jeo-code 0.10.0 → 0.11.1

package/src/agent/notify/daemon-control.ts

@@ -42,13 +42,52 @@ export function parseEtimeToMs(raw: string): number | undefined {
   return ((days * 24 + h!) * 60 + m!) * 60 * 1000 + s! * 1000;
 }
 
-/** Best-effort actual OS process start time in epoch ms, via `ps -o etime=`
- *  (POSIX-portable across macOS/Linux `ps`; unsupported on Windows, where
- *  there is no equivalent zero-dependency lookup). Returns `undefined` when
- *  the lookup is unavailable or unparseable — callers MUST treat that as
- *  "cannot verify" and fall back to the existence-only check, not as "dead". */
+/**
+ * Read a process's start time from `/proc` — Linux only, no subprocess.
+ *
+ * Field 22 of `/proc/<pid>/stat` is the process start time in clock ticks since
+ * boot; `/proc/uptime` gives seconds since boot. Together they yield an epoch
+ * timestamp WITHOUT spawning anything. That matters because the `ps` path below is
+ * exactly what disappears in the environments a Telegram daemon actually runs in:
+ * distroless and scratch containers ship no `ps`, and hardened sandboxes/seccomp
+ * profiles routinely block the setuid `/bin/ps`. When the lookup dies there, the
+ * PID-reuse guard silently degrades to a bare `kill(pid, 0)` — see
+ * {@link isLockOwnerAlive} for why that is the dangerous case.
+ *
+ * The 22nd field is parsed from the LAST `)` rather than by splitting on spaces:
+ * field 2 is the executable name in parentheses and may itself contain spaces.
+ */
+function procStartTimeMs(pid: number): number | undefined {
+  if (process.platform !== "linux") return undefined;
+  try {
+    const stat = fsSync.readFileSync(`/proc/${pid}/stat`, "utf-8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 2);
+    const fields = afterComm.split(" ");
+    // stat field 22 (1-based) == index 19 of the post-comm remainder (fields 3+).
+    const startTicks = Number(fields[19]);
+    if (!Number.isFinite(startTicks)) return undefined;
+    const uptimeSec = Number(fsSync.readFileSync("/proc/uptime", "utf-8").split(" ")[0]);
+    if (!Number.isFinite(uptimeSec)) return undefined;
+    // USER_HZ is 100 on every Linux ABI that matters; sysconf(_SC_CLK_TCK) is not
+    // reachable without a native addon, and jeo is zero-native-dependency by design.
+    const startSecSinceBoot = startTicks / 100;
+    const bootEpochMs = Date.now() - uptimeSec * 1000;
+    return bootEpochMs + startSecSinceBoot * 1000;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Best-effort actual OS process start time in epoch ms. Tries `/proc` first (Linux,
+ *  no subprocess, works in distroless/sandboxed containers), then `ps -o etime=`
+ *  (POSIX-portable across macOS/Linux; unsupported on Windows, where there is no
+ *  equivalent zero-dependency lookup). Returns `undefined` when the lookup is
+ *  unavailable or unparseable — callers MUST treat that as "cannot verify" and fall
+ *  back to the existence-only check, not as "dead". */
 export async function processStartTimeMs(pid: number): Promise<number | undefined> {
   if (process.platform === "win32") return undefined;
+  const viaProc = procStartTimeMs(pid);
+  if (viaProc !== undefined) return viaProc;
   const output = await new Promise<string | undefined>(resolve => {
     let child: ReturnType<typeof nodeSpawn>;
     try {
@@ -67,6 +106,13 @@ export async function processStartTimeMs(pid: number): Promise<number | undefine
   return ms === undefined ? undefined : Date.now() - ms;
 }
 
+/** True when this host can actually verify a process's start time. Exported so
+ *  status output (and tests) can distinguish "the guard says the owner is alive"
+ *  from "the guard could not check" instead of conflating the two. */
+export async function canVerifyProcessStartTime(): Promise<boolean> {
+  return (await processStartTimeMs(process.pid)) !== undefined;
+}
+
 /** `etime` is truncated to whole seconds and adds a little spawn/poll jitter;
  *  genuine PID reuse shows up as a gap of minutes/hours/days, never a few
  *  seconds, so a generous-but-tight tolerance loses no real detections. */
@@ -82,10 +128,23 @@ const START_TIME_TOLERANCE_MS = 10_000;
  *  unavailable (Windows, `ps` missing, permission denied) — never a
  *  regression versus the old behavior in that case. */
 export async function isLockOwnerAlive(lock: DaemonLockInfo): Promise<boolean> {
-  if (!isPidAlive(lock.pid)) return false;
+  return (await inspectLockOwner(lock)).alive;
+}
+
+/** Whether the recorded owner is alive, AND whether that answer was actually
+ *  verified against the OS start time or merely assumed from `kill(pid, 0)`. */
+export interface LockOwnerCheck {
+  alive: boolean;
+  /** False when the host could not report the process start time (no `/proc`,
+   *  no usable `ps`, Windows) — `alive` is then an existence-only guess. */
+  verified: boolean;
+}
+
+export async function inspectLockOwner(lock: DaemonLockInfo): Promise<LockOwnerCheck> {
+  if (!isPidAlive(lock.pid)) return { alive: false, verified: true };
   const real = await processStartTimeMs(lock.pid);
-  if (real === undefined) return true;
-  return Math.abs(real - lock.startedAt) <= START_TIME_TOLERANCE_MS;
+  if (real === undefined) return { alive: true, verified: false };
+  return { alive: Math.abs(real - lock.startedAt) <= START_TIME_TOLERANCE_MS, verified: true };
 }
 
 export async function readDaemonLock(): Promise<DaemonLockInfo | undefined> {
@@ -123,6 +182,10 @@ export interface DaemonStatus {
   stale: boolean;
   pid?: number;
   startedAt?: number;
+  /** False when this host cannot report a process start time (no `/proc`, no usable
+   *  `ps`, Windows), so `running` is an existence-only guess that cannot rule out PID
+   *  reuse. Present only when a lock file exists. */
+  ownerVerified?: boolean;
 }
 
 export async function isNotifyConfigured(): Promise<boolean> {
@@ -133,8 +196,10 @@ export async function isNotifyConfigured(): Promise<boolean> {
 export async function daemonStatus(): Promise<DaemonStatus> {
   const [lock, configured] = await Promise.all([readDaemonLock(), isNotifyConfigured()]);
   if (!lock) return { configured, running: false, stale: false };
-  const alive = await isLockOwnerAlive(lock);
-  return { configured, running: alive, stale: !alive, pid: lock.pid, startedAt: lock.startedAt };
+  const { alive, verified } = await inspectLockOwner(lock);
+  // Surface the degraded case instead of hiding it: on a host with no `/proc` and no
+  // usable `ps`, "running" is an existence-only guess that cannot rule out PID reuse.
+  return { configured, running: alive, stale: !alive, pid: lock.pid, startedAt: lock.startedAt, ownerVerified: verified };
 }
 
 /** Self-invocation argv for the daemon child (mirrors `memory.ts`'s
@@ -200,7 +265,8 @@ export async function startDaemon(spawnImpl: SpawnLike = defaultSpawn): Promise<
 
 export async function stopDaemon(): Promise<{ ok: boolean; message: string }> {
   const lock = await readDaemonLock();
-  if (!lock || !(await isLockOwnerAlive(lock))) {
+  const owner = lock ? await inspectLockOwner(lock) : undefined;
+  if (!lock || !owner?.alive) {
     await fs.unlink(notifyDaemonLockPath()).catch(() => {});
     return { ok: true, message: "daemon was not running" };
   }
@@ -212,7 +278,8 @@ export async function stopDaemon(): Promise<{ ok: boolean; message: string }> {
   const stopped = await waitFor(async () => !isPidAlive(lock.pid), 3_000);
   if (!stopped) return { ok: false, message: `daemon (pid ${lock.pid}) did not exit within 3s` };
   await fs.unlink(notifyDaemonLockPath()).catch(() => {});
-  return { ok: true, message: `daemon stopped (was pid ${lock.pid})` };
+  const caveat = owner.verified ? "" : " (start time unverifiable on this host — PID reuse could not be ruled out)";
+  return { ok: true, message: `daemon stopped (was pid ${lock.pid})${caveat}` };
 }
 
 export async function reloadDaemon(spawnImpl: SpawnLike = defaultSpawn): Promise<{ ok: boolean; message: string }> {

package/src/agent/notify/session-endpoint.ts

@@ -229,7 +229,22 @@ export class SessionNotifyEndpoint {
         },
       },
     });
+    // Same reasoning as the poll timer below: a listening socket also keeps the Bun
+    // event loop alive. This server exists to MIRROR a session, never to outlive it,
+    // so it must not be able to decide the process stays up. `stop()` still tears it
+    // down explicitly on the paths that have one — this only removes its veto over exit.
+    (this.server as { unref?: () => void }).unref?.();
     this.pollTimer = setInterval(() => this.broadcastIfChanged(), SNAPSHOT_POLL_MS);
+    // Unref the poll timer so it can NEVER be the reason the process stays alive.
+    // This endpoint mirrors an already-running session; it has no work of its own
+    // worth holding the event loop open for. Left ref'd, any code path that starts
+    // the endpoint but does not reach an explicit `stop()` hangs the process
+    // forever — which is exactly what happened to every non-interactive invocation
+    // (`echo "…" | jeo`, `jeo -p "…"` in CI): the one-shot branch returns long
+    // before the interactive REPL's exit teardown runs. Bun timers do not appear in
+    // `process._getActiveHandles()`, so that hang presented as a process with zero
+    // active handles refusing to exit.
+    (this.pollTimer as { unref?: () => void }).unref?.();
     await fs.mkdir(notifySessionsDir(), { recursive: true, mode: 0o700 });
     const payload = {
       url: `ws://127.0.0.1:${this.server.port}`,

package/src/agent/task-tool.ts

@@ -111,6 +111,27 @@ export interface TaskToolOptions {
  *  no in-batch peer channel yet, so overlapping-scope tasks MUST be sequential. */
 export const MAX_FANOUT = 4;
 
+/** Clamp for {@link resolveFanoutLimit}. Below 1 there is no fan-out at all; above 16
+ *  the parent turn is monopolized no matter how much provider capacity exists. */
+export const MIN_FANOUT_LIMIT = 1;
+export const MAX_FANOUT_LIMIT = 16;
+
+/**
+ * Effective fan-out concurrency for this account.
+ *
+ * {@link MAX_FANOUT} is a reasonable default, not a universal one: four concurrent
+ * Anthropic streams trip a Tier-1 rate limit immediately (turning a fan-out into a
+ * backoff storm that is SLOWER than running sequentially), while an account with real
+ * headroom leaves throughput on the table at four. `config.subagentConcurrency` lets
+ * that be tuned per machine; the clamp keeps a typo (`0`, `-1`, `500`) from producing a
+ * batch that never runs or never yields.
+ */
+export function resolveFanoutLimit(config?: { subagentConcurrency?: number }): number {
+  const raw = config?.subagentConcurrency;
+  if (raw === undefined || !Number.isFinite(raw)) return MAX_FANOUT;
+  return Math.min(MAX_FANOUT_LIMIT, Math.max(MIN_FANOUT_LIMIT, Math.trunc(raw)));
+}
+
 /** Small bounded reroute budget for a SUBAGENT's own 429 (distinct from
  *  launch.ts's `ROUTE_FALLBACK_MAX_ATTEMPTS`, default 3): a subagent is already
  *  bounded by its own step/token budget and the parent turn's patience, so this
@@ -635,9 +656,12 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
           };
         }
       }
-      // Both roles fan out CONCURRENTLY, bounded at MAX_FANOUT (gjc parity — see
-      // MAX_FANOUT's docstring for the disjoint-file-scope expectation this relies on).
-      const limit = Math.min(items.length, MAX_FANOUT);
+      // Both roles fan out CONCURRENTLY, bounded at the account's effective limit
+      // (gjc parity — see MAX_FANOUT's docstring for the disjoint-file-scope expectation
+      // this relies on). `config.subagentConcurrency` tunes it per machine so a
+      // rate-limited account can drop below the default instead of backoff-storming.
+      const fanoutLimit = resolveFanoutLimit(opts.config as { subagentConcurrency?: number });
+      const limit = Math.min(items.length, fanoutLimit);
       // Load project context ONCE per batch instead of re-scanning AGENTS.md for
       // every fan-out task (redundant IO + duplicated tokens).
       const batchContext = await loadProjectContext(cwd);

package/src/ai/model-retirements.ts

@@ -0,0 +1,123 @@
+/**
+ * Retired model ids and where they went.
+ *
+ * A model id that a provider has sunset does not fail *nicely*: the id is simply
+ * unknown at the API, so the call comes back as a 404 / "model not found" from deep
+ * inside the adapter. That is a bad failure for jeo specifically, because model ids get
+ * **pinned in three durable places** — `config.defaultModel`, per-role
+ * `config.subagents.<role>.model`, and `config.roles.*` — and a pinned id keeps failing
+ * every turn until the user works out which of the three is stale. The live catalog
+ * refresh does not help: discovery only reports what still EXISTS, so a retired pin has
+ * nothing to match against and silently stays broken.
+ *
+ * This table maps a retired id to its documented successor so the manager can (a) route
+ * the call to something that works and (b) tell the user exactly which pin to update.
+ * It is deliberately small and hand-curated: only ids jeo itself shipped in its catalog
+ * or aliases, so nobody's config can be silently rewritten to a model they never chose.
+ *
+ * Rules for entries:
+ *  - `replacement` MUST be a currently-catalogued id, and MUST stay on the SAME provider.
+ *    Silently moving a user to a different vendor (different pricing, different data
+ *    handling, different account) is not a substitution jeo gets to make on its own.
+ *  - `note` is shown to the user once per session, so it should name the successor and
+ *    read as an explanation, not a warning banner.
+ */
+
+export interface ModelRetirement {
+  /** The retired id, exactly as it appeared in jeo's catalog/aliases. */
+  readonly retired: string;
+  /** Current catalog id that serves the same role on the SAME provider. */
+  readonly replacement: string;
+  /** One-line reason surfaced to the user. */
+  readonly note: string;
+}
+
+export const MODEL_RETIREMENTS: readonly ModelRetirement[] = [
+  {
+    retired: "antigravity/gemini-3.1-pro-high",
+    replacement: "antigravity/gemini-pro-agent",
+    note: "Antigravity retired gemini-3.1-pro-high; gemini-pro-agent is its code-agent successor.",
+  },
+  {
+    retired: "gemini-3.1-pro-high",
+    replacement: "antigravity/gemini-pro-agent",
+    note: "Antigravity retired gemini-3.1-pro-high; gemini-pro-agent is its code-agent successor.",
+  },
+] as const;
+
+const BY_RETIRED = new Map(MODEL_RETIREMENTS.map(r => [r.retired.toLowerCase(), r]));
+
+/** The retirement record for `model`, or undefined when the id is still current. */
+export function findRetirement(model: string | undefined): ModelRetirement | undefined {
+  const key = model?.trim().toLowerCase();
+  return key ? BY_RETIRED.get(key) : undefined;
+}
+
+/** True when `model` names an id jeo knows has been sunset. */
+export function isRetiredModel(model: string | undefined): boolean {
+  return findRetirement(model) !== undefined;
+}
+
+/**
+ * Map a possibly-retired id onto a working one.
+ *
+ * Returns the input unchanged when it is current, so this is safe to call on every
+ * resolution path. Chains are followed (a successor that was itself later retired)
+ * with a hard bound, so a malformed table can never spin here.
+ */
+export function resolveRetiredModel(model: string): { model: string; retirement?: ModelRetirement } {
+  let current = model;
+  let first: ModelRetirement | undefined;
+  for (let hop = 0; hop < 4; hop++) {
+    const hit = findRetirement(current);
+    if (!hit) break;
+    first ??= hit;
+    if (hit.replacement.toLowerCase() === current.toLowerCase()) break; // self-reference guard
+    current = hit.replacement;
+  }
+  return first ? { model: current, retirement: first } : { model };
+}
+
+/**
+ * Which durable config pins still name a retired model, and what to change them to.
+ * Used by `jeo doctor` and by the launch banner so the user is told *where* the stale
+ * id lives rather than just that some call failed.
+ */
+export interface RetiredPin {
+  /** Human-readable location, e.g. `defaultModel` or `subagents.executor.model`. */
+  location: string;
+  retired: string;
+  replacement: string;
+  note: string;
+}
+
+export function findRetiredPins(config: {
+  defaultModel?: string;
+  roles?: Record<string, string | undefined>;
+  subagents?: Record<string, { model?: string } | undefined>;
+}): RetiredPin[] {
+  const pins: RetiredPin[] = [];
+  const add = (location: string, model: string | undefined) => {
+    const hit = findRetirement(model);
+    if (hit) pins.push({ location, retired: model!, replacement: hit.replacement, note: hit.note });
+  };
+  add("defaultModel", config.defaultModel);
+  for (const [role, model] of Object.entries(config.roles ?? {})) add(`roles.${role}`, model);
+  for (const [role, cfg] of Object.entries(config.subagents ?? {})) add(`subagents.${role}.model`, cfg?.model);
+  return pins;
+}
+
+/** One-time-per-session dedupe so a retired pin explains itself once, not every turn. */
+const announced = new Set<string>();
+
+export function shouldAnnounceRetirement(retired: string): boolean {
+  const key = retired.toLowerCase();
+  if (announced.has(key)) return false;
+  announced.add(key);
+  return true;
+}
+
+/** Test hook — clears the per-session announce dedupe. */
+export function resetRetirementAnnouncements(): void {
+  announced.clear();
+}

package/src/commands/daemon.ts

@@ -12,6 +12,14 @@ async function printStatus(): Promise<void> {
   }
   if (status.running) {
     console.log(`running (pid ${status.pid}, started ${new Date(status.startedAt!).toISOString()})`);
+    // Say so when the PID-reuse guard could not actually run. On a host with no `/proc`
+    // and no usable `ps` (distroless images, seccomp-hardened sandboxes) "running" is an
+    // existence-only guess: the pid is alive, but it may belong to an unrelated process
+    // that inherited it. Silently printing "running" there overstates what jeo checked.
+    if (status.ownerVerified === false) {
+      console.log("  note: this host cannot report process start times, so PID reuse could not be ruled out.");
+      console.log("        'jeo daemon stop' may therefore be signalling a different process than the daemon.");
+    }
   } else if (status.stale) {
     console.log("stale — a lock file exists but its pid is dead (previous daemon crashed without cleanup). 'jeo daemon start' will reclaim it.");
   } else {

package/src/commands/doctor.ts

@@ -1,4 +1,5 @@
 import { readGlobalConfig } from "../agent/state";
+import { findRetiredPins } from "../ai/model-retirements";
 import { resolveCredential, snapshotProvider, type AuthProvider, type Credential } from "../auth";
 import { resolveProvider, describeProvider } from "../ai";
 
@@ -444,6 +445,19 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
     for (const line of oauthLines) console.log(line);
     console.log("");
   }
+  // Retired-model pins: informational only, but the ONE diagnostic a user cannot get
+  // any other way. Alias expansion silently reroutes a sunset id to its successor, so a
+  // stale pin keeps working and the user is never told their config is out of date —
+  // until the alias is eventually dropped and every turn starts 404-ing. Name the exact
+  // config key so the fix is a one-line edit rather than a hunt through three places.
+  const retiredPins = findRetiredPins(config as Parameters<typeof findRetiredPins>[0]);
+  if (retiredPins.length) {
+    for (const pin of retiredPins) {
+      console.log(`${chalk.yellow("[model]")} ${pin.location} pins retired '${pin.retired}' — ${pin.note}`);
+      console.log(`         update it to '${pin.replacement}'.`);
+    }
+    console.log("");
+  }
   // Routing diagnostic: informational only — never affects ready/strict exit logic.
   if (routingEnabled) {
     if (routingNotes.length) {