.24 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama qwen2.5:1.5b); tiny-ladder rung" },
+    "qwen2.5-0.5b*": { "caps": { "reasoning": 0.15, "codegen": 0.2, "debugging": 0.18, "tool_use": 0.18 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama qwen2.5:0.5b); floor rung, trivial turns only" },
     "qwen3-8b": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.45 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "qwen3-4b": { "caps": { "reasoning": 0.35, "codegen": 0.42, "debugging": 0.38, "tool_use": 0.38 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "qwen3.5-9b*": { "caps": { "reasoning": 0.42, "codegen": 0.5, "debugging": 0.44, "tool_use": 0.42 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: Qwen3.5 9B class (ornith arch family); sized just below qwen3-8b+ — promote on benchmark rows" },
+    "qwen3.5-4b*": { "caps": { "reasoning": 0.35, "codegen": 0.42, "debugging": 0.38, "tool_use": 0.38 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: Qwen3.5 4B class; mirrors qwen3-4b — promote on benchmark rows" },
+    "qwen3.5-2b*": { "caps": { "reasoning": 0.26, "codegen": 0.3, "debugging": 0.27, "tool_use": 0.28 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: Qwen3.5 2B class; tiny/small rung" },
     "glm-5.2": { "caps": { "reasoning": 0.68, "codegen": 0.72, "debugging": 0.68, "tool_use": 0.66 }, "sources": ["swe-bench-verified", "artificial-analysis"], "note": "curated-estimate: provider-agnostic (z.ai/Baidu/local share this entry)" },
     "glm-5*": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.62 }, "sources": ["artificial-analysis"], "note": "curated-estimate: GLM-5 family default" },
     "glm-4.7": { "caps": { "reasoning": 0.62, "codegen": 0.66, "debugging": 0.62, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
@@ -54,20 +73,28 @@
     "kimi-k2*": { "caps": { "reasoning": 0.6, "codegen": 0.63, "debugging": 0.6, "tool_use": 0.6 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: Kimi-K2 family default" },
     "llama-3.3-70b*": { "caps": { "reasoning": 0.6, "codegen": 0.65, "debugging": 0.6, "tool_use": 0.58 }, "sources": ["swe-bench-verified", "livecodebench"], "note": "curated-estimate" },
     "llama-3.1-70b*": { "caps": { "reasoning": 0.55, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.52 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "llama-3.1-8b*": { "caps": { "reasoning": 0.35, "codegen": 0.4, "debugging": 0.35, "tool_use": 0.36 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: tier-catalog entry (fireworks llama-3.1-8b-instruct); small rung" },
     "llama-4-maverick*": { "caps": { "reasoning": 0.6, "codegen": 0.62, "debugging": 0.6, "tool_use": 0.58 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "llama-4-scout*": { "caps": { "reasoning": 0.5, "codegen": 0.52, "debugging": 0.5, "tool_use": 0.5 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "llama-3.2*": { "caps": { "reasoning": 0.25, "codegen": 0.3, "debugging": 0.25, "tool_use": 0.28 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "mistral-large*": { "caps": { "reasoning": 0.6, "codegen": 0.65, "debugging": 0.6, "tool_use": 0.62 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "codestral*": { "caps": { "reasoning": 0.5, "codegen": 0.62, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["livecodebench"], "note": "curated-estimate: coder tilt" },
     "mistral-small*": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.48 }, "sources": ["artificial-analysis"], "note": "curated-estimate" },
+    "mistral*": { "caps": { "reasoning": 0.35, "codegen": 0.4, "debugging": 0.35, "tool_use": 0.36 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: bare/7b-class mistral (ollama SIMPLE slot); longer keys (mistral-large/small) still win via longest-prefix" },
     "devstral*": { "caps": { "reasoning": 0.5, "codegen": 0.6, "debugging": 0.55, "tool_use": 0.5 }, "sources": ["swe-bench-verified"], "note": "curated-estimate: coder tilt" },
     "gpt-oss-120b": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.55 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gpt-oss-20b": { "caps": { "reasoning": 0.45, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.42 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
     "gemma-3-27b": { "caps": { "reasoning": 0.45, "codegen": 0.48, "debugging": 0.45, "tool_use": 0.45 }, "sources": ["livecodebench"], "note": "curated-estimate" },
+    "gemma4*": { "caps": { "reasoning": 0.42, "codegen": 0.46, "debugging": 0.42, "tool_use": 0.42 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (ollama gemma4:12b normalizes to gemma4-12b, no dash); sized just below gemma-3-27b" },
     "gemma-2*": { "caps": { "reasoning": 0.28, "codegen": 0.32, "debugging": 0.28, "tool_use": 0.3 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "phi-4": { "caps": { "reasoning": 0.45, "codegen": 0.48, "debugging": 0.45, "tool_use": 0.4 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "phi-3*": { "caps": { "reasoning": 0.28, "codegen": 0.32, "debugging": 0.28, "tool_use": 0.28 }, "sources": ["livecodebench"], "note": "curated-estimate" },
     "minimax-m2*": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.65 }, "sources": ["swe-bench-verified"], "note": "curated-estimate" },
+    "minimax-m3*": { "caps": { "reasoning": 0.65, "codegen": 0.68, "debugging": 0.65, "tool_use": 0.65 }, "sources": ["lynkr-operator-estimate"], "note": "provisional: local runtime (OLLAMA_MODEL minimax-m3:cloud); mirrors minimax-m2 pending m3 rows" },
+    "ornith*": { "caps": { "reasoning": 0.44, "codegen": 0.52, "debugging": 0.46, "tool_use": 0.47 }, "sources": ["ollama-library", "lynkr-operator-estimate"], "note": "provisional: 9B Qwen3.5-based agentic coder (tools+thinking, 262k ctx); no public SWE-bench row — coder/agentic tilt, revisit on data" },
+    "spark-x2.5-4b*": { "caps": { "reasoning": 0.42, "codegen": 0.5, "debugging": 0.45, "tool_use": 0.48 }, "sources": ["vendor-reported", "lynkr-operator-estimate"], "note": "provisional: vendor claims SOTA-among-size on agent/code; capped per self-report policy (cf. muse-spark-1.3) — revisit on independent rows" },
+    "spark-x2.5-1.7b*": { "caps": { "reasoning": 0.32, "codegen": 0.38, "debugging": 0.34, "tool_use": 0.36 }, "sources": ["vendor-reported", "lynkr-operator-estimate"], "note": "provisional: 1.7B sibling; small rung with agent tilt — revisit on independent rows" },
+    "spark-x2.5*": { "caps": { "reasoning": 0.35, "codegen": 0.42, "debugging": 0.38, "tool_use": 0.4 }, "sources": ["lynkr-operator-estimate"], "note": "family default; dated/suffixed forms fall here, longer 4b/1.7b keys win via longest-prefix" },
     "muse-spark-1.3": { "caps": { "reasoning": 0.85, "codegen": 0.87, "debugging": 0.85, "tool_use": 0.75 }, "sources": ["deepswe-1.1@75.4% (vendor-reported, max setting)", "terminal-bench-2.1@88.8% (vendor-reported)"], "note": "curated-estimate: full 1.3 at max reasoning. Vendor self-reported; absent from public DeepSWE leaderboard (only 1.2 listed); hands-on gap reported by third parties. tool_use capped — no direct tool-use data. Revisit on independent rows." },
     "muse-spark-1.2*": { "caps": { "reasoning": 0.42, "codegen": 0.46, "debugging": 0.42, "tool_use": 0.44 }, "sources": ["lynkr-telemetry:4176 scored rows, avg quality 52.7 @ complexity 51.7"], "note": "measured: operator's own traffic. Below the 70 evidence bar — economize trivial turns only." },
     "muse-spark-1.3-contributor*": { "caps": { "reasoning": 0.4, "codegen": 0.45, "debugging": 0.4, "tool_use": 0.45 }, "sources": ["lynkr-telemetry:29 scored rows (thin) + 1.2 family history"], "note": "provisional: free/contributor serving grades far below full-1.3 published scores (variant, effort setting, or benchmark inflation — undetermined). Do NOT cover with muse-spark*: the full model and the free serving must never share caps." }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lynkr",
-  "version": "9.14.9",
+  "version": "9.14.11",
   "files": [
     "index.js",
     "install.sh",

package/src/api/middleware/session.js

@@ -8,12 +8,21 @@ const FALLBACK_HEADERS = [
   "x-claude-session",
   "x-claude-conversation-id",
   "anthropic-session-id",
+  // open-code-review per-bundle affinity: internal/llm/sessionkey.go sends
+  // `x-session-affinity: <ocr_session_key>` (real task key, or an
+  // auto-generated fallback). Each file bundle gets its own key so bundles
+  // route independently instead of sharing one PR-wide pin.
+  "x-session-affinity",
 ];
 
 function normaliseSessionId(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
-  return trimmed.length ? trimmed : null;
+  if (!trimmed.length) return null;
+  // Ignore unsubstituted templates (OCR sends literal "{ocr_session_key}"
+  // when no key is configured — its own client falls back to auto-generated).
+  if (trimmed.includes("{") && trimmed.includes("}")) return null;
+  return trimmed;
 }
 
 function _contentText(content) {

package/src/cache/prompt.js

@@ -37,6 +37,45 @@ function stableStringify(value) {
   return JSON.stringify(normaliseObject(value));
 }
 
+/**
+ * Replace image bytes with short hashes for cache keys.
+ * Prevents multi-MB base64 from entering SQLite keys/values index path and
+ * gives stable keys for identical images without hashing megabytes per request.
+ */
+function stripImageBytesForKey(messages) {
+  if (!Array.isArray(messages)) return messages;
+  let hashImageData = null;
+  try {
+    hashImageData = require('../routing/vision').hashImageData;
+  } catch { hashImageData = null; }
+  const shortHash = (s) => {
+    if (!hashImageData || typeof s !== 'string') return `[image:${String(s ?? '').length}]`;
+    try { return `[image:${hashImageData(s)}]`; } catch { return `[image:${String(s).length}]`; }
+  };
+  return messages.map((msg) => {
+    if (!msg || !Array.isArray(msg.content)) return msg;
+    return {
+      ...msg,
+      content: msg.content.map((block) => {
+        if (!block || typeof block !== 'object') return block;
+        if (block.type === 'image' && typeof block.source?.data === 'string') {
+          return { ...block, source: { ...block.source, data: shortHash(block.source.data) } };
+        }
+        if (typeof block.image_url?.url === 'string' && block.image_url.url.startsWith('data:image')) {
+          return { ...block, image_url: { ...block.image_url, url: shortHash(block.image_url.url) } };
+        }
+        if (typeof block.inlineData?.data === 'string') {
+          return { ...block, inlineData: { ...block.inlineData, data: shortHash(block.inlineData.data) } };
+        }
+        if (block.type === 'tool_result' && Array.isArray(block.content)) {
+          return { ...block, content: stripImageBytesForKey([{ content: block.content }])[0].content };
+        }
+        return block;
+      }),
+    };
+  });
+}
+
 class PromptCache {
   constructor(options = {}) {
     this.enabled = options.enabled === true;
@@ -158,7 +197,7 @@ class PromptCache {
       const canonical = {
         model: payload.model ?? null,
         input: payload.input ?? null,
-        messages: payload.messages ? normaliseObject(payload.messages) : null,
+        messages: payload.messages ? normaliseObject(stripImageBytesForKey(payload.messages)) : null,
         tools: payload.tools ? normaliseObject(payload.tools) : null,
         tool_choice: payload.tool_choice ? normaliseObject(payload.tool_choice) : null,
         temperature: payload.temperature ?? null,

package/src/cache/semantic.js

@@ -162,6 +162,13 @@ class SemanticCache {
         }
         return count;
       }, 0),
+      // Vision hash: same text + different image must NOT hit. Null when no
+      // images (backwards compatible with existing entries).
+      visionHash: (() => {
+        try {
+          return require('../routing/vision').visionContextHash(messages);
+        } catch { return null; }
+      })(),
     };
 
     hash.update(JSON.stringify(conversationState));

package/src/clients/databricks.js

@@ -1810,6 +1810,62 @@ async function invokeLMStudio(body, _incomingHeaders = {}) {
   return performJsonRequest(endpoint, { headers, body: lmstudioBody }, "LM Studio");
 }
 
+/**
+ * Map a single Anthropic content block to Bedrock Converse content.
+ * Text -> {text}; image base64 -> {image:{format, source:{bytes}}};
+ * image URL / unsupported -> text placeholder (Converse has no URL fetch).
+ * Returns null for cache_control-only / empty blocks.
+ *
+ * @param {object|string} block
+ * @returns {object|null}
+ */
+function anthropicBlockToConverseContent(block) {
+  if (block == null) return null;
+  if (typeof block === 'string') return block ? { text: block } : null;
+  if (block.type === 'text' && typeof block.text === 'string') {
+    return block.text ? { text: block.text } : null;
+  }
+  if (block.type === 'image' && block.source) {
+    const src = block.source;
+    if (src.type === 'base64' && src.data) {
+      const mediaType = (src.media_type || 'image/jpeg').toLowerCase();
+      const format = mediaType.includes('png') ? 'png'
+        : mediaType.includes('gif') ? 'gif'
+        : mediaType.includes('webp') ? 'webp'
+        : 'jpeg';
+      try {
+        return { image: { format, source: { bytes: src.data } } };
+      } catch { return null; }
+    }
+    if (src.type === 'url' && src.url) {
+      return { text: `[Image URL: ${src.url}]` };
+    }
+  }
+  // OpenAI-shaped image_url (may already be converted upstream)
+  const imageUrl = block.image_url?.url || (typeof block.url === 'string' ? block.url : null);
+  if ((block.type === 'image_url' || block.type === 'input_image' || imageUrl) && imageUrl) {
+    const dataMatch = String(imageUrl).match(/^data:(image\/[^;]+);base64,(.+)$/);
+    if (dataMatch) {
+      const mediaType = dataMatch[1].toLowerCase();
+      const format = mediaType.includes('png') ? 'png'
+        : mediaType.includes('gif') ? 'gif'
+        : mediaType.includes('webp') ? 'webp'
+        : 'jpeg';
+      return { image: { format, source: { bytes: dataMatch[2] } } };
+    }
+    return { text: `[Image URL: ${imageUrl}]` };
+  }
+  if (block.type === 'tool_use' || block.type === 'tool_result' || block.type === 'thinking') {
+    // Tool/thinking blocks are handled by the toolConfig path or dropped for
+    // pure-text turns — preserve text content when present.
+    const text = block.text || (typeof block.content === 'string' ? block.content : null);
+    return text ? { text } : null;
+  }
+  if (typeof block.text === 'string' && block.text) return { text: block.text };
+  if (typeof block.content === 'string' && block.content) return { text: block.content };
+  return null;
+}
+
 /**
  * Flatten an Anthropic-style content value into a plain string for the
  * Bedrock Converse API.
@@ -1919,9 +1975,10 @@ async function invokeBedrock(body, _incomingHeaders = {}) {
       .map(msg => ({
         role: msg.role,
         content: Array.isArray(msg.content)
-          ? msg.content.map(c => ({ text: c.text || c.content || "" }))
-          : [{ text: msg.content }]
+          ? msg.content.map(c => anthropicBlockToConverseContent(c)).filter(Boolean)
+          : [{ text: String(msg.content ?? '') }]
       }))
+      .map(m => ({ ...m, content: m.content.length > 0 ? m.content : [{ text: ' ' }] }))
   };
 
   // Add system prompt (from Anthropic system field OR extracted from messages)
@@ -2997,6 +3054,33 @@ IMPORTANT TOOL USAGE RULES:
       for (const block of msg.content) {
         if (block.type === "text") {
           parts.push({ text: block.text });
+        } else if (block.type === "image" && block.source?.type === "base64" && block.source?.data) {
+          parts.push({
+            inlineData: {
+              mimeType: block.source.media_type || "image/jpeg",
+              data: block.source.data,
+            },
+          });
+        } else if (block.type === "image" && block.source?.type === "url" && block.source?.url) {
+          parts.push({ text: `[Image URL: ${block.source.url}]` });
+        } else if ((block.type === "image_url" || block.type === "input_image") && block.image_url?.url) {
+          const url = block.image_url.url;
+          const dataMatch = String(url).match(/^data:(image\/[^;]+);base64,(.+)$/);
+          if (dataMatch) {
+            parts.push({ inlineData: { mimeType: dataMatch[1], data: dataMatch[2] } });
+          } else {
+            parts.push({ text: `[Image URL: ${url}]` });
+          }
+        } else if (block.image_url?.url) {
+          const url = block.image_url.url;
+          const dataMatch = String(url).match(/^data:(image\/[^;]+);base64,(.+)$/);
+          if (dataMatch) {
+            parts.push({ inlineData: { mimeType: dataMatch[1], data: dataMatch[2] } });
+          } else {
+            parts.push({ text: `[Image URL: ${url}]` });
+          }
+        } else if (block.inlineData?.data) {
+          parts.push({ inlineData: block.inlineData });
         } else if (block.type === "tool_use") {
           // Assistant's tool call
           parts.push({

package/src/clients/openrouter-utils.js

@@ -55,6 +55,25 @@ function convertAnthropicToolsToOpenRouter(anthropicTools) {
  * - User messages with tool_result blocks → OpenRouter tool role messages
  * - Regular text content → OpenRouter text content
  */
+function anthropicImageToOpenAIUrl(block) {
+  if (!block || typeof block !== 'object') return null;
+  // Anthropic: {type:'image', source:{type:'base64', media_type, data}}
+  if (block.type === 'image' && block.source?.type === 'base64' && block.source?.data) {
+    const mediaType = block.source.media_type || 'image/jpeg';
+    return `data:${mediaType};base64,${block.source.data}`;
+  }
+  if (block.type === 'image' && block.source?.type === 'url' && block.source?.url) {
+    return block.source.url;
+  }
+  // Already OpenAI-shaped
+  if ((block.type === 'image_url' || block.type === 'input_image') && block.image_url?.url) {
+    return block.image_url.url;
+  }
+  if (block.image_url?.url) return block.image_url.url;
+  if (typeof block.url === 'string' && block.url.startsWith('data:image')) return block.url;
+  return null;
+}
+
 function convertAnthropicMessagesToOpenRouter(anthropicMessages) {
   if (!Array.isArray(anthropicMessages)) return [];
 
@@ -124,32 +143,80 @@ function convertAnthropicMessagesToOpenRouter(anthropicMessages) {
       // providers 400 the unpaired function_call.
       else if (msg.role === 'user' && toolResultBlocks.length > 0) {
         // Tool results first — adjacent to their assistant tool_calls.
+        // Preserve nested screenshots: emit text to the tool message and
+        // re-attach images as a following user message with image_url parts.
+        const pendingImages = [];
         for (const toolResult of toolResultBlocks) {
+          let toolText = '';
+          const trContent = toolResult.content;
+          if (typeof trContent === 'string') {
+            toolText = trContent;
+          } else if (Array.isArray(trContent)) {
+            const texts = [];
+            for (const b of trContent) {
+              if (b?.type === 'text' && b.text) texts.push(b.text);
+              else {
+                const url = anthropicImageToOpenAIUrl(b);
+                if (url) pendingImages.push(url);
+                else if (b) texts.push(typeof b === 'string' ? b : JSON.stringify(b));
+              }
+            }
+            toolText = texts.join('\n');
+          } else {
+            try { toolText = JSON.stringify(trContent || {}); } catch { toolText = ''; }
+          }
           converted.push({
             role: 'tool',
             tool_call_id: toolResult.tool_use_id || `call_${Date.now()}`,
-            content: typeof toolResult.content === 'string'
-              ? toolResult.content
-              : JSON.stringify(toolResult.content || {})
+            content: toolText
           });
         }
 
-        // Then any user-authored/injected text as a user message.
+        // Then any user-authored/injected text + images as a user message.
         const textContent = textBlocks.map(block => block.text || '').join('\n');
-        if (textContent) {
-          converted.push({
-            role: 'user',
-            content: textContent
-          });
+        for (const b of content) {
+          const url = anthropicImageToOpenAIUrl(b);
+          if (url) pendingImages.push(url);
+        }
+        if (textContent || pendingImages.length > 0) {
+          if (pendingImages.length === 0) {
+            converted.push({ role: 'user', content: textContent });
+          } else {
+            const parts = [];
+            if (textContent) parts.push({ type: 'text', text: textContent });
+            for (const url of pendingImages) {
+              parts.push({ type: 'image_url', image_url: { url } });
+            }
+            converted.push({ role: 'user', content: parts });
+          }
         }
       }
-      // Regular message with just text
+      // Regular message (may carry text + images)
       else {
         const textContent = textBlocks.map(block => block.text || '').join('\n');
-        const message = {
-          role: msg.role,
-          content: textContent || ''
-        };
+        const imageUrls = [];
+        for (const b of content) {
+          const url = anthropicImageToOpenAIUrl(b);
+          if (url) imageUrls.push(url);
+        }
+        // Document blocks with embedded base64 images
+        for (const b of content) {
+          if (b?.type === 'document' && b.source?.data && imageUrls.length === 0) {
+            // PDFs aren't image_url-compatible — keep a text placeholder so the
+            // turn isn't silently emptied (becomes ' ' downstream if nothing else).
+          }
+        }
+        let message;
+        if (imageUrls.length === 0) {
+          message = { role: msg.role, content: textContent || '' };
+        } else {
+          const parts = [];
+          if (textContent) parts.push({ type: 'text', text: textContent });
+          for (const url of imageUrls) {
+            parts.push({ type: 'image_url', image_url: { url } });
+          }
+          message = { role: msg.role, content: parts };
+        }
         if (msg.role === 'assistant' && thinkingText) {
           message.reasoning_content = thinkingText;
         }
@@ -188,6 +255,9 @@ function convertAnthropicMessagesToOpenRouter(anthropicMessages) {
     if (m.role === 'tool') continue;
     const hasToolCalls = Array.isArray(m.tool_calls) && m.tool_calls.length > 0;
     if (hasToolCalls) continue;
+    // Array content (text + image_url parts) must be preserved verbatim —
+    // only string content gets the empty-string guard.
+    if (Array.isArray(m.content)) continue;
     if (typeof m.content !== 'string' || m.content.trim() === '') {
       m.content = ' ';
     }

package/src/logger/audit-logger.js

@@ -127,6 +127,12 @@ function hashAndTruncate(content, maxLength, deduplicator) {
     return { hash: null, content: null, truncated: false, originalLength: null };
   }
 
+  // Redact image bytes before hashing/storing — never persist base64 to disk.
+  try {
+    const { redactVisionBytes } = require('../routing/vision');
+    content = redactVisionBytes(content);
+  } catch { /* redaction is best-effort */ }
+
   // Hash the ORIGINAL content before any truncation
   const hash = deduplicator ? deduplicator.hashContent(content) : null;
 

package/src/logger/deduplicator.js

@@ -244,6 +244,11 @@ class ContentDeduplicator {
       return null;
     }
 
+    // Redact image bytes before anything touches disk.
+    try {
+      content = require('../routing/vision').redactVisionBytes(content);
+    } catch { /* best-effort */ }
+
     let stringContent = typeof content === "string" ? content : JSON.stringify(content);
 
     // Sanitize content before hashing (if enabled)
@@ -292,6 +297,11 @@ class ContentDeduplicator {
       return null;
     }
 
+    // Redact image bytes before anything touches disk.
+    try {
+      content = require('../routing/vision').redactVisionBytes(content);
+    } catch { /* best-effort */ }
+
     let stringContent = typeof content === "string" ? content : JSON.stringify(content);
 
     // Sanitize content (if enabled)

package/src/orchestrator/index.js

@@ -948,7 +948,14 @@ function sanitizePayload(payload) {
     || config.modelProvider?.type
     || "databricks";
   const willFlatten = providerType !== "azure-anthropic";
-  const clean = clonePayloadSmart(payload ?? {}, { willFlatten });
+  // Vision payloads must keep image bytes through the clone: flatten-aware
+  // cloning replaces them with {_skipped:true} placeholders that downstream
+  // converters can no longer recover. Full-clone when images are present.
+  let needsVisionForClone = false;
+  try {
+    needsVisionForClone = require("../routing/vision").payloadNeedsVision(payload);
+  } catch { needsVisionForClone = false; }
+  const clean = clonePayloadSmart(payload ?? {}, { willFlatten: willFlatten && !needsVisionForClone });
   const requestedModel =
     (typeof payload?.model === "string" && payload.model.trim().length > 0
       ? payload.model.trim()
@@ -1031,17 +1038,28 @@ function sanitizePayload(payload) {
     const { modelNameSupportsTools } = require("../clients/ollama-utils");
     const modelSupportsTools = modelNameSupportsTools(config.ollama?.model);
 
+    // Preserve image blocks for vision-capable Ollama models (e.g. llava,
+    // llama3.2-vision): the native /v1/messages path forwards them verbatim,
+    // the legacy /api/chat path drops what it can't handle. Text-only
+    // filtering below must not blind the native path.
+    const msgHasVision = (msg) => Array.isArray(msg?.content) && msg.content.some((b) =>
+      b?.type === 'image' || b?.type === 'image_url' || b?.image_url?.url || b?.source?.data
+    );
     if (!modelSupportsTools) {
       // Filter out tool_result content blocks for models without tool support
+      // (but keep text + images so vision still works).
       clean.messages = clean.messages
         .map((msg) => {
           if (Array.isArray(msg.content)) {
-            // Filter out tool_use and tool_result blocks
-            const textBlocks = msg.content.filter(
-              (block) => block.type === "text" && block.text
+            const keepBlocks = msg.content.filter(
+              (block) => (block.type === "text" && block.text) || msgHasVision({ content: [block] })
             );
-            if (textBlocks.length > 0) {
-              // Convert to simple string format for Ollama
+            if (keepBlocks.length > 0) {
+              const textBlocks = keepBlocks.filter((b) => b.type === "text" && b.text);
+              // If only images remain, keep array form for the native path
+              if (textBlocks.length === 0) return { role: msg.role, content: keepBlocks };
+              // Mixed text+images: keep array form (native) — legacy drops images
+              if (keepBlocks.some((b) => b.type !== "text")) return { role: msg.role, content: keepBlocks };
               return {
                 role: msg.role,
                 content: textBlocks.map((b) => b.text).join("\n"),
@@ -1054,9 +1072,10 @@ function sanitizePayload(payload) {
         .filter(Boolean);
     } else {
       // Keep tool blocks for tool-capable models
-      // But flatten content to simple string for better compatibility
+      // Preserve image arrays; flatten pure-text arrays for compatibility.
       clean.messages = clean.messages.map((msg) => {
         if (Array.isArray(msg.content)) {
+          if (msgHasVision(msg)) return msg;
           const textBlocks = msg.content.filter(
             (block) => block.type === "text" && block.text
           );

package/src/routing/client-profiles.js

@@ -158,6 +158,25 @@ const PROFILES = {
       minToolFingerprintMatch: 0.8,
     },
   },
+  'open-code-review': {
+    name: 'open-code-review',
+    baselineTools: new Set([
+      // Alibaba open-code-review focused review toolset —
+      // internal/tool/definitions.go: task_done, code_comment, file_read,
+      // file_read_diff (+ search variants). These attach to every review
+      // bundle by design; counting them as agentic intent would floor every
+      // bundle at ITERATIVE/COMPLEX even for a 10-line typo fix. Real
+      // complexity still comes through diff size + file_read chains.
+      'task_done', 'code_comment', 'file_read', 'file_read_diff',
+    ]),
+    detect: {
+      // UA shape: `open-code-review/<ver> | <provider>` (internal/llm/client.go
+      // userAgent). Fingerprint fallback at 0.5: minimal bundles may carry
+      // only code_comment + task_done.
+      headerPatterns: [/open-code-review/i],
+      minToolFingerprintMatch: 0.5,
+    },
+  },
 };
 
 // Union of every baseline tool across all known profiles — used for the

package/src/routing/index.js

@@ -61,16 +61,23 @@ const LOCAL_PROVIDERS = ['ollama', 'llamacpp', 'lmstudio'];
 
 /**
  * Returns true when any message content block is an image.
- * Handles both string content and structured content arrays.
+ * Delegates to the central vision detector (covers base64/url/document/
+ * tool_result-nested/Gemini inlineData). Kept as a thin wrapper for
+ * backwards compatibility with existing call sites and tests.
  */
 function _payloadHasImages(payload) {
-  const messages = payload?.messages;
-  if (!Array.isArray(messages)) return false;
-  return messages.some(msg => {
-    const content = msg?.content;
-    if (!Array.isArray(content)) return false;
-    return content.some(block => block?.type === 'image' || block?.type === 'image_url');
-  });
+  try {
+    const { payloadNeedsVision } = require('./vision');
+    return payloadNeedsVision(payload);
+  } catch {
+    const messages = payload?.messages;
+    if (!Array.isArray(messages)) return false;
+    return messages.some(msg => {
+      const content = msg?.content;
+      if (!Array.isArray(content)) return false;
+      return content.some(block => block?.type === 'image' || block?.type === 'image_url');
+    });
+  }
 }
 
 /**
@@ -215,10 +222,8 @@ function _runPinGuards(payload, pin) {
 
   if (_payloadHasImages(payload)) {
     try {
-      const { getModelRegistrySync } = require('./model-registry');
-      const registry = getModelRegistrySync();
-      const modelInfo = pin.model ? registry.getCost(pin.model) : null;
-      if (!modelInfo?.vision) {
+      const { providerSupportsVision } = require('./vision');
+      if (!providerSupportsVision(pin.provider, pin.model)) {
         return { ok: false, reason: 'vision', risk, promptTokensEst };
       }
     } catch (err) {
@@ -758,6 +763,26 @@ function checkSessionPin(payload, options = {}) {
         }
       }
     } catch { /* never block the pin-serve path */ }
+    // Vision escape hatch. Same safe pattern as context-overflow above: an
+    // image arriving mid-tool-loop must not stay pinned to a text-only model
+    // (upstream 400). Serve the pin THIS turn (tool-call IDs aren't portable),
+    // drop it so the next boundary re-routes to a vision-capable model.
+    try {
+      if (_payloadHasImages(payload)) {
+        const { providerSupportsVision } = require('./vision');
+        if (!providerSupportsVision(pin.provider, pin.model)) {
+          sessionAffinity.removePin(sessionId);
+          logger.warn({
+            sessionId,
+            trigger: 'vision_mid_loop',
+            pinnedModel: pin.model,
+            pinnedProvider: pin.provider,
+            pinnedTier: pin.tier,
+          }, '[Routing] Image arrived mid-tool-loop on text-only pin — pin dropped, next boundary re-routes to vision-capable model');
+          return { serve: true, pin, reason: 'tool_history_pin_dropped', sessionId };
+        }
+      }
+    } catch { /* never block the pin-serve path */ }
     if (refreshOk) {
       sessionAffinity.setPin(sessionId, pin, {
         // Monotonic within a pin's lifetime: refreshes must never SHRINK the
@@ -1451,15 +1476,14 @@ async function _determineProviderSmartInner(payload, options = {}) {
   }
 
   // Phase 1.4 — vision capability guard.
-  // If the payload contains image content blocks but the selected model lacks
-  // vision support, silently swap to the cheapest vision-capable model at or
-  // above the current tier. Prevents silent upstream failures.
+  // If the payload contains image content blocks but the selected
+  // provider/model combo cannot carry vision, swap to the cheapest
+  // vision-capable model at or above the current tier. Prevents silent
+  // upstream failures. Uses per-provider gate, not registry flag alone.
   if (_payloadHasImages(payload)) {
     try {
-      const { getModelRegistrySync } = require('./model-registry');
-      const registry = getModelRegistrySync();
-      const modelInfo = registry.getCost(selectedModel);
-      if (!modelInfo?.vision) {
+      const { providerSupportsVision } = require('./vision');
+      if (!providerSupportsVision(provider, selectedModel)) {
         const visionModel = selector.findVisionCapable(tier);
         if (visionModel) {
           const fromTier = tier;

package/src/routing/model-tiers.js

@@ -184,24 +184,23 @@ class ModelTierSelector {
 
   /**
    * Find a vision-capable model at or above `preferredTier`.
-   * Walks tier order from preferred upward; returns null when none available.
+   * Walks tiers in priority order (cheapest upward); returns null when none.
+   * Uses per-provider gate so registry-true but transportless combos are skipped.
    */
   findVisionCapable(preferredTier = null) {
-    const { getModelRegistrySync } = require('./model-registry');
-    const registry = getModelRegistrySync();
-    const tierOrder = preferredTier
-      ? [preferredTier, 'COMPLEX', 'REASONING', 'MEDIUM', 'SIMPLE']
-      : ['COMPLEX', 'REASONING', 'MEDIUM', 'SIMPLE'];
-    const seen = new Set();
+    const { providerSupportsVision } = require('./vision');
+    const priority = { SIMPLE: 1, MEDIUM: 2, COMPLEX: 3, REASONING: 4 };
+    const allTiers = ['SIMPLE', 'MEDIUM', 'COMPLEX', 'REASONING'];
+    const minPriority = preferredTier ? (priority[preferredTier] ?? 1) : 1;
+    const tierOrder = allTiers.filter((t) => (priority[t] ?? 99) >= minPriority);
+    // Fall back to full sweep (handles unknown tier names gracefully)
+    if (preferredTier && !tierOrder.includes(preferredTier)) tierOrder.unshift(preferredTier);
     for (const t of tierOrder) {
-      if (seen.has(t)) continue;
-      seen.add(t);
       const tierConfig = this.tierConfig[t];
       if (!tierConfig?.preferred) continue;
       for (const [provider, models] of Object.entries(tierConfig.preferred)) {
         for (const model of models) {
-          const info = registry.getCost(model);
-          if (info?.vision) return { provider, model, tier: t };
+          if (providerSupportsVision(provider, model)) return { provider, model, tier: t };
         }
       }
     }

package/src/routing/risk-classifier.js

@@ -102,7 +102,19 @@ function analyzeRisk(payload) {
     }
   }
   text = stripSystemReminders(text);
-  if (typeof payload?.system === 'string') text += ' ' + payload.system;
+  // Harness-aware classification: OCR ships its review ruleset (NPE,
+  // thread-safety, XSS, SQL injection) as system text on every bundle. Those
+  // rule words are risk keywords ("security", "credential", "secret") the
+  // diff never contained — including system would force-escalate every
+  // bundle to high/REASONING. Classify on the task (diff bundle), execute
+  // on the full request. Fall back to tool fingerprint when the profile
+  // hasn't been attached yet (direct analyzeRisk calls in tests/guards).
+  const isOCR = payload?._clientProfile?.name === 'open-code-review'
+    || (Array.isArray(payload?.tools) && payload.tools.some((t) => {
+      const n = t?.name || t?.function?.name;
+      return n === 'code_comment' || n === 'task_done';
+    }));
+  if (!isOCR && typeof payload?.system === 'string') text += ' ' + payload.system;
 
   const prob = _predict(text, model);
   let level;

package/src/routing/tokenizer.js

@@ -114,14 +114,31 @@ function _extractText(content) {
 
 function _imageTokenEstimate(content) {
   if (!Array.isArray(content)) return 0;
-  let imageBase64Bytes = 0;
+  let imageCount = 0;
   for (const block of content) {
-    if (block?.type === 'image' && block.source?.data) {
-      imageBase64Bytes += block.source.data.length;
+    if (!block || typeof block !== 'object') continue;
+    // Fixed per-image estimate (Anthropic ~1k-1.5k/image, OpenAI tiles similar).
+    // Never count base64 bytes as text — 1MB of base64 is not 170k tokens.
+    if (block.type === 'image' || block.type === 'image_url' || block.type === 'input_image') {
+      imageCount += 1;
+    } else if (block.image_url?.url || block.inlineData?.data || block.inline_data?.data) {
+      imageCount += 1;
+    } else if (block.type === 'tool_result' && block.content) {
+      // Nested screenshots inside tool results
+      const nested = Array.isArray(block.content) ? block.content : [block.content];
+      for (const nb of nested) {
+        if (nb && typeof nb === 'object' && (nb.type === 'image' || nb.type === 'image_url' || nb.image_url?.url)) {
+          imageCount += 1;
+        }
+      }
     }
   }
-  // Rough heuristic mirroring previous behavior: ~1 token per 6 base64 chars
-  return Math.floor(imageBase64Bytes / 6);
+  try {
+    const { VISION_IMAGE_TOKEN_ESTIMATE } = require('./vision');
+    return imageCount * VISION_IMAGE_TOKEN_ESTIMATE;
+  } catch {
+    return imageCount * 1500;
+  }
 }
 
 /**

package/src/routing/vision.js

@@ -0,0 +1,246 @@
+/**
+ * Central vision detection + capability gating.
+ *
+ * Single source of truth for "does this payload need a vision-capable model?"
+ * Covers Anthropic image blocks, OpenAI image_url parts, documents with
+ * embedded images, Gemini inlineData, and nested tool_result screenshots.
+ *
+ * @module routing/vision
+ */
+
+const crypto = require('crypto');
+
+const VISION_IMAGE_TOKEN_ESTIMATE = 1500;
+
+// Providers that can never transport image bytes (no vision path, even after
+// converter fixes). Everything else either forwards natively or converts.
+const TRANSPORTLESS_PROVIDERS = new Set(['llamacpp', 'lmstudio', 'codex']);
+
+/**
+ * Does a single content block carry image data?
+ * @param {object|string|null} block
+ * @returns {boolean}
+ */
+function blockNeedsVision(block) {
+  if (!block || typeof block !== 'object') {
+    if (typeof block === 'string') {
+      return block.includes('data:image');
+    }
+    return false;
+  }
+  // Anthropic native: {type:'image', source:{type:'base64'|'url', data|url}}
+  if (block.type === 'image') return true;
+  // OpenAI native: {type:'image_url', image_url:{url}} or {type:'input_image'}
+  if (block.type === 'image_url' || block.type === 'input_image') return true;
+  if (block.image_url?.url) return true;
+  // Gemini: {inlineData:{mimeType,data}} / {inline_data:{...}} / {fileData}
+  if (block.inlineData?.data || block.inline_data?.data || block.fileData) return true;
+  // Anthropic document that embeds an image (PDF with scans)
+  if (block.type === 'document' && block.source?.data) return true;
+  // Generic base64 source marker
+  if (block.source?.type === 'base64' && block.source?.data) return true;
+  if (typeof block.source?.data === 'string' && block.source.data.length > 100) {
+    // Heuristic: large opaque source payloads are media, not text
+    if (block.type !== 'text') return true;
+  }
+  // data: URL embedded in url/text fields
+  if (typeof block.url === 'string' && block.url.startsWith('data:image')) return true;
+  if (typeof block.text === 'string' && block.text.includes('data:image')) return true;
+  // Nested tool_result content: {type:'tool_result', content:[{type:'image'...}]}
+  if (block.type === 'tool_result' && block.content) {
+    return contentNeedsVision(block.content);
+  }
+  return false;
+}
+
+/**
+ * Does message content (string | array | object) contain image data?
+ * @param {*} content
+ * @returns {boolean}
+ */
+function contentNeedsVision(content) {
+  if (!content) return false;
+  if (typeof content === 'string') return content.includes('data:image');
+  if (Array.isArray(content)) return content.some(blockNeedsVision);
+  if (typeof content === 'object') return blockNeedsVision(content);
+  return false;
+}
+
+/**
+ * Does the full request payload need a vision-capable model?
+ * Scans messages + system for any image signal.
+ * @param {object} payload
+ * @returns {boolean}
+ */
+function payloadNeedsVision(payload) {
+  if (!payload || typeof payload !== 'object') return false;
+  const messages = payload.messages;
+  if (Array.isArray(messages)) {
+    for (const msg of messages) {
+      if (!msg) continue;
+      if (contentNeedsVision(msg.content)) return true;
+      // OpenAI tool_calls with image args (rare) — stringify check, cheap
+      if (Array.isArray(msg.tool_calls)) {
+        for (const tc of msg.tool_calls) {
+          try {
+            const args = typeof tc?.function?.arguments === 'string'
+              ? tc.function.arguments
+              : JSON.stringify(tc?.function?.arguments ?? '');
+            if (args && args.includes('data:image')) return true;
+          } catch { /* ignore */ }
+        }
+      }
+    }
+  }
+  if (payload.system && contentNeedsVision(payload.system)) return true;
+  if (payload.input && contentNeedsVision(payload.input)) return true;
+  return false;
+}
+
+/**
+ * Count image blocks in a payload (for token budgets + logging).
+ * @param {object} payload
+ * @returns {number}
+ */
+function countVisionImages(payload) {
+  if (!payload || !Array.isArray(payload.messages)) return 0;
+  let count = 0;
+  const walk = (content) => {
+    if (!content) return;
+    if (typeof content === 'string') {
+      // Count data: URLs in strings (rough)
+      const matches = content.match(/data:image/g);
+      if (matches) count += matches.length;
+      return;
+    }
+    if (Array.isArray(content)) {
+      for (const b of content) {
+        if (!b || typeof b !== 'object') continue;
+        if (b.type === 'image' || b.type === 'image_url' || b.type === 'input_image' || b.image_url?.url || b.inlineData?.data || b.inline_data?.data) {
+          count += 1;
+        } else if (b.type === 'tool_result' && b.content) {
+          walk(b.content);
+        }
+      }
+      return;
+    }
+    if (typeof content === 'object' && blockNeedsVision(content)) count += 1;
+  };
+  for (const msg of payload.messages) {
+    if (msg) walk(msg.content);
+  }
+  return count;
+}
+
+/**
+ * Hash image bytes for cache keys (avoids hashing multi-MB base64 twice and
+ * gives stable keys for identical images).
+ * @param {string} data - base64 or URL string
+ * @returns {string} short hash
+ */
+function hashImageData(data) {
+  if (!data || typeof data !== 'string') return 'empty';
+  // URLs are short — hash full string; base64 is huge — hash first+last 4k
+  const sample = data.length > 8192 ? data.slice(0, 4096) + data.slice(-4096) + data.length : data;
+  return crypto.createHash('sha256').update(sample).digest('hex').substring(0, 16);
+}
+
+/**
+ * Collect per-image hashes for semantic-cache context keying.
+ * @param {object} payload
+ * @returns {string|null} combined hash or null when no images
+ */
+function visionContextHash(payload) {
+  if (!payload || !Array.isArray(payload.messages)) return null;
+  const hashes = [];
+  const collect = (content) => {
+    if (!content || typeof content === 'string') return;
+    const arr = Array.isArray(content) ? content : [content];
+    for (const b of arr) {
+      if (!b || typeof b !== 'object') continue;
+      if (b.type === 'image' && b.source?.data) hashes.push(hashImageData(b.source.data));
+      else if (b.type === 'image' && b.source?.url) hashes.push(hashImageData(b.source.url));
+      else if ((b.type === 'image_url' || b.type === 'input_image') && b.image_url?.url) hashes.push(hashImageData(b.image_url.url));
+      else if (b.image_url?.url) hashes.push(hashImageData(b.image_url.url));
+      else if (b.inlineData?.data) hashes.push(hashImageData(b.inlineData.data));
+      else if (b.inline_data?.data) hashes.push(hashImageData(b.inline_data.data));
+      else if (b.type === 'tool_result' && b.content) collect(b.content);
+    }
+  };
+  for (const msg of payload.messages) {
+    if (msg) collect(msg.content);
+  }
+  if (hashes.length === 0) return null;
+  return crypto.createHash('sha256').update(hashes.sort().join(',')).digest('hex').substring(0, 16);
+}
+
+/**
+ * Per-provider transport + model capability gate.
+ * Returns true only when the provider can carry image bytes AND the model
+ * advertises vision support in the registry.
+ *
+ * @param {string} provider
+ * @param {string|null} model
+ * @returns {boolean}
+ */
+function providerSupportsVision(provider, model) {
+  if (!provider || TRANSPORTLESS_PROVIDERS.has(provider)) return false;
+  if (!model) return false;
+  try {
+    const { getModelRegistrySync } = require('./model-registry');
+    const registry = getModelRegistrySync();
+    const info = registry.getCost(model);
+    return info?.vision === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Redact image bytes for logging / trajectory export.
+ * Replaces source.data / image_url data: URLs with [REDACTED len=N hash=H].
+ * Mutates a deep-cloned structure — never call on live payloads.
+ * @param {*} value
+ * @returns {*}
+ */
+function redactVisionBytes(value) {
+  if (typeof value === 'string') {
+    if (value.length > 2000 && value.includes('data:image')) {
+      return value.replace(/data:image\/[^;,]+;base64,[A-Za-z0-9+/=]{100,}/g, (m) => `[REDACTED_IMAGE len=${m.length} hash=${hashImageData(m)}]`);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) return value.map(redactVisionBytes);
+  if (value && typeof value === 'object') {
+    const out = { ...value };
+    if (typeof out.source?.data === 'string' && out.source.data.length > 500) {
+      out.source = { ...out.source, data: `[REDACTED_IMAGE len=${out.source.data.length} hash=${hashImageData(out.source.data)}]` };
+    }
+    if (typeof out.image_url?.url === 'string' && out.image_url.url.startsWith('data:image') && out.image_url.url.length > 500) {
+      out.image_url = { ...out.image_url, url: `[REDACTED_IMAGE len=${out.image_url.url.length} hash=${hashImageData(out.image_url.url)}]` };
+    }
+    if (typeof out.inlineData?.data === 'string' && out.inlineData.data.length > 500) {
+      out.inlineData = { ...out.inlineData, data: `[REDACTED_IMAGE len=${out.inlineData.data.length}]` };
+    }
+    // Recurse into nested content
+    if (out.content !== undefined) out.content = redactVisionBytes(out.content);
+    if (out.text !== undefined && typeof out.text === 'string' && out.text.includes('data:image')) {
+      out.text = redactVisionBytes(out.text);
+    }
+    return out;
+  }
+  return value;
+}
+
+module.exports = {
+  VISION_IMAGE_TOKEN_ESTIMATE,
+  TRANSPORTLESS_PROVIDERS,
+  blockNeedsVision,
+  contentNeedsVision,
+  payloadNeedsVision,
+  countVisionImages,
+  hashImageData,
+  visionContextHash,
+  providerSupportsVision,
+  redactVisionBytes,
+};

package/src/training/trajectory-compressor.js

@@ -50,11 +50,19 @@ const ANONYMIZE_PATTERNS = [
   [/\/home\/[^/\s]+/g, "/home/<USER>"],
   // IPs
   [/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, "<IP>"],
+  // Inline base64 image bytes (never persist image data to training JSONL)
+  [/data:image\/[^;,]+;base64,[A-Za-z0-9+/=]{200,}/g, "<REDACTED_IMAGE>"],
   // Hostnames containing service-now / corporate domains (configurable)
   [/[A-Za-z0-9-]+\.service-now\.com/gi, "<SERVICENOW_HOST>"],
 ];
 
 function anonymize(value) {
+  // Strip image bytes at the structural level first (raw base64 source.data
+  // has no data: prefix for the regex to catch).
+  try {
+    const { redactVisionBytes } = require("../routing/vision");
+    value = redactVisionBytes(value);
+  } catch { /* best-effort */ }
   if (typeof value === "string") {
     let out = value;
     for (const [re, replacement] of ANONYMIZE_PATTERNS) {

package/src/utils/tokens.js

@@ -50,9 +50,9 @@ function countPayloadTokens(payload) {
             return sum + estimateTokens(block.text || '');
           } else if (block.type === 'tool_result') {
             return sum + estimateTokens(block.content || '');
-          } else if (block.type === 'image') {
-            // Images: rough estimate based on source length
-            return sum + estimateTokens(JSON.stringify(block.source || {}));
+          } else if (block.type === 'image' || block.type === 'image_url' || block.type === 'input_image' || block.image_url?.url || block.inlineData?.data || block.inline_data?.data) {
+            // Fixed per-image estimate — never count base64 bytes as text.
+            return sum + 1500;
           }
           return sum + estimateTokens(JSON.stringify(block));
         }, 0);