jeo-code 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -9,6 +9,28 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-08-25
+_One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside._
+
+### Fixed
+- **The project-context parent walk did not stop at the home directory when `$HOME` was unset** (`src/agent/context-files.ts`) — the boundary was `process.env.HOME ? path.resolve(...) : null`, and a `null` guard never fires. `$HOME` is genuinely absent in bare Docker images, systemd units without `User=`, `env -i` wrappers and several CI runners, so on those hosts the walk climbed *past* the user's home into `/Users`, `/home` or `/` and spliced whatever `AGENTS.md` / `CLAUDE.md` lived there straight into the system prompt — on a shared machine, potentially another account's. Now resolved through `os.homedir()` (the OS user database, which answers correctly without the env var), the boundary test is "at or **above** home" so it also holds when the working directory is outside the home subtree entirely, and a `MAX_PARENT_WALK_DEPTH` cap makes walking the whole filesystem structurally impossible.
+- **The user-global guidance scan read the current working directory when `$HOME` was unset** (`src/agent/context-files.ts`) — roots were built with `path.join(process.env.HOME || "", ".agents", "rules")`, and `path.join("", …)` yields a **relative** path, so the "user global" scan silently read `./.agents/rules` and presented a project's own files as the user's global config. No resolvable home now means no home roots, full stop.
+- **Subagent fan-out burned an extra dispatch per refusal** (`src/agent/task-tool.ts` path, via the same context bug) — the leaked ancestor context made the refusal ladder's rung 3 (guidance-strip) fire as a real retry instead of the intended no-op, so every uncategorized refusal cost 4 model calls where 3 were budgeted, against `MAX_SUBAGENT_REROUTES`.
+- **The Telegram daemon's PID-reuse guard silently degraded to a bare `kill(pid, 0)`** (`src/agent/notify/daemon-control.ts`) — `processStartTimeMs` had a single point of failure in `ps`, which is exactly what is missing where daemons actually run: distroless/scratch containers ship no `ps`, and hardened sandboxes block the setuid `/bin/ps`. With the start-time check unavailable, `jeo daemon stop` would happily `SIGTERM` a recycled PID belonging to an unrelated process. Added a `/proc/<pid>/stat` + `/proc/uptime` fast path (Linux, no subprocess, works in distroless) ahead of `ps`, and split the result into `{ alive, verified }` via the new `inspectLockOwner` so the two facts stop being conflated.
+
+### Added
+- **`config.subagentConcurrency`** (`resolveFanoutLimit`, default 4, clamped 1..16) — fan-out concurrency is now tunable per machine instead of a hardcoded `MAX_FANOUT`. Four concurrent Anthropic streams trip a Tier-1 rate limit immediately, turning a fan-out into a backoff storm that is *slower* than running sequentially; accounts with headroom can raise it. Bounds both the `task` tool's `tasks[]` batch and the `eval` tool's `parallel`/`pipeline` helpers.
+- **Retired-model registry** (`src/ai/model-retirements.ts`) + a `jeo doctor` check that names the exact stale config key. Alias expansion already reroutes a sunset id to its successor, which means a stale pin keeps working and the user is *never told* their `defaultModel` / `roles.*` / `subagents.<role>.model` is out of date — until the alias is eventually dropped and every turn starts 404-ing. `findRetiredPins` reports the location, the replacement and why, and the table is constrained to same-provider successors so nobody is silently moved to another vendor.
+- **`daemonStatus().ownerVerified`**, surfaced by `jeo daemon status` — says outright when the host cannot report process start times, so "running" is not mistaken for "verified".
+
+### Changed
+- README (en/ko/ja/zh): custom-provider registry in the highlights, the `/provider add|list|remove|presets` row in the slash table, and new Configuration sections for `customProviders` and `subagentConcurrency`.
+
+### Verified
+- `bun run typecheck` clean; `bun test` **3339 pass**, failures down from **22 to 6** against the 0.10.0 baseline. The 16 fixed are real (13 context/fan-out, 3 daemon); the remaining 6 are sandbox-only (`bashTool` child signals, REPL stdin-EOF and `--resume` spawn timeouts) and unrelated to this change.
+- 3 PID-reuse tests are now capability-gated (`canVerifyProcessStartTime`) rather than failing on hosts without `ps`//proc, with 2 new tests pinning the **degraded** contract so the fallback path stays covered everywhere.
+- 8 new tests in `test/model-retirements-fanout.test.ts`; `test/context-files.test.ts` isolation corrected to an empty temp `HOME` (deleting `$HOME` no longer isolates, by design).
+
 ## [0.10.0] - 2026-08-25
 _jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script._
 

package/README.ja.md

@@ -38,7 +38,7 @@
 
 ## ハイライト
 
-- **マルチプロバイダ・単一ループ** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio に加え、OpenAI・Anthropic 互換クラウド20以上(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai など)を均一な JSON ツールループで。入力欄から OAuth ログイン(`/provider login`)、モデル選択は即座にデフォルトとして永続化。プロンプトルーティングは実際に使える認証済み経路だけを自動選択します: Gemini OAuth は provider-qualified な `antigravity/*` エージェントセット(Gemini 3.5 Flash 各ティア、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6)へ向かい、`GEMINI_API_KEY` が必要な public `google/gemini-*` 行は選びません。
+- **マルチプロバイダ・単一ループ** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio に加え、OpenAI・Anthropic 互換クラウド20以上(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai など)を均一な JSON ツールループで — **さらに自分で登録したエンドポイントも**: `jeo provider add --id my-proxy --base-url https://…`(または `--preset litellm|vllm|sglang|azure-openai|…`)で、LiteLLM プロキシ・自前ホストの vLLM・社内 Anthropic ゲートウェイが、組み込みの `openai` プロバイダを乗っ取ることなく独自のルーティング接頭辞・モデル一覧・認証情報を持てます。入力欄から OAuth ログイン(`/provider login`)、モデル選択は即座にデフォルトとして永続化。プロンプトルーティングは実際に使える認証済み経路だけを自動選択します: Gemini OAuth は provider-qualified な `antigravity/*` エージェントセット(Gemini 3.5 Flash 各ティア、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6)へ向かい、`GEMINI_API_KEY` が必要な public `google/gemini-*` 行は選びません。
 - **編集の完全性** — read 出力にコンテンツアンカー(`42ab|`)が付き、アンカー付き編集は現在のファイルと照合・行移動時は自動再マッピング・不一致時は最新内容と共に拒否されます。
 - **自己修正の検証ループ** — post-edit フック(tsc / eslint / テスト)を設定すると、エージェントが診断を*自ら読み*ループ内で修正します。フックが赤のままだと `done` はブロックされます。
 - **芝居なしの本物のゲート** — `ralplan` の合議はリポジトリを実際に読む critic サブエージェントで、`[OKAY]` 評決が永続化され `jeo approve` がそれを*要求*します。`ultragoal` は誠実に報告します(スイート1回実行はグローバル信号であり、基準ごとの合格を捏造しません)。
@@ -87,6 +87,7 @@ jeo --tmux               # 独立した tmux セッションで実行
 | --- | --- |
 | `/model` · `/provider` | モデル/プロバイダ選択; `/model` でデフォルト/ロールバッジ、Ralph 風の入れ子ロール・thinking 選択、OpenAI Codex ロールプリセットを一つの流れで設定 |
 | `/provider login <name>` · `/logout` | 入力欄から OAuth ログイン/ログアウト |
+| `/provider add` · `list` · `remove` · `presets` | OpenAI/Anthropic 互換エンドポイントを正式なプロバイダとして登録(ゲートウェイプリセット15種) |
 | `/agents [role]` · `/subagent` | ロール別(executor/planner/architect/critic)モデル・thinking・ステップ設定 |
 | `/thinking [level]` | デフォルト推論予算(low…xhigh)の表示/設定 |
 | `/route [status\|on\|off\|why\|history [n]]` | セッション単位のプロンプトベース・モデルルーティングの切替 · 直近のルーティング判断の説明 · `history [n]` はこのセッションの直近 n 件(デフォルト 10 件)のルーティング判断を表示(設定済み資格情報 — OAuth または API キー — が実際に提供するモデルの中でのみ自動ルーティング) |
@@ -246,6 +247,37 @@ JEO_TOOL_OUTPUT_MAX=4000        # モデル可視のツール出力上限(全文
 
 リトライ動作は `~/.jeo/config.json` の `retry` で調整します(`requestMaxRetries`、`streamMaxRetries`、`rateLimitRetries`、`failFastStatuses` など)。ステップ予算はデフォルトで動的 — 新規進捗が見える間は延長され、停滞時は要約に収束します。`--max-steps N` で有限フローに戻ります。
 
+### カスタムプロバイダ
+
+```jsonc
+{
+  "customProviders": {
+    "my-proxy": {
+      "baseUrl": "https://gateway.internal/v1",
+      "protocol": "openai",            // または "anthropic" (/v1/messages ワイヤ形式)
+      "apiKeyEnv": "MY_PROXY_API_KEY", // 既定: <ID>_API_KEY
+      "models": ["fast", "smart"]      // オフライン一覧。ライブ /models が優先されます
+    }
+  }
+}
+```
+
+シェル(`jeo provider add|list|remove|presets|test`)からも入力欄(`/provider add …`)からも
+同じレジストリを扱えます。`jeo provider test <id>` はエンドポイントを実際に叩き、
+**認証情報の問題とエンドポイントの問題を分けて**報告し、失敗時は非ゼロ終了するため
+プロビジョニングスクリプトのゲートに使えます。
+
+### サブエージェントのファンアウト並列度
+
+```jsonc
+{ "subagentConcurrency": 2 }   // 既定 4、1〜16 にクランプ
+```
+
+Anthropic の Tier-1 アカウントでは同時ストリーム4本で即座にレートリミットに達し、
+ファンアウトが逐次実行より*遅い*バックオフの嵐になります。制限の厳しいアカウントでは
+下げ、余裕があれば上げてください。`task` ツールの `tasks[]` バッチと `eval` ツールの
+`parallel`/`pipeline` ヘルパーの両方に効きます。
+
 ## スキル移行とバンドルスキルの確認
 
 ワークフローを jeo に移す際は、何かをインストール・上書きする前にバンドルされたデフォルトを確認してください:
@@ -287,10 +319,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
 - **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 - **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
-- **[0.9.15]** (2026-08-18) — The 0.9.14 fix wired `promptInput` into the `$a $b …` one-shot skill-chain's `io.input`, but that chain runs before the interactive REPL's own `readline.Interface` exists — so a bundled workflow skill (`$deep-interview`, with or without `--tmux`) invoked directly from the command line still froze forever on its first question.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -38,7 +38,7 @@
 
 ## 하이라이트
 
-- **멀티 프로바이더, 단일 루프** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio, 그리고 OpenAI·Anthropic 호환 클라우드 20종 이상(Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai 등)까지 균일한 JSON 도구 루프로. 입력창에서 바로 OAuth 로그인(`/provider login`), 모델 선택은 즉시 기본값으로 영속됩니다. 프롬프트 라우팅은 실제 사용 가능한 인증 경로만 자동 선택합니다: Gemini OAuth는 provider-qualified `antigravity/*` 에이전트 세트(Gemini 3.5 Flash 등급, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6)로만 가고, `GEMINI_API_KEY`가 필요한 public `google/gemini-*` 행은 고르지 않습니다.
+- **멀티 프로바이더, 단일 루프** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio, 그리고 OpenAI·Anthropic 호환 클라우드 20종 이상(Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai 등)까지 균일한 JSON 도구 루프로 — **여기에 직접 등록한 엔드포인트까지**: `jeo provider add --id my-proxy --base-url https://…` (또는 `--preset litellm|vllm|sglang|azure-openai|…`)로 LiteLLM 프록시·자체 호스팅 vLLM·사내 Anthropic 게이트웨이가 내장 `openai` 프로바이더를 덮어쓰지 않고 자기만의 라우팅 접두사·모델 목록·자격증명을 갖습니다. 입력창에서 바로 OAuth 로그인(`/provider login`), 모델 선택은 즉시 기본값으로 영속됩니다. 프롬프트 라우팅은 실제 사용 가능한 인증 경로만 자동 선택합니다: Gemini OAuth는 provider-qualified `antigravity/*` 에이전트 세트(Gemini 3.5 Flash 등급, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6)로만 가고, `GEMINI_API_KEY`가 필요한 public `google/gemini-*` 행은 고르지 않습니다.
 - **편집 무결성** — read 출력에 콘텐츠 앵커(`42ab|`)가 붙고, 앵커 편집은 현재 파일과 대조 검증·줄 이동 시 자동 재매핑·불일치 시 최신 내용과 함께 거부 — 파일을 오염시키지 않습니다.
 - **자기수정 검증 루프** — post-edit 훅(tsc / eslint / 테스트)을 설정하면 에이전트가 진단을 *직접 읽고* 루프 안에서 수정합니다. 훅이 빨간 상태면 `done`이 차단됩니다.
 - **연극 없는 진짜 게이트** — `ralplan` 합의는 실제 저장소를 읽는 critic 서브에이전트이며 `[OKAY]` 평결이 영속되고 `jeo approve`가 이를 *요구*합니다. `ultragoal`은 정직하게 보고합니다(스위트 1회 실행은 전역 신호일 뿐, 기준별 통과를 조작하지 않음).
@@ -88,6 +88,7 @@ jeo --tmux               # 독립 tmux 세션에서 실행
 | --- | --- |
 | `/model` · `/provider` | 모델/프로바이더 선택; `/model`에서 기본/역할 배지, Ralph식 하위 리스트 역할·thinking 선택, OpenAI Codex 역할 프리셋을 한 흐름으로 설정 |
 | `/provider login <name>` · `/logout` | 입력창에서 OAuth 로그인/로그아웃 |
+| `/provider add` · `list` · `remove` · `presets` | OpenAI/Anthropic 호환 엔드포인트를 정식 프로바이더로 등록 (게이트웨이 프리셋 15종) |
 | `/agents [role]` · `/subagent` | 역할별(executor/planner/architect/critic) 모델·thinking·스텝 구성 |
 | `/thinking [level]` | 기본 추론 예산(low…xhigh) 조회/설정 |
 | `/route [status\|on\|off\|why\|history [n]]` | 세션별 프롬프트 기반 모델 라우팅 켜기/끄기 · 마지막 라우팅 결정 설명 · `history [n]`은 이번 세션의 최근 n개(기본 10개) 라우팅 결정 표시(설정된 자격증명 — OAuth 또는 API 키 — 이 실제로 서비스하는 모델 안에서만 자동 라우팅) |
@@ -247,6 +248,37 @@ JEO_TOOL_OUTPUT_MAX=4000        # 모델 가시 도구 출력 캡(전체는 아
 
 재시도 동작은 `~/.jeo/config.json`의 `retry`로 조정합니다(`requestMaxRetries`, `streamMaxRetries`, `rateLimitRetries`, `failFastStatuses`, …). 스텝 버짓은 기본 동적 — 새로운 진전이 보이는 동안 연장되고 정체 시 요약으로 수렴하며, `--max-steps N`이면 유한 플로로 복귀합니다.
 
+### 커스텀 프로바이더
+
+```jsonc
+{
+  "customProviders": {
+    "my-proxy": {
+      "baseUrl": "https://gateway.internal/v1",
+      "protocol": "openai",            // 또는 "anthropic" (/v1/messages 와이어 포맷)
+      "apiKeyEnv": "MY_PROXY_API_KEY", // 기본값: <ID>_API_KEY
+      "models": ["fast", "smart"]      // 오프라인 목록. 라이브 /models 가 우선합니다
+    }
+  }
+}
+```
+
+셸(`jeo provider add|list|remove|presets|test`)에서도, 입력창(`/provider add …`)에서도
+같은 레지스트리를 다룹니다. `jeo provider test <id>`는 엔드포인트를 실제로 찔러보고
+**자격증명 문제와 엔드포인트 문제를 따로** 보고하며, 실패 시 non-zero로 종료하므로
+프로비저닝 스크립트에서 게이트로 쓸 수 있습니다.
+
+### 서브에이전트 팬아웃 동시성
+
+```jsonc
+{ "subagentConcurrency": 2 }   // 기본 4, 1~16으로 클램프
+```
+
+Anthropic Tier-1 계정은 동시 스트림 4개에서 곧바로 레이트 리밋에 걸려, 팬아웃이
+순차 실행보다 *느려지는* 백오프 폭풍이 됩니다. 레이트 리밋이 빡빡한 계정은 낮추고,
+여유가 있으면 올리세요. `task` 도구의 `tasks[]` 배치와 `eval` 도구의
+`parallel`/`pipeline` 헬퍼 양쪽 모두에 적용됩니다.
+
 ## 스킬 마이그레이션 및 번들 스킬 확인
 
 워크플로를 jeo로 옮기기 전에, 무언가를 설치하거나 덮어쓰기 전에 먼저 번들 기본값을 확인하세요:
@@ -288,10 +320,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
 - **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 - **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
-- **[0.9.15]** (2026-08-18) — The 0.9.14 fix wired `promptInput` into the `$a $b …` one-shot skill-chain's `io.input`, but that chain runs before the interactive REPL's own `readline.Interface` exists — so a bundled workflow skill (`$deep-interview`, with or without `--tmux`) invoked directly from the command line still froze forever on its first question.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -42,7 +42,7 @@ Run `jeo` inside a repository and it reads files, edits them, runs commands, and
 
 - **Prompt routing (cost-aware, credential-aware)** — every turn can auto-route to a tier-appropriate model among only the providers your configured credentials actually serve (`/route [status|on|off|why|history]`), with a live equivalent-model fallback whenever a routed provider is rate-limited, unauthenticated, unreachable, or silently times out — see `/route why` for the last decision, `/route history` for the recent ones.
 - **Computer use (desktop automation)** — a fail-closed `computer` tool (screenshot/click/type/scroll/drag/batch) gated by both a config flag and an independent kill-switch/heartbeat supervisor; toggle it for the current session with `/computer [status|on|off]` without touching `~/.jeo/config.json`.
-- **Multi-provider, one loop** — Anthropic / OpenAI (+Codex) / Gemini / Antigravity / Ollama / LM Studio, plus 20+ OpenAI- and Anthropic-compatible clouds (Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai, …), all behind one uniform JSON tool loop. OAuth login happens from the input box (`/provider login`), every model pick persists as the new default, and prompt routing only auto-selects usable credentialed paths: Gemini OAuth goes through the provider-qualified `antigravity/*` agent set (Gemini 3.5 Flash tiers, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6), never public `google/gemini-*` rows that require `GEMINI_API_KEY`; if a configured route points at an unready provider, jeo switches to an equivalent credentialed tier model before falling back to the default.
+- **Multi-provider, one loop** — Anthropic / OpenAI (+Codex) / Gemini / Antigravity / Ollama / LM Studio, plus 20+ OpenAI- and Anthropic-compatible clouds (Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai, …), all behind one uniform JSON tool loop — **plus any endpoint you register yourself**: `jeo provider add --id my-proxy --base-url https://…` (or `--preset litellm|vllm|sglang|azure-openai|…`) gives a LiteLLM proxy, a self-hosted vLLM box or a corporate Anthropic gateway its own routing prefix, model list and credential, instead of hijacking the built-in `openai` provider. OAuth login happens from the input box (`/provider login`), every model pick persists as the new default, and prompt routing only auto-selects usable credentialed paths: Gemini OAuth goes through the provider-qualified `antigravity/*` agent set (Gemini 3.5 Flash tiers, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6), never public `google/gemini-*` rows that require `GEMINI_API_KEY`; if a configured route points at an unready provider, jeo switches to an equivalent credentialed tier model before falling back to the default.
 
 - **Edit integrity** — read output carries content anchors (`42ab|`); anchored edits are verified against the current file, re-mapped when lines shifted, and rejected with fresh content instead of corrupting.
 - **Self-correcting verification loop** — configure a post-edit hook (tsc / eslint / tests) and the agent *sees* the diagnostics and fixes them in-loop; a red hook blocks `done` until resolved.
@@ -93,6 +93,7 @@ Inside the `jeo` REPL (Tab autocompletes; `/` opens the palette).
 | --- | --- |
 | `/model` · `/provider` | Pick model/provider; `/model` shows default/role badges, Ralph-style nested Set-as-role thinking choices, and the OpenAI Codex role preset in one flow |
 | `/provider login <name>` · `/logout` | OAuth login/logout from the input box |
+| `/provider add` · `list` · `remove` · `presets` | Register OpenAI/Anthropic-compatible endpoints as first-class providers (15 gateway presets) |
 | `/agents [role]` · `/subagent` | Per-role (executor/planner/architect/critic) model · thinking · step config |
 | `/thinking [level]` | Show/set default reasoning budget (low…xhigh) |
 | `/route [status\|on\|off\|why\|history [n]]` | Toggle prompt-based model routing for this session · explain the last routing decision · `history [n]` lists the last n (default 10) routing decisions this session (auto-routes each turn to a tier-appropriate model among the models your configured credentials — OAuth or API key — actually serve, and switches to an equivalent tier model when a configured route is unready) |
@@ -195,7 +196,7 @@ jeo notify setup        # pair a BotFather bot once (getMe verification + chat-i
 jeo notify status       # masked token, paired chat id, daemon state
 jeo daemon start        # spawn the singleton background daemon
 jeo daemon status       # check whether it's running
-jeo daemon stop         # SIGTERM it
+jeo daemon stop         # SIGTERM it (refuses to signal a recycled pid)
 ```
 
 ```
@@ -253,6 +254,37 @@ JEO_TOOL_OUTPUT_MAX=4000        # model-visible tool output cap (full output spi
 
 Retry behavior is tunable via `retry` in `~/.jeo/config.json` (`requestMaxRetries`, `streamMaxRetries`, `rateLimitRetries`, `failFastStatuses`, …). The step budget is dynamic by default — it extends while recent tool calls show novel progress and consolidates with a wrap-up when stalled; `--max-steps N` restores a bounded flow.
 
+### Custom providers
+
+```jsonc
+{
+  "customProviders": {
+    "my-proxy": {
+      "baseUrl": "https://gateway.internal/v1",
+      "protocol": "openai",          // or "anthropic" (/v1/messages wire format)
+      "apiKeyEnv": "MY_PROXY_API_KEY", // default: <ID>_API_KEY
+      "models": ["fast", "smart"]      // offline pick-list; live /models supersedes it
+    }
+  }
+}
+```
+
+Manage it from the shell (`jeo provider add|list|remove|presets|test`) or the input box
+(`/provider add …`). `jeo provider test <id>` probes the endpoint and reports the
+credential source and endpoint health *separately*, exiting non-zero on failure so
+provisioning scripts can gate on it.
+
+### Subagent fan-out concurrency
+
+```jsonc
+{ "subagentConcurrency": 2 }   // default 4, clamped to 1..16
+```
+
+Four concurrent Anthropic streams trip a Tier-1 rate limit immediately, turning a
+fan-out into a backoff storm that is *slower* than running sequentially. Lower this on a
+rate-limited account; raise it when the provider has headroom. It bounds both the `task`
+tool's `tasks[]` batch and the `eval` tool's `parallel`/`pipeline` helpers.
+
 ## Skill migration and bundled skill inspection
 
 When moving a workflow into jeo, inspect the bundled defaults before installing or overwriting anything:
@@ -295,10 +327,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
 - **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 - **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
-- **[0.9.15]** (2026-08-18) — The 0.9.14 fix wired `promptInput` into the `$a $b …` one-shot skill-chain's `io.input`, but that chain runs before the interactive REPL's own `readline.Interface` exists — so a bundled workflow skill (`$deep-interview`, with or without `--tmux`) invoked directly from the command line still froze forever on its first question.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -38,7 +38,7 @@
 
 ## 亮点
 
-- **多提供商、单一循环** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio，以及 20+ 个 OpenAI、Anthropic 兼容云服务(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai 等)，统一在一个 JSON 工具循环中。输入框内直接 OAuth 登录(`/provider login`)，模型选择即刻持久化为默认值。Prompt routing 只会自动选择真实可用的凭据路径: Gemini OAuth 会走 provider-qualified 的 `antigravity/*` 代理模型集(Gemini 3.5 Flash 各档、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6)，绝不选择需要 `GEMINI_API_KEY` 的 public `google/gemini-*` 行。
+- **多提供商、单一循环** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio，以及 20+ 个 OpenAI、Anthropic 兼容云服务(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai 等)，统一在一个 JSON 工具循环中 — **还包括你自己注册的端点**: `jeo provider add --id my-proxy --base-url https://…`(或 `--preset litellm|vllm|sglang|azure-openai|…`)让 LiteLLM 代理、自托管 vLLM、企业内部 Anthropic 网关拥有各自的路由前缀、模型列表和凭据，而不是劫持内置的 `openai` 提供商。输入框内直接 OAuth 登录(`/provider login`)，模型选择即刻持久化为默认值。Prompt routing 只会自动选择真实可用的凭据路径: Gemini OAuth 会走 provider-qualified 的 `antigravity/*` 代理模型集(Gemini 3.5 Flash 各档、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6)，绝不选择需要 `GEMINI_API_KEY` 的 public `google/gemini-*` 行。
 - **编辑完整性** — read 输出携带内容锚点(`42ab|`)；带锚点的编辑会与当前文件校验、行移动时自动重映射、不匹配时连同最新内容一起拒绝 — 绝不污染文件。
 - **自我修正的验证循环** — 配置 post-edit 钩子(tsc / eslint / 测试)，代理会*亲自读取*诊断并在循环内修复；钩子未通过时 `done` 会被阻断。
 - **没有表演的真实门禁** — `ralplan` 共识由真正读取仓库的 critic 子代理执行，`[OKAY]` 裁决被持久化且 `jeo approve` *强制要求*它；`ultragoal` 诚实报告(套件运行只是全局信号，绝不伪造逐条通过)。
@@ -87,6 +87,7 @@ jeo --tmux               # 在独立 tmux 会话中运行
 | --- | --- |
 | `/model` · `/provider` | 选择模型/提供商；`/model` 在一个流程内显示默认/角色徽章、Ralph 风格嵌套角色·thinking 选择与 OpenAI Codex 角色预设 |
 | `/provider login <name>` · `/logout` | 在输入框内 OAuth 登录/登出 |
+| `/provider add` · `list` · `remove` · `presets` | 将 OpenAI/Anthropic 兼容端点注册为一等提供商(15 个网关预设) |
 | `/agents [role]` · `/subagent` | 按角色(executor/planner/architect/critic)配置模型·thinking·步数 |
 | `/thinking [level]` | 查看/设置默认推理预算(low…xhigh) |
 | `/route [status\|on\|off\|why\|history [n]]` | 切换本会话的基于提示词的模型路由 · 解释最近一次路由决策 · `history [n]` 列出本会话最近 n 条(默认 10 条)路由决策(仅在已配置凭证 — OAuth 或 API 密钥 — 实际可用的模型内自动路由) |
@@ -246,6 +247,35 @@ JEO_TOOL_OUTPUT_MAX=4000        # 模型可见的工具输出上限(全文溢出
 
 重试行为通过 `~/.jeo/config.json` 的 `retry` 调整(`requestMaxRetries`、`streamMaxRetries`、`rateLimitRetries`、`failFastStatuses` 等)。步数预算默认动态 — 只要看到新的进展就延长，停滞时收敛为总结；`--max-steps N` 恢复有界流程。
 
+### 自定义提供商
+
+```jsonc
+{
+  "customProviders": {
+    "my-proxy": {
+      "baseUrl": "https://gateway.internal/v1",
+      "protocol": "openai",            // 或 "anthropic" (/v1/messages 协议)
+      "apiKeyEnv": "MY_PROXY_API_KEY", // 默认: <ID>_API_KEY
+      "models": ["fast", "smart"]      // 离线列表；实时 /models 优先
+    }
+  }
+}
+```
+
+命令行(`jeo provider add|list|remove|presets|test`)与输入框(`/provider add …`)操作同一份注册表。
+`jeo provider test <id>` 会真实探测端点，并**分别报告凭据问题与端点问题**，
+失败时以非零码退出，可直接用作部署脚本的检查关卡。
+
+### 子代理扇出并发度
+
+```jsonc
+{ "subagentConcurrency": 2 }   // 默认 4，限制在 1~16
+```
+
+Anthropic Tier-1 账号在 4 条并发流时会立刻触发限流，使扇出变成比顺序执行**更慢**的
+退避风暴。限流紧张的账号请调低，额度充足时可调高。该值同时约束 `task` 工具的
+`tasks[]` 批处理与 `eval` 工具的 `parallel`/`pipeline` 辅助函数。
+
 ## 技能迁移与内置技能检查
 
 把某个工作流迁移到 jeo 之前，先检查内置默认值，再决定是否安装或覆盖任何内容:
@@ -287,10 +317,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
 - **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
 - **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
-- **[0.9.15]** (2026-08-18) — The 0.9.14 fix wired `promptInput` into the `$a $b …` one-shot skill-chain's `io.input`, but that chain runs before the interactive REPL's own `readline.Interface` exists — so a bundled workflow skill (`$deep-interview`, with or without `--tmux`) invoked directly from the command line still froze forever on its first question.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -179,6 +179,12 @@ export const ConfigSchema = z
      * (executor / planner / architect / critic); each may pin a model and/or a
      * step budget. Tolerant of unknown keys.
      */
+    /** Max subagents a fan-out batch runs CONCURRENTLY (`task: {tasks:[...]}`) and the
+     *  bound the eval tool's `parallel`/`pipeline` helpers enforce. Default 4.
+     *  Lower it on a rate-limited account (4 concurrent Anthropic streams trips Tier-1
+     *  limits immediately); raise it when the provider has headroom. Clamped to 1..16 —
+     *  above that the parent turn is monopolized regardless of provider capacity. */
+    subagentConcurrency: z.number().int().min(1).max(16).optional(),
     subagents: z
       .record(
         z.object({

package/src/agent/context-files.ts

@@ -1,8 +1,78 @@
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 
 import { IGNORED_DIRS } from "./tools";
 
+/**
+ * The user's home directory, or `undefined` when it genuinely cannot be determined.
+ *
+ * `$HOME` is NOT always set: bare Docker images, systemd units without `User=`,
+ * `env -i` wrappers and some CI runners all launch processes without it. Two separate
+ * bugs came out of reading `process.env.HOME` raw:
+ *
+ *  1. The parent walk below stops at the home directory. With `HOME` unset that guard
+ *     was `null` and never fired, so the walk climbed PAST the user's home into
+ *     `/Users`, `/home`, or `/` — loading whatever `AGENTS.md` / `CLAUDE.md` happened
+ *     to sit there (on a shared machine, potentially another account's) straight into
+ *     the system prompt.
+ *  2. `discoverAgentGuidanceFiles` built its home roots with
+ *     `path.join(process.env.HOME || "", ".agents", "rules")`, and `path.join("", ...)`
+ *     yields a RELATIVE path — so with `HOME` unset it scanned `./.agents/rules`,
+ *     i.e. the current working directory, and treated a project's files as if they were
+ *     the user's global config.
+ *
+ * `os.homedir()` consults the OS user database (getpwuid / USERPROFILE), so it still
+ * answers correctly when the env var is missing. It is only allowed to return a usable
+ * value — an empty or relative result is rejected rather than silently becoming ".".
+ */
+export function resolveHomeDir(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const candidates = [env.HOME, safeOsHomedir()];
+  for (const c of candidates) {
+    const trimmed = c?.trim();
+    if (!trimmed) continue;
+    const resolved = path.resolve(trimmed);
+    // `path.resolve` always returns an absolute path, but a bogus "."/"" input would
+    // resolve to the CWD — which is exactly the bug this function exists to prevent.
+    if (resolved === path.resolve(process.cwd()) && trimmed !== resolved) continue;
+    return resolved;
+  }
+  return undefined;
+}
+
+function safeOsHomedir(): string | undefined {
+  try {
+    return os.homedir() || undefined;
+  } catch {
+    // os.homedir() throws on exotic platforms with no user database.
+    return undefined;
+  }
+}
+
+/** Hard ceiling on the parent walk. The home boundary and the git-root check normally
+ *  stop it long before this; the cap is defence in depth so a pathological environment
+ *  (no home, no git root, deeply nested cwd) can never walk the whole filesystem. */
+const MAX_PARENT_WALK_DEPTH = 24;
+
+/**
+ * True when `dir` is at or above the user's home directory — i.e. a shared/system path
+ * such as `/Users`, `/home` or `/`.
+ *
+ * The parent walk must never read agent context from these. Stopping only on
+ * `curr === home` was too weak: when the working directory is NOT inside home (a repo
+ * under `/opt`, or a temp dir whose `TMPDIR` points outside home) that equality never
+ * holds, and the walk climbs into directories that can belong to another account or to
+ * the machine itself — silently splicing their `AGENTS.md` / `CLAUDE.md` into the
+ * system prompt. Testing "is an ancestor of home" stops at the same place for the
+ * common case AND caps the uncommon one at the last non-shared directory.
+ */
+function isAtOrAboveHome(dir: string, home: string | null): boolean {
+  if (!home) return false;
+  if (dir === home) return true;
+  // `home` lives under `dir` → `dir` is a shared ancestor (e.g. /Users for /Users/x).
+  return home.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep);
+}
+
 interface ContextItem {
   filePath: string;
   displayPath: string;
@@ -225,15 +295,20 @@ export function invalidateWorkspaceScan(cwd?: string): void {
 export async function discoverAgentGuidanceFiles(cwd = process.cwd()): Promise<Array<{ filePath: string; displayPath: string }>> {
   const scan = await getWorkspaceScan(cwd);
   const out: Array<{ filePath: string; displayPath: string }> = [...scan.localGuidance];
-  const home = path.join(process.env.HOME || "", "");
-  const homeRoots = [
-    { rootDir: path.join(home, ".agents", "rules"), displayPrefix: "~/.agents/rules" },
-    { rootDir: path.join(home, ".jeo", "rules"), displayPrefix: "~/.jeo/rules" },
-    { rootDir: path.join(home, ".agents", "hooks"), displayPrefix: "~/.agents/hooks" },
-    { rootDir: path.join(home, ".jeo", "hooks"), displayPrefix: "~/.jeo/hooks" },
-  ];
-  for (const root of homeRoots) {
-    await collectTextFiles(root.rootDir, root.displayPrefix, 2, out);
+  // No resolvable home → NO home roots. Previously this fell back to `path.join("", …)`,
+  // a RELATIVE path, so the "user global" scan silently read the current working
+  // directory's `.agents/rules` and presented project files as user-global config.
+  const home = resolveHomeDir();
+  if (home) {
+    const homeRoots = [
+      { rootDir: path.join(home, ".agents", "rules"), displayPrefix: "~/.agents/rules" },
+      { rootDir: path.join(home, ".jeo", "rules"), displayPrefix: "~/.jeo/rules" },
+      { rootDir: path.join(home, ".agents", "hooks"), displayPrefix: "~/.agents/hooks" },
+      { rootDir: path.join(home, ".jeo", "hooks"), displayPrefix: "~/.jeo/hooks" },
+    ];
+    for (const root of homeRoots) {
+      await collectTextFiles(root.rootDir, root.displayPrefix, 2, out);
+    }
   }
   const seen = new Set<string>();
   return out.filter(entry => {
@@ -261,7 +336,7 @@ export async function loadProjectContext(cwd = process.cwd()): Promise<ProjectCo
   };
 
   const resolvedCwd = path.resolve(cwd);
-  const home = process.env.HOME ? path.resolve(process.env.HOME) : null;
+  const home = resolveHomeDir() ?? null;
   const collectedItems: ContextItem[] = [];
 
   // 0. User-global context files (~/.jeo/agent/AGENTS.md) — lowest precedence.
@@ -293,7 +368,11 @@ export async function loadProjectContext(cwd = process.cwd()): Promise<ProjectCo
   let curr = resolvedCwd;
   let distance = 0;
   while (true) {
-    if (home && curr === home) {
+    if (isAtOrAboveHome(curr, home)) {
+      break;
+    }
+    // Never walk the entire filesystem, even if the home boundary is unknowable.
+    if (distance >= MAX_PARENT_WALK_DEPTH) {
       break;
     }
 

package/src/agent/notify/daemon-control.ts

@@ -42,13 +42,52 @@ export function parseEtimeToMs(raw: string): number | undefined {
   return ((days * 24 + h!) * 60 + m!) * 60 * 1000 + s! * 1000;
 }
 
-/** Best-effort actual OS process start time in epoch ms, via `ps -o etime=`
- *  (POSIX-portable across macOS/Linux `ps`; unsupported on Windows, where
- *  there is no equivalent zero-dependency lookup). Returns `undefined` when
- *  the lookup is unavailable or unparseable — callers MUST treat that as
- *  "cannot verify" and fall back to the existence-only check, not as "dead". */
+/**
+ * Read a process's start time from `/proc` — Linux only, no subprocess.
+ *
+ * Field 22 of `/proc/<pid>/stat` is the process start time in clock ticks since
+ * boot; `/proc/uptime` gives seconds since boot. Together they yield an epoch
+ * timestamp WITHOUT spawning anything. That matters because the `ps` path below is
+ * exactly what disappears in the environments a Telegram daemon actually runs in:
+ * distroless and scratch containers ship no `ps`, and hardened sandboxes/seccomp
+ * profiles routinely block the setuid `/bin/ps`. When the lookup dies there, the
+ * PID-reuse guard silently degrades to a bare `kill(pid, 0)` — see
+ * {@link isLockOwnerAlive} for why that is the dangerous case.
+ *
+ * The 22nd field is parsed from the LAST `)` rather than by splitting on spaces:
+ * field 2 is the executable name in parentheses and may itself contain spaces.
+ */
+function procStartTimeMs(pid: number): number | undefined {
+  if (process.platform !== "linux") return undefined;
+  try {
+    const stat = fsSync.readFileSync(`/proc/${pid}/stat`, "utf-8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 2);
+    const fields = afterComm.split(" ");
+    // stat field 22 (1-based) == index 19 of the post-comm remainder (fields 3+).
+    const startTicks = Number(fields[19]);
+    if (!Number.isFinite(startTicks)) return undefined;
+    const uptimeSec = Number(fsSync.readFileSync("/proc/uptime", "utf-8").split(" ")[0]);
+    if (!Number.isFinite(uptimeSec)) return undefined;
+    // USER_HZ is 100 on every Linux ABI that matters; sysconf(_SC_CLK_TCK) is not
+    // reachable without a native addon, and jeo is zero-native-dependency by design.
+    const startSecSinceBoot = startTicks / 100;
+    const bootEpochMs = Date.now() - uptimeSec * 1000;
+    return bootEpochMs + startSecSinceBoot * 1000;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Best-effort actual OS process start time in epoch ms. Tries `/proc` first (Linux,
+ *  no subprocess, works in distroless/sandboxed containers), then `ps -o etime=`
+ *  (POSIX-portable across macOS/Linux; unsupported on Windows, where there is no
+ *  equivalent zero-dependency lookup). Returns `undefined` when the lookup is
+ *  unavailable or unparseable — callers MUST treat that as "cannot verify" and fall
+ *  back to the existence-only check, not as "dead". */
 export async function processStartTimeMs(pid: number): Promise<number | undefined> {
   if (process.platform === "win32") return undefined;
+  const viaProc = procStartTimeMs(pid);
+  if (viaProc !== undefined) return viaProc;
   const output = await new Promise<string | undefined>(resolve => {
     let child: ReturnType<typeof nodeSpawn>;
     try {
@@ -67,6 +106,13 @@ export async function processStartTimeMs(pid: number): Promise<number | undefine
   return ms === undefined ? undefined : Date.now() - ms;
 }
 
+/** True when this host can actually verify a process's start time. Exported so
+ *  status output (and tests) can distinguish "the guard says the owner is alive"
+ *  from "the guard could not check" instead of conflating the two. */
+export async function canVerifyProcessStartTime(): Promise<boolean> {
+  return (await processStartTimeMs(process.pid)) !== undefined;
+}
+
 /** `etime` is truncated to whole seconds and adds a little spawn/poll jitter;
  *  genuine PID reuse shows up as a gap of minutes/hours/days, never a few
  *  seconds, so a generous-but-tight tolerance loses no real detections. */
@@ -82,10 +128,23 @@ const START_TIME_TOLERANCE_MS = 10_000;
  *  unavailable (Windows, `ps` missing, permission denied) — never a
  *  regression versus the old behavior in that case. */
 export async function isLockOwnerAlive(lock: DaemonLockInfo): Promise<boolean> {
-  if (!isPidAlive(lock.pid)) return false;
+  return (await inspectLockOwner(lock)).alive;
+}
+
+/** Whether the recorded owner is alive, AND whether that answer was actually
+ *  verified against the OS start time or merely assumed from `kill(pid, 0)`. */
+export interface LockOwnerCheck {
+  alive: boolean;
+  /** False when the host could not report the process start time (no `/proc`,
+   *  no usable `ps`, Windows) — `alive` is then an existence-only guess. */
+  verified: boolean;
+}
+
+export async function inspectLockOwner(lock: DaemonLockInfo): Promise<LockOwnerCheck> {
+  if (!isPidAlive(lock.pid)) return { alive: false, verified: true };
   const real = await processStartTimeMs(lock.pid);
-  if (real === undefined) return true;
-  return Math.abs(real - lock.startedAt) <= START_TIME_TOLERANCE_MS;
+  if (real === undefined) return { alive: true, verified: false };
+  return { alive: Math.abs(real - lock.startedAt) <= START_TIME_TOLERANCE_MS, verified: true };
 }
 
 export async function readDaemonLock(): Promise<DaemonLockInfo | undefined> {
@@ -123,6 +182,10 @@ export interface DaemonStatus {
   stale: boolean;
   pid?: number;
   startedAt?: number;
+  /** False when this host cannot report a process start time (no `/proc`, no usable
+   *  `ps`, Windows), so `running` is an existence-only guess that cannot rule out PID
+   *  reuse. Present only when a lock file exists. */
+  ownerVerified?: boolean;
 }
 
 export async function isNotifyConfigured(): Promise<boolean> {
@@ -133,8 +196,10 @@ export async function isNotifyConfigured(): Promise<boolean> {
 export async function daemonStatus(): Promise<DaemonStatus> {
   const [lock, configured] = await Promise.all([readDaemonLock(), isNotifyConfigured()]);
   if (!lock) return { configured, running: false, stale: false };
-  const alive = await isLockOwnerAlive(lock);
-  return { configured, running: alive, stale: !alive, pid: lock.pid, startedAt: lock.startedAt };
+  const { alive, verified } = await inspectLockOwner(lock);
+  // Surface the degraded case instead of hiding it: on a host with no `/proc` and no
+  // usable `ps`, "running" is an existence-only guess that cannot rule out PID reuse.
+  return { configured, running: alive, stale: !alive, pid: lock.pid, startedAt: lock.startedAt, ownerVerified: verified };
 }
 
 /** Self-invocation argv for the daemon child (mirrors `memory.ts`'s
@@ -200,7 +265,8 @@ export async function startDaemon(spawnImpl: SpawnLike = defaultSpawn): Promise<
 
 export async function stopDaemon(): Promise<{ ok: boolean; message: string }> {
   const lock = await readDaemonLock();
-  if (!lock || !(await isLockOwnerAlive(lock))) {
+  const owner = lock ? await inspectLockOwner(lock) : undefined;
+  if (!lock || !owner?.alive) {
     await fs.unlink(notifyDaemonLockPath()).catch(() => {});
     return { ok: true, message: "daemon was not running" };
   }
@@ -212,7 +278,8 @@ export async function stopDaemon(): Promise<{ ok: boolean; message: string }> {
   const stopped = await waitFor(async () => !isPidAlive(lock.pid), 3_000);
   if (!stopped) return { ok: false, message: `daemon (pid ${lock.pid}) did not exit within 3s` };
   await fs.unlink(notifyDaemonLockPath()).catch(() => {});
-  return { ok: true, message: `daemon stopped (was pid ${lock.pid})` };
+  const caveat = owner.verified ? "" : " (start time unverifiable on this host — PID reuse could not be ruled out)";
+  return { ok: true, message: `daemon stopped (was pid ${lock.pid})${caveat}` };
 }
 
 export async function reloadDaemon(spawnImpl: SpawnLike = defaultSpawn): Promise<{ ok: boolean; message: string }> {

package/src/agent/task-tool.ts

@@ -111,6 +111,27 @@ export interface TaskToolOptions {
  *  no in-batch peer channel yet, so overlapping-scope tasks MUST be sequential. */
 export const MAX_FANOUT = 4;
 
+/** Clamp for {@link resolveFanoutLimit}. Below 1 there is no fan-out at all; above 16
+ *  the parent turn is monopolized no matter how much provider capacity exists. */
+export const MIN_FANOUT_LIMIT = 1;
+export const MAX_FANOUT_LIMIT = 16;
+
+/**
+ * Effective fan-out concurrency for this account.
+ *
+ * {@link MAX_FANOUT} is a reasonable default, not a universal one: four concurrent
+ * Anthropic streams trip a Tier-1 rate limit immediately (turning a fan-out into a
+ * backoff storm that is SLOWER than running sequentially), while an account with real
+ * headroom leaves throughput on the table at four. `config.subagentConcurrency` lets
+ * that be tuned per machine; the clamp keeps a typo (`0`, `-1`, `500`) from producing a
+ * batch that never runs or never yields.
+ */
+export function resolveFanoutLimit(config?: { subagentConcurrency?: number }): number {
+  const raw = config?.subagentConcurrency;
+  if (raw === undefined || !Number.isFinite(raw)) return MAX_FANOUT;
+  return Math.min(MAX_FANOUT_LIMIT, Math.max(MIN_FANOUT_LIMIT, Math.trunc(raw)));
+}
+
 /** Small bounded reroute budget for a SUBAGENT's own 429 (distinct from
  *  launch.ts's `ROUTE_FALLBACK_MAX_ATTEMPTS`, default 3): a subagent is already
  *  bounded by its own step/token budget and the parent turn's patience, so this
@@ -635,9 +656,12 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
           };
         }
       }
-      // Both roles fan out CONCURRENTLY, bounded at MAX_FANOUT (gjc parity — see
-      // MAX_FANOUT's docstring for the disjoint-file-scope expectation this relies on).
-      const limit = Math.min(items.length, MAX_FANOUT);
+      // Both roles fan out CONCURRENTLY, bounded at the account's effective limit
+      // (gjc parity — see MAX_FANOUT's docstring for the disjoint-file-scope expectation
+      // this relies on). `config.subagentConcurrency` tunes it per machine so a
+      // rate-limited account can drop below the default instead of backoff-storming.
+      const fanoutLimit = resolveFanoutLimit(opts.config as { subagentConcurrency?: number });
+      const limit = Math.min(items.length, fanoutLimit);
       // Load project context ONCE per batch instead of re-scanning AGENTS.md for
       // every fan-out task (redundant IO + duplicated tokens).
       const batchContext = await loadProjectContext(cwd);

package/src/ai/model-retirements.ts

@@ -0,0 +1,123 @@
+/**
+ * Retired model ids and where they went.
+ *
+ * A model id that a provider has sunset does not fail *nicely*: the id is simply
+ * unknown at the API, so the call comes back as a 404 / "model not found" from deep
+ * inside the adapter. That is a bad failure for jeo specifically, because model ids get
+ * **pinned in three durable places** — `config.defaultModel`, per-role
+ * `config.subagents.<role>.model`, and `config.roles.*` — and a pinned id keeps failing
+ * every turn until the user works out which of the three is stale. The live catalog
+ * refresh does not help: discovery only reports what still EXISTS, so a retired pin has
+ * nothing to match against and silently stays broken.
+ *
+ * This table maps a retired id to its documented successor so the manager can (a) route
+ * the call to something that works and (b) tell the user exactly which pin to update.
+ * It is deliberately small and hand-curated: only ids jeo itself shipped in its catalog
+ * or aliases, so nobody's config can be silently rewritten to a model they never chose.
+ *
+ * Rules for entries:
+ *  - `replacement` MUST be a currently-catalogued id, and MUST stay on the SAME provider.
+ *    Silently moving a user to a different vendor (different pricing, different data
+ *    handling, different account) is not a substitution jeo gets to make on its own.
+ *  - `note` is shown to the user once per session, so it should name the successor and
+ *    read as an explanation, not a warning banner.
+ */
+
+export interface ModelRetirement {
+  /** The retired id, exactly as it appeared in jeo's catalog/aliases. */
+  readonly retired: string;
+  /** Current catalog id that serves the same role on the SAME provider. */
+  readonly replacement: string;
+  /** One-line reason surfaced to the user. */
+  readonly note: string;
+}
+
+export const MODEL_RETIREMENTS: readonly ModelRetirement[] = [
+  {
+    retired: "antigravity/gemini-3.1-pro-high",
+    replacement: "antigravity/gemini-pro-agent",
+    note: "Antigravity retired gemini-3.1-pro-high; gemini-pro-agent is its code-agent successor.",
+  },
+  {
+    retired: "gemini-3.1-pro-high",
+    replacement: "antigravity/gemini-pro-agent",
+    note: "Antigravity retired gemini-3.1-pro-high; gemini-pro-agent is its code-agent successor.",
+  },
+] as const;
+
+const BY_RETIRED = new Map(MODEL_RETIREMENTS.map(r => [r.retired.toLowerCase(), r]));
+
+/** The retirement record for `model`, or undefined when the id is still current. */
+export function findRetirement(model: string | undefined): ModelRetirement | undefined {
+  const key = model?.trim().toLowerCase();
+  return key ? BY_RETIRED.get(key) : undefined;
+}
+
+/** True when `model` names an id jeo knows has been sunset. */
+export function isRetiredModel(model: string | undefined): boolean {
+  return findRetirement(model) !== undefined;
+}
+
+/**
+ * Map a possibly-retired id onto a working one.
+ *
+ * Returns the input unchanged when it is current, so this is safe to call on every
+ * resolution path. Chains are followed (a successor that was itself later retired)
+ * with a hard bound, so a malformed table can never spin here.
+ */
+export function resolveRetiredModel(model: string): { model: string; retirement?: ModelRetirement } {
+  let current = model;
+  let first: ModelRetirement | undefined;
+  for (let hop = 0; hop < 4; hop++) {
+    const hit = findRetirement(current);
+    if (!hit) break;
+    first ??= hit;
+    if (hit.replacement.toLowerCase() === current.toLowerCase()) break; // self-reference guard
+    current = hit.replacement;
+  }
+  return first ? { model: current, retirement: first } : { model };
+}
+
+/**
+ * Which durable config pins still name a retired model, and what to change them to.
+ * Used by `jeo doctor` and by the launch banner so the user is told *where* the stale
+ * id lives rather than just that some call failed.
+ */
+export interface RetiredPin {
+  /** Human-readable location, e.g. `defaultModel` or `subagents.executor.model`. */
+  location: string;
+  retired: string;
+  replacement: string;
+  note: string;
+}
+
+export function findRetiredPins(config: {
+  defaultModel?: string;
+  roles?: Record<string, string | undefined>;
+  subagents?: Record<string, { model?: string } | undefined>;
+}): RetiredPin[] {
+  const pins: RetiredPin[] = [];
+  const add = (location: string, model: string | undefined) => {
+    const hit = findRetirement(model);
+    if (hit) pins.push({ location, retired: model!, replacement: hit.replacement, note: hit.note });
+  };
+  add("defaultModel", config.defaultModel);
+  for (const [role, model] of Object.entries(config.roles ?? {})) add(`roles.${role}`, model);
+  for (const [role, cfg] of Object.entries(config.subagents ?? {})) add(`subagents.${role}.model`, cfg?.model);
+  return pins;
+}
+
+/** One-time-per-session dedupe so a retired pin explains itself once, not every turn. */
+const announced = new Set<string>();
+
+export function shouldAnnounceRetirement(retired: string): boolean {
+  const key = retired.toLowerCase();
+  if (announced.has(key)) return false;
+  announced.add(key);
+  return true;
+}
+
+/** Test hook — clears the per-session announce dedupe. */
+export function resetRetirementAnnouncements(): void {
+  announced.clear();
+}

package/src/commands/daemon.ts

@@ -12,6 +12,14 @@ async function printStatus(): Promise<void> {
   }
   if (status.running) {
     console.log(`running (pid ${status.pid}, started ${new Date(status.startedAt!).toISOString()})`);
+    // Say so when the PID-reuse guard could not actually run. On a host with no `/proc`
+    // and no usable `ps` (distroless images, seccomp-hardened sandboxes) "running" is an
+    // existence-only guess: the pid is alive, but it may belong to an unrelated process
+    // that inherited it. Silently printing "running" there overstates what jeo checked.
+    if (status.ownerVerified === false) {
+      console.log("  note: this host cannot report process start times, so PID reuse could not be ruled out.");
+      console.log("        'jeo daemon stop' may therefore be signalling a different process than the daemon.");
+    }
   } else if (status.stale) {
     console.log("stale — a lock file exists but its pid is dead (previous daemon crashed without cleanup). 'jeo daemon start' will reclaim it.");
   } else {

package/src/commands/doctor.ts

@@ -1,4 +1,5 @@
 import { readGlobalConfig } from "../agent/state";
+import { findRetiredPins } from "../ai/model-retirements";
 import { resolveCredential, snapshotProvider, type AuthProvider, type Credential } from "../auth";
 import { resolveProvider, describeProvider } from "../ai";
 
@@ -444,6 +445,19 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
     for (const line of oauthLines) console.log(line);
     console.log("");
   }
+  // Retired-model pins: informational only, but the ONE diagnostic a user cannot get
+  // any other way. Alias expansion silently reroutes a sunset id to its successor, so a
+  // stale pin keeps working and the user is never told their config is out of date —
+  // until the alias is eventually dropped and every turn starts 404-ing. Name the exact
+  // config key so the fix is a one-line edit rather than a hunt through three places.
+  const retiredPins = findRetiredPins(config as Parameters<typeof findRetiredPins>[0]);
+  if (retiredPins.length) {
+    for (const pin of retiredPins) {
+      console.log(`${chalk.yellow("[model]")} ${pin.location} pins retired '${pin.retired}' — ${pin.note}`);
+      console.log(`         update it to '${pin.replacement}'.`);
+    }
+    console.log("");
+  }
   // Routing diagnostic: informational only — never affects ready/strict exit logic.
   if (routingEnabled) {
     if (routingNotes.length) {