The v1.18.0 provider catalog: ten providers, three new model families, and defaults chosen by list price, not benchmark.

A provider catalog is the list of LLM providers and models a tool can send a review to, along with what each one costs and which one it picks when you don’t say. CommitBrief v1.18.0, released 2026-09-24, grew that list and changed two of the picks. This post is the current picture — replacing the provider roster in the earlier multi-provider post, which now reflects a stale six-provider, pre-v1.18.0 lineup.

The short version: ten providers total, three new model families cataloged (Anthropic, OpenAI, Gemini), two default models changed (anthropic, gemini; openai is unchanged), and every default is stated as a list-price and maintainer choice — not a measured quality claim. The setup wizard now says so in the picker itself.

The ten providers, as of v1.18.0

DeepSeek, Mistral, and Cohere are OpenAI-compatible: they reuse the openai-go client against the vendor’s own base URL rather than a bespoke SDK. codex-cli is the newest subprocess provider — a third CLI-backed option alongside claude-cli and gemini-cli, wrapping a locally-installed host CLI so a subscription you already pay for covers the bill instead of a second API key.

Three new model families, one release

v1.18.0’s catalog additions:

• Anthropic — claude-opus-5-5, claude-sonnet-5, claude-fable-5-1, alongside the existing claude-opus-4-8, claude-sonnet-4-6, and claude-haiku-4-5. All six carry a 1M-token context window except Haiku 4.5, which stays at 200K.
• OpenAI — gpt-6-astra, gpt-6-sol, gpt-6-luna, Responses-API-only reasoning models with a 1,050,000-token context window, alongside the existing gpt-5.5 / gpt-5.5-pro / gpt-5.4-mini and the older gpt-4o / gpt-4o-mini.
• Gemini — gemini-3.8-flash and gemini-3.5-flash-lite, alongside gemini-3.1-pro-preview, gemini-3.5-flash, and gemini-3.1-flash-lite.

List price per 1M tokens, input / output, from each vendor’s published pricing:

gpt-6-astra/sol/luna are Responses-API-only — CommitBrief routes them through that API rather than Chat Completions, the same split gpt-5.5-pro already needed. Gemini’s published pricing table also carries a scheduled increase for gemini-3.8-flash: the rates above hold through 2026-12-31, then Google’s page lists a jump to $1.50 / $7.50 / $0.15 per 1M starting 2027-01-01. If you’re budgeting past that date, use the later number.

Two defaults changed, one didn’t — and here’s exactly why

This is a behavior change: a fresh config, or any existing config that leaves providers.<name>.model unset, now reviews with a different model on two of the ten providers. A config that pins a model explicitly is unaffected. Neither change is a quality claim — CommitBrief has not measured Opus 5.5, Sonnet 5, or gemini-3.8-flash against its eval corpus, and the changelog says so directly.

gemini: gemini-3.5-flash → gemini-3.8-flash. This one follows an interim rule that holds until a live measurement exists: pick the cheapest model in the vendor’s current mid tier whose typical-diff cost estimate stays under the default cost warning threshold ($0.50). Google positions Flash between Flash-Lite and Pro in its own docs, and a typical staged diff — about 8,500 input tokens — estimates at roughly $0.012 with gemini-3.8-flash (rising to about $0.024 once the 2027-01-01 price increase lands). Not measured; picked by list price under a stated rule.

anthropic: claude-opus-4-8 → claude-opus-5-5. This one breaks the rule on purpose. The interim rule, applied mechanically, would have picked claude-sonnet-5 — the mid-tier model. The maintainer chose the flagship instead. Also not measured.

That flagship choice comes with a caveat worth reading before you rely on the cost estimate: claude-opus-5-5 thinks by default, and the estimator’s typical-diff figure — about $0.064 — does not count thinking tokens. In the worst case (output up to the 16,000-token ceiling plus one JSON-repair retry) a single review on this model can reach roughly $0.88, and that spike can happen without the cost-confirmation prompt appearing first, because the estimate that gates the prompt was computed before the thinking tokens were spent. If you’d rather have a hard ceiling than a flagship, pin claude-sonnet-5 yourself.

openai: unchanged, gpt-5.4-mini. No new default here — the existing pick already clears the interim rule and nothing in this release displaced it.

What the setup wizard shows now

commitbrief setup’s model picker used to list models with no price and no stated basis, and pressing Enter on the picker took whichever model the catalog happened to list first — not necessarily the provider’s actual default. v1.18.0 fixes both:

claude-opus-5-5 · $4.00/1M in · $20.00/1M out · not measured · default
claude-sonnet-5 · $2.00/1M in · $10.00/1M out · not measured
claude-fable-5-1 · $10.00/1M in · $50.00/1M out · not measured

Every cataloged entry now carries its list price and the literal words “not measured” — no quality signal is implied where none has been produced. The provider’s actual default model is labeled default and is what an Enter keypress on the picker now accepts, on every static-list provider (Anthropic, OpenAI, Gemini, DeepSeek, Mistral, Cohere). Ollama keeps its old first-in-list behavior, because a discovered model list has no catalog default to point at — it’s whatever you’ve pulled locally, and CommitBrief can’t know it in advance.

The action installs a binary now, not a go install

If you run CommitBrief in CI through commitbrief-action, the version input now defaults to v1.18.0 and resolves to a real release install, not a source build. Given a release tag (or latest), the action’s install step downloads the prebuilt platform binary from that GitHub release and verifies its SHA-256 against the release’s own checksums.txt before putting it on PATH. A missing checksum entry or a mismatch is a hard failure — there’s no fallback to a source build on a bad download, because that fallback would turn a corrupted or tampered download into a silent success.

Worth being precise about what that check does and doesn’t prove: it’s integrity, not provenance. checksums.txt ships unsigned, from the same release as the archive, so it confirms the binary you got matches the one the release published — not that a specific person or process produced it. Transport security is TLS, same as any HTTPS download. Only a branch name or a commit SHA still falls back to go install from source, which is slower and carries no checksum verification at all.

Pin the version input to a specific release tag if you want a CI run to be reproducible across time; latest resolves to whatever’s newest on every run, which means the CLI — and its default models — can change between two runs of the same workflow without you touching the workflow file.

What this doesn’t tell you

None of the numbers in this post are a quality ranking. CommitBrief ships an eval harness (make eval-live) that measures recall and false-positive rate against a fixture corpus, and v1.18.0 grew that corpus to 40 fixtures specifically so the numbers it eventually produces are statistically meaningful — but none of the new models in this release have been run through it yet. “Chosen by list price” and “chosen by the maintainer” are both stated as exactly that, not dressed up as a benchmark result. If you want a default you can trust for review quality rather than sticker price, the honest move today is to pick a model yourself and reproduce the eval against it, not to trust the default.

← all posts