jeo-code 0.11.0 → 0.11.2

package/CHANGELOG.md

@@ -9,6 +9,32 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.11.2] - 2026-09-30
+_OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries._
+
+### Fixed
+- Use Codex `visibility` for ChatGPT model discovery; retain visible subscription-only models even when `supported_in_api` is false. Keep modern GPT Codex models in API-key discovery and fetch both catalogs when both credentials are configured.
+- Preserve the full OpenAI model list by default, de-duplicate picker rows, and keep empty or failed live results honest instead of fabricating availability from a static snapshot.
+- Replace account-scoped OpenAI model observations on refresh, migrate old caches, and separate authentication sources and custom endpoints. Use stored account identity for opaque OAuth credentials and the proxy's own API key for custom endpoints.
+
+### Validation
+- Regression coverage for visibility, dual credentials, complete lists, account headers, proxy scoping, cache replacement, and authoritative empty catalogs.
+
+## [0.11.1] - 2026-08-25
+_Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited._
+
+### Fixed
+- **A one-shot run never exited when `notifications.enabled` was set** (`src/agent/notify/session-endpoint.ts`, `src/commands/launch.ts`) — `startSessionNotifyEndpoint` binds a `Bun.serve` socket plus a snapshot-poll `setInterval` for the whole launch lifetime, but its teardown lived only on the interactive REPL's exit path. A one-shot run leaves through one of ~17 early `return`s, none of which reach it, so the listening socket and the ref'd timer kept the event loop alive indefinitely. Fixed on both sides: the server and poll timer are now `unref`'d so the endpoint can never be the reason the process stays up, and the entire one-shot block is wrapped in a `try/finally` that stops the endpoint — which also removes the session discovery file, so the Telegram daemon stops dialling a dead socket after a scripted run.
+  - This was invisible for two compounding reasons: it only reproduces on a machine with notifications actually configured, and Bun timers/servers do not appear in `process._getActiveHandles()` — so the hung process reported **zero** active handles while refusing to exit. It was found by monkey-patching `setInterval`/`setTimeout` to record creation sites and dumping the still-ref'd ones after `dispatch()` returned.
+- **The `bashTool` orphan-reaping assertions compared raw command output to the string `"0"`** (`test/tools-fs.test.ts`) — `bashTool` merges stdout and stderr, so any warning `pgrep` wrote to stderr false-failed a run in which zero strays actually existed. The count is now parsed rather than string-matched, and the orphan check is gated on process enumeration actually working (hardened sandboxes answer `pgrep: Cannot get process list`). The abort **contract** itself (`success:false` / `"Command aborted"`) is still asserted unconditionally, so a restricted host keeps covering the behaviour that matters.
+
+### Added
+- `test/notify-endpoint-exit.test.ts` — pins the exit contract deterministically by pointing `JEO_CONFIG_DIR` at a temp config with notifications ON, rather than depending on the developer's real `~/.jeo/config.json`. Covers both halves independently: the `finally` teardown (one-shot exits, no leftover discovery file) and the `unref` guard (any future path that forgets `stop()` still cannot pin the process open).
+
+### Verified
+- `bun run typecheck` clean; `bun test` **3348 pass, 0 fail** — down from 22 failures two releases ago and 6 at 0.11.0. Suite wall time also dropped ~148s → ~88s, since the hung specs no longer burn their full 25s/5s timeouts.
+- The unref guard was verified by reverting it and confirming the new unit test fails, then restoring it.
+
 ## [0.11.0] - 2026-08-25
 _One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside._
 

package/README.ja.md

@@ -319,10 +319,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
+- **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
-- **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -320,10 +320,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
+- **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
-- **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -327,10 +327,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
+- **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
-- **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -317,10 +317,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
+- **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
 - **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
-- **[0.9.17]** (2026-08-18) — Live model discovery already existed (`listProviderModels`/`discoverModels`), but only `jeo auth login openai` ever called it — logging into Anthropic or Antigravity left the account pinned to the maintained static catalog snapshot until the next unrelated live-discovery call happened to run.
-- **[0.9.16]** (2026-08-18) — Routing looked broken while it was actually working: the idle status bar and `/compact`/`/handoff` never reflected which model `routePrompt` actually routed to.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/notify/session-endpoint.ts

@@ -229,7 +229,22 @@ export class SessionNotifyEndpoint {
         },
       },
     });
+    // Same reasoning as the poll timer below: a listening socket also keeps the Bun
+    // event loop alive. This server exists to MIRROR a session, never to outlive it,
+    // so it must not be able to decide the process stays up. `stop()` still tears it
+    // down explicitly on the paths that have one — this only removes its veto over exit.
+    (this.server as { unref?: () => void }).unref?.();
     this.pollTimer = setInterval(() => this.broadcastIfChanged(), SNAPSHOT_POLL_MS);
+    // Unref the poll timer so it can NEVER be the reason the process stays alive.
+    // This endpoint mirrors an already-running session; it has no work of its own
+    // worth holding the event loop open for. Left ref'd, any code path that starts
+    // the endpoint but does not reach an explicit `stop()` hangs the process
+    // forever — which is exactly what happened to every non-interactive invocation
+    // (`echo "…" | jeo`, `jeo -p "…"` in CI): the one-shot branch returns long
+    // before the interactive REPL's exit teardown runs. Bun timers do not appear in
+    // `process._getActiveHandles()`, so that hang presented as a process with zero
+    // active handles refusing to exit.
+    (this.pollTimer as { unref?: () => void }).unref?.();
     await fs.mkdir(notifySessionsDir(), { recursive: true, mode: 0o700 });
     const payload = {
       url: `ws://127.0.0.1:${this.server.port}`,

package/src/ai/model-cache.ts

@@ -11,7 +11,7 @@
  * Persisting the discovered lists (gjc parity) closes both gaps: the next launch
  * rehydrates the account's REAL model set from disk before any network call, and a
  * background refresh keeps it current. The cache is an optimization — a missing,
- * corrupt, or stale file only means "fall back to live discovery + static catalog",
+ * corrupt, or stale file only means live discovery must refresh the catalog,
  * never an error.
  */
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -37,15 +37,16 @@ export interface CachedProviderModels {
 }
 
 export interface ModelCacheFile {
-  version: 2;
+  version: 3;
   updatedAt: number;
   providers: CachedProviderModels[];
 }
 
-const CACHE_VERSION = 2;
+// Earlier snapshots could persist hidden or fabricated OpenAI entries.
+const CACHE_VERSION = 3;
 /** Refresh in the background once the cache is older than this (6h). */
 export const MODEL_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
-/** Bound a single provider's persisted list so a pathological aggregator cannot bloat the file. */
+/** Bound other providers' cache rows; preserve complete authoritative OpenAI lists. */
 const MAX_MODELS_PER_PROVIDER = 500;
 
 function cacheDir(): string {
@@ -62,9 +63,9 @@ export function normalizeCacheEntries(raw: unknown): CachedProviderModels[] {
   for (const entry of raw) {
     const row = entry as Partial<CachedProviderModels>;
     if (!row || typeof row.provider !== "string" || !Array.isArray(row.models)) continue;
-    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, MAX_MODELS_PER_PROVIDER);
-    if (models.length === 0) continue;
     const provider = row.provider as ProviderName;
+    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, provider === "openai" ? undefined : MAX_MODELS_PER_PROVIDER);
+    if (models.length === 0 && (provider !== "openai" || row.models.length !== 0)) continue;
     const source: ModelCacheSource =
       row.source === "oauth" || row.source === "api_key" || row.source === "keyless" || row.source === "none" ? row.source : "none";
     const baseUrl = typeof row.baseUrl === "string" ? row.baseUrl.replace(/\/+$/, "") : undefined;
@@ -111,26 +112,26 @@ export function isModelCacheStale(cache: ModelCacheFile | null, now = Date.now()
  */
 export function mergeCacheEntries(
   previous: readonly CachedProviderModels[],
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string; fallback?: boolean }[],
 ): CachedProviderModels[] {
   const byKey = new Map<string, CachedProviderModels>();
-  const keyOf = (provider: string, baseUrl?: string, accountId?: string) =>
-    `${provider}\u0000${baseUrl ?? ""}\u0000${accountId ?? ""}`;
+  const keyOf = (provider: string, baseUrl?: string, accountId?: string, source?: ModelCacheSource) =>
+    `${provider}\u0000${baseUrl?.replace(/\/+$/, "") ?? ""}\u0000${accountId ?? ""}\u0000${provider === "openai" ? source ?? "none" : ""}`;
   for (const entry of previous) {
     const isOpenAIOAuth = entry.provider === "openai" && entry.source === "oauth";
     if (isOpenAIOAuth && !entry.accountId) continue;
-    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined), entry);
+    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined, entry.source), entry);
   }
   for (const result of results) {
-    if (!result.ok || result.models.length === 0) continue;
+    if (!result.ok || result.fallback || (result.models.length === 0 && result.provider !== "openai")) continue;
     const source: ModelCacheSource = result.source ?? "none";
     const isOpenAIOAuth = result.provider === "openai" && source === "oauth";
     const baseUrl = typeof result.baseUrl === "string" ? result.baseUrl.replace(/\/+$/, "") : undefined;
     const accountId = typeof result.accountId === "string" ? result.accountId.trim() : "";
     if (isOpenAIOAuth && !accountId) continue;
-    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined), {
+    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined, source), {
       provider: result.provider,
-      models: [...result.models].slice(0, MAX_MODELS_PER_PROVIDER),
+      models: [...result.models].slice(0, result.provider === "openai" ? undefined : MAX_MODELS_PER_PROVIDER),
       source,
       ...(baseUrl ? { baseUrl } : {}),
       ...(isOpenAIOAuth ? { accountId } : {}),
@@ -141,11 +142,16 @@ export function mergeCacheEntries(
 
 /** Persist discovery results (best-effort; never throws, never blocks a turn). */
 export async function writeModelCache(
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string; fallback?: boolean }[],
 ): Promise<void> {
   // Same hermeticity rule as saveGlobalConfig: a test run may only write into an
   // explicitly sandboxed JEO_CONFIG_DIR, never the developer's real ~/.jeo.
   if (process.env.NODE_ENV === "test" && !jeoEnv("CONFIG_DIR")) return;
+  // A failed/fallback-only refresh must not make an old snapshot appear fresh.
+  const hasFreshResult = results.some(result => result.ok && !result.fallback
+    && (result.models.length > 0 || result.provider === "openai")
+    && !(result.provider === "openai" && result.source === "oauth" && !result.accountId?.trim()));
+  if (!hasFreshResult) return;
   try {
     const existing = await readModelCache();
     const providers = mergeCacheEntries(existing?.providers ?? [], results);
@@ -173,9 +179,10 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
     recordLiveProviderModels(entry.provider, entry.models, {
       source: entry.source,
       baseUrl: entry.baseUrl,
+      replace: entry.provider === "openai",
       ...(isOpenAIOAuth && entry.accountId ? { accountId: entry.accountId } : {}),
     });
-    if (isOpenAIOAuth && entry.accountId) {
+    if (isOpenAIOAuth && entry.accountId && !entry.baseUrl) {
       recordLiveCodexModels(entry.models, entry.accountId);
     }
     applied += entry.models.length;

package/src/ai/model-catalog.ts

@@ -179,9 +179,8 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
 
 /**
  * OpenAI models the ChatGPT/Codex subscription backend (`codex/responses`) actually
- * serves. The Codex backend rejects standard API ids (gpt-4o, o3, …) and exposes no
- * usable list endpoint, so an OAuth-only OpenAI login surfaces exactly these instead
- * of the full chat-completions catalog. Verified live against a ChatGPT account.
+ * serves in the bundled offline snapshot. A confirmed account-specific model list
+ * replaces this snapshot for OAuth eligibility, including a successful empty list.
  */
 export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
 
@@ -236,7 +235,7 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
   const explicitScope = normalizeOpenAIOauthScope(accountId);
   if (explicitScope) setOpenAIOauthAccountScope(explicitScope);
   const scope = explicitScope || EPHEMERAL_OPENAI_OAUTH_SCOPE;
-  const bucket = liveCodexModels.get(scope) ?? new Set<string>();
+  const bucket = new Set<string>();
   for (const id of ids) {
     const trimmed = id.trim();
     if (trimmed) bucket.add(trimmed);
@@ -244,10 +243,11 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
   liveCodexModels.set(scope, bucket);
 }
 
-/** True for the static Codex snapshot or a live id confirmed for the active scope. */
+/** A confirmed account catalog is authoritative; use the snapshot before discovery. */
 export function isCodexModel(model: string): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  return CODEX_MODELS.includes(wire) || (liveCodexModels.get(activeOpenAIOauthScope)?.has(wire) ?? false);
+  const confirmed = liveCodexModels.get(activeOpenAIOauthScope);
+  return confirmed ? confirmed.has(wire) : CODEX_MODELS.includes(wire);
 }
 
 /** Test-only reset for live Codex observations and the active account scope. */
@@ -330,9 +330,10 @@ function liveModelRecordKey(
   canonical: string,
   baseUrl: string | undefined,
   accountId?: string,
+  source?: LiveProviderModelSource,
 ): string {
   const normalizedAccountId = provider === "openai" ? normalizeOpenAIOauthScope(accountId) : "";
-  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${canonical}`;
+  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${provider === "openai" ? source ?? "none" : ""}\u0000${canonical}`;
 }
 
 function liveModelFallbackRow(provider: ProviderName, canonical: string, providerModel: string): CatalogModel {
@@ -351,12 +352,12 @@ function liveModelFallbackRow(provider: ProviderName, canonical: string, provide
   };
 }
 
-/** Record live ids returned by a provider's own model-list endpoint. Additive only:
- *  transient partial responses must not evict an id observed earlier this session. */
+/** Record live ids. Complete OpenAI refreshes may replace their matching scope;
+ *  partial observations and other providers remain additive. */
 export function recordLiveProviderModels(
   provider: ProviderName,
   ids: readonly string[],
-  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string } = {},
+  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string; replace?: boolean } = {},
 ): void {
   const source = opts.source ?? "none";
   const baseUrl = normalizeBaseUrl(opts.baseUrl);
@@ -366,6 +367,14 @@ export function recordLiveProviderModels(
   if (provider === "openai" && source === "oauth" && scopedAccountId) {
     setOpenAIOauthAccountScope(scopedAccountId);
   }
+  if (provider === "openai" && opts.replace) {
+    for (const [key, record] of liveProviderModels) {
+      if (record.row.provider === provider && record.source === source && record.baseUrl === baseUrl
+        && oauthScope(record.accountId) === oauthScope(scopedAccountId)) {
+        removeLiveProviderRecord(key, record);
+      }
+    }
+  }
   for (const id of ids) {
     const canonical = liveCanonicalId(provider, id);
     if (!canonical) continue;
@@ -374,7 +383,7 @@ export function recordLiveProviderModels(
     const row = known
       ? { ...known, canonical, provider, providerModel }
       : liveModelFallbackRow(provider, canonical, providerModel);
-    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId);
+    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId, source);
     liveProviderModels.set(recordKey, {
       row,
       source,

package/src/ai/model-discovery.ts

@@ -13,7 +13,6 @@ import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
 import {
   catalogByProvider,
-  CODEX_MODELS,
   KIMI_CODE_MODELS,
   recordLiveCodexModels,
   recordLiveProviderModels,
@@ -32,6 +31,8 @@ export interface ProviderModelsResult {
   source: "oauth" | "api_key" | "keyless" | "none";
   /** Stable OpenAI OAuth account scope for account-specific cache rows. */
   accountId?: string;
+  /** Actual custom endpoint queried, for endpoint-scoped persistent caches. */
+  baseUrl?: string;
   /** Present on failure: a short, human-readable reason. */
   error?: string;
   /** True when the live endpoint was unusable and ids came from the static catalog. */
@@ -45,7 +46,7 @@ export interface DiscoveryOptions {
   /** Per-request timeout; default 5000ms. */
   timeoutMs?: number;
   signal?: AbortSignal;
-  /** Cap the number of returned ids per provider; default 100. */
+  /** Cap returned ids; OpenAI defaults to the full list, other providers to 100. */
   limit?: number;
   /** Config snapshot used for provider base URLs. */
   config?: Config;
@@ -54,8 +55,8 @@ export interface DiscoveryOptions {
    * the just-stored OAuth credential even when an unrelated `providers.openai`
    * API key is also configured, so the report reflects the account that was
    * JUST logged in rather than silently swapping to the API key. Does not
-   * change any other discovery caller — the TUI/`discoverModels` default
-   * (API key preferred when configured) is untouched.
+   * change single-provider discovery's API-key preference. `discoverModels`
+   * queries both OpenAI catalogs when both credentials are configured.
    */
   preferOAuth?: boolean;
 }
@@ -107,6 +108,7 @@ export function discoveryRequest(
   provider: ProviderName,
   cred: Credential | undefined,
   baseUrl?: string,
+  oauthAccountId?: string,
 ): { url: string; headers: Record<string, string>; method?: "GET" | "POST"; body?: string } {
   // Catalog-driven compat providers: OpenAI `${base}/models` (Bearer) or Anthropic
   // `${base}/v1/models` (x-api-key). Both return { data: [{ id }] }.
@@ -125,7 +127,7 @@ export function discoveryRequest(
     case "openai": {
       const token = cred?.kind === "oauth" || cred?.kind === "api_key" ? cred.token : "";
       if (cred?.kind === "oauth" && !baseUrl && !process.env.OPENAI_BASE_URL) {
-        const accountId = extractChatgptAccountId(token);
+        const accountId = extractChatgptAccountId(token) || oauthAccountId;
         const headers: Record<string, string> = {
           Authorization: `Bearer ${token}`,
           "OpenAI-Beta": "responses=experimental",
@@ -180,11 +182,12 @@ export function discoveryRequest(
 
 /**
  * OpenAI `/v1/models` lists every model family — embeddings, audio/tts, image, moderation,
- * realtime — but jeo only calls chat/completions. Drop the families that can never serve a
+ * realtime — jeo uses chat/completions and Responses. Drop the families that cannot serve a
  * chat turn so pickers never offer a model that fails at call time.
  */
 function isOpenAiChatModel(id: string): boolean {
-  return !/(^|[-/])(text-embedding|embedding|tts|whisper|dall-e|moderation|omni-moderation|davinci|babbage|computer-use|realtime|audio|image|sora|transcribe|instruct|codex)([-/]|$)/i.test(id);
+  return !/(^|[-/])(text-embedding|embedding|tts|whisper|dall-e|moderation|omni-moderation|davinci|babbage|computer-use|realtime|audio|image|sora|transcribe|instruct)([-/]|$)/i.test(id)
+    && !/^codex([-/]|$)/i.test(id);
 }
 
 /**
@@ -195,11 +198,11 @@ function isGeminiChatModel(id: string): boolean {
   return !/(^|[-/])(embedding|aqa|tts|image|imagen|veo|lyria|nano-banana|deep-research|computer-use|antigravity)([-/]|$)/i.test(id);
 }
 
-type CodexModelRow = { slug?: string; id?: string; supported_in_api?: boolean; priority?: number };
+type CodexModelRow = { slug?: string; id?: string; visibility?: string; supported_in_api?: boolean; priority?: number };
 type AntigravityModelRow = { slug?: string; id?: string; name?: string; isInternal?: boolean; model?: string };
 
 /** Parse a provider's models response body into normalized, chat-capable model ids. */
-export function parseModelsBody(provider: ProviderName, body: unknown): string[] {
+export function parseModelsBody(provider: ProviderName, body: unknown, opts: { openaiCompatible?: boolean } = {}): string[] {
   const data = body as {
     data?: { id?: string }[];
     models?: ({ name?: string; supportedGenerationMethods?: string[] } & CodexModelRow)[];
@@ -285,14 +288,16 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
   }
   if (provider === "openai" && data.models?.some(m => m.slug || m.id)) {
     return data.models
-      .filter(m => m.supported_in_api !== false)
+      // supported_in_api describes API-key availability, not ChatGPT entitlement.
+      // Codex's ChatGPT picker uses visibility, including subscription-only rows.
+      .filter(m => m.visibility === undefined || m.visibility === "list")
       .map(m => m.slug ?? m.id ?? "")
       // Review-only entries (e.g. codex-auto-review) are not chat-turn models.
       .filter(id => id && !/(^|[-/])auto-review([-/]|$)/i.test(id));
   }
   // anthropic / openai: { data: [{ id }] }
   const ids = (data.data ?? []).map(m => m.id ?? "").filter(Boolean);
-  return provider === "openai" ? ids.filter(isOpenAiChatModel) : ids;
+  return provider === "openai" && !opts.openaiCompatible ? ids.filter(isOpenAiChatModel) : ids;
 }
 
 /**
@@ -305,23 +310,23 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
  */
 export function catalogOr(result: ProviderModelsResult): ProviderModelsResult {
   if (result.ok && result.models.length > 0) return result;
+  // OpenAI has live list endpoints for both auth modes. Neither a failed request
+  // nor an authoritative empty list establishes access to the static snapshot.
+  if (result.provider === "openai") return result;
   // Antigravity's available models depend on the Cloud Code Assist agent backend
   // and must never be faked from a hard-coded catalog.
   if (result.provider === "antigravity") return result;
   // No catalog-fallback for oauth-sourced gemini failures: OAuth can LIST but
   // not SERVE gemini models (see listProviderModels' gemini gate).
   if (result.provider === "gemini" && result.source === "oauth") return result;
-  // OAuth: OpenAI/Codex legitimately rejects the standard /models endpoint while
-  // the fixed Codex ids still work; other OAuth providers fall back to their full
-  // static catalog too. API-key providers only fall back when the provider has NO
+  // Other OAuth providers fall back to their static catalog. API-key providers
+  // only fall back when the provider has NO
   // models-list endpoint at all (HTTP 404 / not found) — never for an auth
   // rejection, so a wrong key stays a failure instead of fabricating catalog rows.
   const eligible = result.source === "oauth"
     || (result.source === "api_key" && isMissingModelsEndpoint(result.error));
   if (!eligible) return result;
-  const ids = result.provider === "openai" && result.source === "oauth"
-    ? [...CODEX_MODELS]
-    : result.provider === "kimi" && result.source === "oauth"
+  const ids = result.provider === "kimi" && result.source === "oauth"
       // Kimi OAuth (Kimi Code subscription) serves ONLY the Kimi Code catalog —
       // moonshot API-platform ids would 404 against api.kimi.com/coding.
       ? KIMI_CODE_MODELS.map(id => `kimi/${id}`)
@@ -345,7 +350,8 @@ export async function listProviderModels(
   opts: DiscoveryOptions = {},
 ): Promise<ProviderModelsResult> {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const limit = opts.limit ?? DEFAULT_LIMIT;
+  const limit = opts.limit ?? (provider === "openai" ? Number.POSITIVE_INFINITY : DEFAULT_LIMIT);
+  let baseUrl = opts.baseUrl;
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
@@ -363,6 +369,7 @@ export async function listProviderModels(
     cred = raw;
     source = cred.kind === "oauth" ? "oauth" : cred.kind === "api_key" ? "api_key" : "none";
     const config = opts.config ?? (await readGlobalConfig());
+    if (provider === "openai") baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
 
     if (provider === "antigravity") {
       // Antigravity lists models from the LIVE Cloud Code Assist endpoint
@@ -391,6 +398,12 @@ export async function listProviderModels(
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";
     }
+    if (provider === "openai" && baseUrl && cred.kind === "oauth") {
+      // Subscription credentials belong to ChatGPT, not a configured proxy.
+      const key = config.providers?.openai;
+      cred = key ? { kind: "api_key", provider: "openai", token: key } : { kind: "none", provider: "openai" };
+      source = key ? "api_key" : "keyless";
+    }
     if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
       const stored = await getStoredOAuth("openai").catch(() => undefined);
       const jwtAccountId = extractChatgptAccountId(cred.token);
@@ -406,23 +419,32 @@ export async function listProviderModels(
     if (provider === "gemini" && cred.kind === "oauth") {
       return { provider, models: [], ok: false, source, error: "OAuth cannot serve gemini models — set GEMINI_API_KEY, or use antigravity/* (Cloud Code Assist)" };
     }
-    const isLocalOpenAi = provider === "openai" && !!(opts.baseUrl ?? process.env.OPENAI_BASE_URL);
+    const isLocalOpenAi = provider === "openai" && !!baseUrl;
     if (source === "none" && !isLocalOpenAi) {
       return { provider, models: [], ok: false, source, error: "not logged in" };
     }
   }
 
-  const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, opts.baseUrl);
+  const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId);
+  const scope = { ...(oauthAccountId ? { accountId: oauthAccountId } : {}), ...(baseUrl ? { baseUrl } : {}) };
   const timeout = opts.timeoutMs ?? DEFAULT_TIMEOUT;
   const signal = opts.signal ?? AbortSignal.timeout(timeout);
   try {
     const res = await fetchImpl(url, { method: method ?? "GET", headers, body: requestBody, signal });
     if (!res.ok) {
       const reason = res.status === 401 || res.status === 403 ? "auth rejected" : `HTTP ${res.status}`;
-      return { provider, models: [], ok: false, source, error: reason };
+      return { provider, models: [], ok: false, source, error: reason, ...scope };
     }
     const body = await res.json();
-    let ids = parseModelsBody(provider, body);
+    if (provider === "openai") {
+      const payload = body as { models?: unknown; data?: unknown } | null;
+      const rows = Array.isArray(payload?.models) ? payload.models : payload?.data;
+      if (!Array.isArray(rows) || rows.some(row => !row || typeof row !== "object"
+        || ![row.slug, row.id].some(id => typeof id === "string" && id.trim().length > 0))) {
+        return { provider, models: [], ok: false, source, error: "invalid models response", ...scope };
+      }
+    }
+    let ids = parseModelsBody(provider, body, { openaiCompatible: provider === "openai" && !!baseUrl });
     // Gemini paginates: follow nextPageToken (bounded) so the available list is
     // COMPLETE — page 1 alone silently dropped the newest models (round-15).
     if (provider === "gemini") {
@@ -436,26 +458,28 @@ export async function listProviderModels(
         pageToken = pageBody.nextPageToken;
       }
     }
-    const models = [...new Set(ids)].sort().slice(0, limit);
+    const allModels = [...new Set(ids)].sort();
+    const models = allModels.slice(0, limit);
     // Record live ids for routing supplements. For OpenAI OAuth, keep the
     // existing Codex allow-list widening separate: API-key/custom-base discovery
     // must not make OAuth Codex calls accept unrelated API models.
-    recordLiveProviderModels(provider, models, {
+    recordLiveProviderModels(provider, allModels, {
       source,
-      baseUrl: opts.baseUrl,
+      baseUrl,
+      replace: provider === "openai",
       ...(provider === "openai" && source === "oauth" && oauthAccountId ? { accountId: oauthAccountId } : {}),
     });
-    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models, oauthAccountId);
+    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthAccountId);
     return {
       provider,
       models,
       ok: true,
       source,
-      ...(oauthAccountId ? { accountId: oauthAccountId } : {}),
+      ...scope,
     };
   } catch (err) {
     const msg = (err as Error)?.name === "TimeoutError" || (err as Error)?.name === "AbortError" ? "timeout" : "unreachable";
-    return { provider, models: [], ok: false, source, error: msg };
+    return { provider, models: [], ok: false, source, error: msg, ...scope };
   }
 }
 
@@ -495,13 +519,24 @@ export async function discoverModels(
   const providers = opts.providers ?? [...PROVIDER_NAMES];
   const useFallback = opts.catalogFallback !== false;
   const results = await Promise.all(
-    providers.map(p =>
-      listProviderModels(p, {
+    providers.map(async p => {
+      const discoveryOpts = {
         ...opts,
         config: cfg,
         baseUrl: p === "ollama" ? (cfg.ollamaBaseUrl ?? opts.baseUrl) : p === "lmstudio" ? (cfg.lmstudioBaseUrl ?? opts.baseUrl) : p === "openai" ? (cfg.openaiBaseUrl ?? opts.baseUrl) : opts.baseUrl,
-      }),
-    ),
+      };
+      const primary = await listProviderModels(p, discoveryOpts);
+      // Both credentials can coexist. API discovery alone omits subscription-only
+      // models and never teaches the Codex call gate what this account can serve.
+      if (p === "openai" && primary.source === "api_key" && !discoveryOpts.baseUrl && !process.env.OPENAI_BASE_URL) {
+        const credential = await resolveCredential("openai");
+        if (credential.kind === "oauth") {
+          return [primary, await listProviderModels(p, { ...discoveryOpts, preferOAuth: true })];
+        }
+      }
+      return [primary];
+    }),
   );
-  return useFallback ? results.map(catalogOr) : results;
+  const flat = results.flat();
+  return useFallback ? flat.map(catalogOr) : flat;
 }

package/src/ai/model-picker.ts

@@ -16,9 +16,13 @@ export interface PickEntry {
 /** Flatten successful discovery results into an ordered, 1-based pick list. */
 export function flattenModels(results: ProviderModelsResult[]): PickEntry[] {
   const out: PickEntry[] = [];
+  const seen = new Set<string>();
   for (const r of results) {
     if (!r.ok) continue;
     for (const model of r.models) {
+      const key = `${r.provider}\u0000${model}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
       out.push({ index: out.length + 1, provider: r.provider, model });
     }
   }

package/src/commands/launch.ts

@@ -55,7 +55,7 @@ import { callLlm, type Message } from "../agent/loop";
 import { friendlyProviderError } from "../util/provider-error";
 import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/state";
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
-import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
+import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, liveProviderCatalogModels, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import { rehydrateLiveModels, writeModelCache } from "../ai/model-cache";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
@@ -335,8 +335,8 @@ function providerDefaultModel(p: ProviderName): string {
 }
 
 /**
- * Pick-list entries for ONE provider, with static fallbacks so the list is never
- * empty.
+ * Pick-list entries for ONE provider. OpenAI availability comes only from live
+ * results; other providers retain their offline catalog fallbacks.
  *
  * Live discovery yields ids only for a logged-in, reachable provider, and
  * `catalogOr` backfills the static catalog for OAuth sources and for API-key
@@ -348,6 +348,9 @@ function providerDefaultModel(p: ProviderName): string {
 export function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
   if (fromLive.length) return fromLive;
+  // An OpenAI empty/error response is authoritative for this picker. Offering
+  // the static capability catalog here would fabricate account availability.
+  if (want === "openai") return [];
   const catalog = catalogByProvider(want);
   if (catalog.length) {
     return catalog.map((m, i) => ({ index: i + 1, provider: want, model: qualifyModelId(m.providerModel, want) }));
@@ -1974,239 +1977,250 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   };
 
   if (isOneShot) {
-    let messageContent = joinedArgs;
-    if (!process.stdin.isTTY && joinedArgs.length === 0) {
-      messageContent = (await Bun.stdin.text()).trim();
-    }
-    if (!messageContent) {
-      console.log("No input provided.");
-      return;
-    }
-    // One-shot piped/`-p` input that is a control slash command must be handled
-    // HERE — never forwarded to the model. `echo "/clear" | jeo` (and Ctrl-D after
-    // a piped command) previously sent the literal "/clear" to the LLM as a prompt:
-    // a slow, flaky, and semantically wrong round-trip. These no-arg session/system
-    // commands have a meaningful one-shot effect (or are simple no-ops) and exit.
-    {
-      const cmd = messageContent.trim();
-      if (cmd === "/exit" || cmd === "/quit") {
-        return;
-      }
-      if (cmd === "/clear" || cmd === "/session new" || cmd === "/session drop" || cmd === "/session delete") {
-        // Reset history to just the system prompt and overwrite the session file so
-        // the persisted transcript matches (a fresh session for /session new and /session drop).
-        history.length = 1;
-        if (sessionId && !flags.noSession) {
-          try {
-            sessionId = (await createSession(cwd, undefined, sessionModel)).id;
-          } catch { /* best-effort: in-memory clear already done */ }
-        }
-        console.log("(history cleared)");
-        return;
-      }
-      if (cmd === "/" || cmd === "/?" || cmd === "/help") {
-        for (const line of formatSlashCommandList("/", skillSlashDetails)) console.log(line);
-        console.log("Tools: read / write / edit / bash / find / search. Sessions persist to .jeo/sessions/.");
-        return;
-      }
-      if (cmd === "/usage") {
-        const cfg = await readGlobalConfig();
-        const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
-        const result = handleUsage(ctx, sessionUsage);
-        if (result && "lines" in result) for (const line of result.lines) console.log(line);
-        return;
-      }
-      if (cmd === "/context") {
-        const cfg = await readGlobalConfig();
-        const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
-        const result = await handleContext(ctx);
-        if (result && "lines" in result) for (const line of result.lines) console.log(line);
-        return;
-      }
-      if (cmd === "/tools") {
-        const cfg = await readGlobalConfig();
-        const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
-        const result = await handleTools(ctx);
-        if (result && "lines" in result) for (const line of result.lines) console.log(line);
-        return;
-      }
-      if (cmd === "/hotkeys") {
-        const cfg = await readGlobalConfig();
-        const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
-        const result = handleHotkeys(ctx);
-        if (result && "lines" in result) for (const line of result.lines) console.log(line);
-        return;
+    // A one-shot run has ~17 exit points below. The session notify endpoint (a
+    // listening socket + a discovery file the Telegram daemon polls) is created for
+    // the WHOLE launch lifetime up at `startSessionNotifyEndpoint`, but its teardown
+    // lives on the interactive REPL's exit path — which none of those 17 returns
+    // reach. The endpoint's socket/timer are unref'd so a leak can no longer HANG the
+    // process, but a one-shot run would still leave a stale discovery file behind for
+    // the daemon to keep dialling. One `finally` covers every exit point.
+    try {
+      let messageContent = joinedArgs;
+      if (!process.stdin.isTTY && joinedArgs.length === 0) {
+        messageContent = (await Bun.stdin.text()).trim();
       }
-      if (cmd === "/handoff" || cmd.startsWith("/handoff ")) {
-        const parsed = parseHandoffCommand(cmd) ?? {};
-        const cfg = await readGlobalConfig();
-        const activeModel = sessionModel || defaultModel;
-        // `Config` (state.ts) predates config-schema.ts's `compaction` field and is
-        // out of this change's scope — read the passthrough-preserved value via a
-        // narrow structural cast instead of widening the shared interface.
-        const focus = parsed.focus ?? (cfg as { compaction?: { handoffFocus?: string } }).compaction?.handoffFocus;
-        const res = await buildHandoffDocument(history, { model: activeModel, focus });
-        for (const line of handoffLines(res, process.stdout.columns)) console.log(line);
+      if (!messageContent) {
+        console.log("No input provided.");
         return;
       }
-      if (cmd === "/theme" || cmd.startsWith("/theme ")) {
-        const decision = decideThemeSlash(cmd, listThemes(), resolveTheme().name);
-        for (const line of decision.lines) console.log(line);
-        if (decision.kind === "set") {
-          process.env.JEO_TUI_THEME = decision.themeName!;
-          await saveConfigPatch(raw => ({ theme: decision.themeName }));
-          // No refreshUiTheme() here — one-shot mode returns immediately after this
-          // block, so there is no live TUI paint state to re-resolve (and
-          // refreshUiTheme is declared later in this closure, out of scope here).
+      // One-shot piped/`-p` input that is a control slash command must be handled
+      // HERE — never forwarded to the model. `echo "/clear" | jeo` (and Ctrl-D after
+      // a piped command) previously sent the literal "/clear" to the LLM as a prompt:
+      // a slow, flaky, and semantically wrong round-trip. These no-arg session/system
+      // commands have a meaningful one-shot effect (or are simple no-ops) and exit.
+      {
+        const cmd = messageContent.trim();
+        if (cmd === "/exit" || cmd === "/quit") {
+          return;
         }
-        return;
-      }
-      if (cmd === "/wiki" || cmd.startsWith("/wiki ")) {
-        const decision = decideWikiSlash(
-          cmd,
-          resolveWikiRoot(await readGlobalConfig()),
-          !!jeoEnv("WIKI_ROOT"),
-        );
-        for (const line of decision.lines) console.log(line);
-        if (decision.kind === "clear") {
-          await saveConfigPatch(() => ({ wikiRoot: undefined }));
-          delete process.env.JEO_WIKI_ROOT;
-          sessionWikiRoot = undefined;
-          await refreshSessionMemory("");
-        } else if (decision.kind === "set") {
-          await saveConfigPatch(() => ({ wikiRoot: decision.persistArg }));
-          process.env.JEO_WIKI_ROOT = decision.root;
-          sessionWikiRoot = decision.root;
-          await refreshSessionMemory("");
+        if (cmd === "/clear" || cmd === "/session new" || cmd === "/session drop" || cmd === "/session delete") {
+          // Reset history to just the system prompt and overwrite the session file so
+          // the persisted transcript matches (a fresh session for /session new and /session drop).
+          history.length = 1;
+          if (sessionId && !flags.noSession) {
+            try {
+              sessionId = (await createSession(cwd, undefined, sessionModel)).id;
+            } catch { /* best-effort: in-memory clear already done */ }
+          }
+          console.log("(history cleared)");
+          return;
         }
-        return;
-      }
-      if (cmd === "/config" || cmd === "/settings") {
-        for (const line of await buildConfigPanelLines({ sessionModel, sessionThinking, sessionId })) console.log(line);
-        return;
-      }
-      if (cmd === "/evolve") {
-        await runEvolveSimulation(animateAsciiArt);
-        return;
-      }
-    }
-    // One skill run (bundle workflow → engine; regular skill → agent turn). Shared by the
-    // single-invocation path and the `$a $b …` chain path so every `$` skill actually runs.
-    const runOneSkillShot = async (inv: SkillInvocation): Promise<void> => {
-      const isBundleWorkflow = isWorkflowSkill(inv.skill.name);
-      if (isBundleWorkflow) {
-        const startMsg: Message = {
-          role: "system",
-          content: `[workflow:${inv.skill.name}:start]${inv.intent ? ` intent: ${inv.intent}` : ""}`
-        };
-        history.push(startMsg);
-        if (sessionId) {
-          await appendMessage(sessionId, startMsg, cwd);
+        if (cmd === "/" || cmd === "/?" || cmd === "/help") {
+          for (const line of formatSlashCommandList("/", skillSlashDetails)) console.log(line);
+          console.log("Tools: read / write / edit / bash / find / search. Sessions persist to .jeo/sessions/.");
+          return;
         }
+        if (cmd === "/usage") {
+          const cfg = await readGlobalConfig();
+          const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
+          const result = handleUsage(ctx, sessionUsage);
+          if (result && "lines" in result) for (const line of result.lines) console.log(line);
+          return;
+        }
+        if (cmd === "/context") {
+          const cfg = await readGlobalConfig();
+          const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
+          const result = await handleContext(ctx);
+          if (result && "lines" in result) for (const line of result.lines) console.log(line);
+          return;
+        }
+        if (cmd === "/tools") {
+          const cfg = await readGlobalConfig();
+          const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
+          const result = await handleTools(ctx);
+          if (result && "lines" in result) for (const line of result.lines) console.log(line);
+          return;
+        }
+        if (cmd === "/hotkeys") {
+          const cfg = await readGlobalConfig();
+          const ctx: SlashContext = { history, sessionModel, sessionId, cwd, config: cfg };
+          const result = handleHotkeys(ctx);
+          if (result && "lines" in result) for (const line of result.lines) console.log(line);
+          return;
+        }
+        if (cmd === "/handoff" || cmd.startsWith("/handoff ")) {
+          const parsed = parseHandoffCommand(cmd) ?? {};
+          const cfg = await readGlobalConfig();
+          const activeModel = sessionModel || defaultModel;
+          // `Config` (state.ts) predates config-schema.ts's `compaction` field and is
+          // out of this change's scope — read the passthrough-preserved value via a
+          // narrow structural cast instead of widening the shared interface.
+          const focus = parsed.focus ?? (cfg as { compaction?: { handoffFocus?: string } }).compaction?.handoffFocus;
+          const res = await buildHandoffDocument(history, { model: activeModel, focus });
+          for (const line of handoffLines(res, process.stdout.columns)) console.log(line);
+          return;
+        }
+        if (cmd === "/theme" || cmd.startsWith("/theme ")) {
+          const decision = decideThemeSlash(cmd, listThemes(), resolveTheme().name);
+          for (const line of decision.lines) console.log(line);
+          if (decision.kind === "set") {
+            process.env.JEO_TUI_THEME = decision.themeName!;
+            await saveConfigPatch(raw => ({ theme: decision.themeName }));
+            // No refreshUiTheme() here — one-shot mode returns immediately after this
+            // block, so there is no live TUI paint state to re-resolve (and
+            // refreshUiTheme is declared later in this closure, out of scope here).
+          }
+          return;
+        }
+        if (cmd === "/wiki" || cmd.startsWith("/wiki ")) {
+          const decision = decideWikiSlash(
+            cmd,
+            resolveWikiRoot(await readGlobalConfig()),
+            !!jeoEnv("WIKI_ROOT"),
+          );
+          for (const line of decision.lines) console.log(line);
+          if (decision.kind === "clear") {
+            await saveConfigPatch(() => ({ wikiRoot: undefined }));
+            delete process.env.JEO_WIKI_ROOT;
+            sessionWikiRoot = undefined;
+            await refreshSessionMemory("");
+          } else if (decision.kind === "set") {
+            await saveConfigPatch(() => ({ wikiRoot: decision.persistArg }));
+            process.env.JEO_WIKI_ROOT = decision.root;
+            sessionWikiRoot = decision.root;
+            await refreshSessionMemory("");
+          }
+          return;
+        }
+        if (cmd === "/config" || cmd === "/settings") {
+          for (const line of await buildConfigPanelLines({ sessionModel, sessionThinking, sessionId })) console.log(line);
+          return;
+        }
+        if (cmd === "/evolve") {
+          await runEvolveSimulation(animateAsciiArt);
+          return;
+        }
+      }
+      // One skill run (bundle workflow → engine; regular skill → agent turn). Shared by the
+      // single-invocation path and the `$a $b …` chain path so every `$` skill actually runs.
+      const runOneSkillShot = async (inv: SkillInvocation): Promise<void> => {
+        const isBundleWorkflow = isWorkflowSkill(inv.skill.name);
+        if (isBundleWorkflow) {
+          const startMsg: Message = {
+            role: "system",
+            content: `[workflow:${inv.skill.name}:start]${inv.intent ? ` intent: ${inv.intent}` : ""}`
+          };
+          history.push(startMsg);
+          if (sessionId) {
+            await appendMessage(sessionId, startMsg, cwd);
+          }
 
-        const harness = createInFlightAbortHarness({
-          captureEsc: false,
-          onAbortNotice: msg => console.log(msg),
-          onHardExit: () => forceExitFromCtrlC(),
-        });
-        const ac = harness.controller;
+          const harness = createInFlightAbortHarness({
+            captureEsc: false,
+            onAbortNotice: msg => console.log(msg),
+            onHardExit: () => forceExitFromCtrlC(),
+          });
+          const ac = harness.controller;
 
-        const opts = {
-          cwd,
-          signal: ac.signal,
-          onProgress: (e: { skill: string; phase: string; detail?: string }) => console.log(`[workflow:${e.skill}] ${e.phase}${e.detail ? ` — ${e.detail}` : ""}`),
-          io: {
-            output: (line: string) => {
-              console.log(line);
+          const opts = {
+            cwd,
+            signal: ac.signal,
+            onProgress: (e: { skill: string; phase: string; detail?: string }) => console.log(`[workflow:${e.skill}] ${e.phase}${e.detail ? ` — ${e.detail}` : ""}`),
+            io: {
+              output: (line: string) => {
+                console.log(line);
+              },
+              // This `$a $b …` one-shot chain runs BEFORE the interactive REPL's
+              // `promptInput`/`rl` exist (this whole dispatch is reached and returns
+              // long before the `const promptInput = …` further down the function
+              // executes) — referencing `promptInput` here throws a TDZ
+              // ReferenceError ("Cannot access 'promptInput' before initialization")
+              // the instant the workflow engine asks its first question. That error
+              // is caught and stashed into session history (never printed to the
+              // terminal), so the visible symptom is just a frozen prompt forever
+              // (the "jeo --tmux $deep-interview hangs" / "$deep-interview hangs"
+              // report). Omitting `input` here is safe and correct: no other
+              // readline exists yet at this point, so deep-interview.ts's own
+              // fallback `createInterface({input: process.stdin, ...})` (used
+              // whenever `opts.io?.input` is absent) has nothing to fight over raw
+              // mode with. The INTERACTIVE `runSkillInvocation` sibling path below
+              // runs AFTER `promptInput` is declared and correctly wires it — do not
+              // "fix" this block by copying that wiring here again.
             },
-            // This `$a $b …` one-shot chain runs BEFORE the interactive REPL's
-            // `promptInput`/`rl` exist (this whole dispatch is reached and returns
-            // long before the `const promptInput = …` further down the function
-            // executes) — referencing `promptInput` here throws a TDZ
-            // ReferenceError ("Cannot access 'promptInput' before initialization")
-            // the instant the workflow engine asks its first question. That error
-            // is caught and stashed into session history (never printed to the
-            // terminal), so the visible symptom is just a frozen prompt forever
-            // (the "jeo --tmux $deep-interview hangs" / "$deep-interview hangs"
-            // report). Omitting `input` here is safe and correct: no other
-            // readline exists yet at this point, so deep-interview.ts's own
-            // fallback `createInterface({input: process.stdin, ...})` (used
-            // whenever `opts.io?.input` is absent) has nothing to fight over raw
-            // mode with. The INTERACTIVE `runSkillInvocation` sibling path below
-            // runs AFTER `promptInput` is declared and correctly wires it — do not
-            // "fix" this block by copying that wiring here again.
-          },
 
-          args: inv.skill.name === "deep-interview" ? (inv.intent ? inv.intent.split(/\s+/) : []) : undefined
+            args: inv.skill.name === "deep-interview" ? (inv.intent ? inv.intent.split(/\s+/) : []) : undefined
 
-        };
+          };
 
-        let ok = false;
-        let reason: string | undefined;
-        try {
-          const res: { ok: boolean; reason?: string } = await runWorkflowEngine(inv.skill.name, opts);
-          ok = res.ok;
-          reason = res.reason;
-        } catch (err: any) {
-          ok = false;
-          reason = err.message;
-        } finally {
-          harness.dispose();
-        }
+          let ok = false;
+          let reason: string | undefined;
+          try {
+            const res: { ok: boolean; reason?: string } = await runWorkflowEngine(inv.skill.name, opts);
+            ok = res.ok;
+            reason = res.reason;
+          } catch (err: any) {
+            ok = false;
+            reason = err.message;
+          } finally {
+            harness.dispose();
+          }
 
-        const endMsg: Message = {
-          role: "system",
-          content: ok
-            ? `[workflow:${inv.skill.name}:finish]`
-            : `[workflow:${inv.skill.name}:abort]${reason ? ` reason: ${reason}` : ""}`
-        };
-        if (sessionId) {
-          await appendMessage(sessionId, endMsg, cwd);
+          const endMsg: Message = {
+            role: "system",
+            content: ok
+              ? `[workflow:${inv.skill.name}:finish]`
+              : `[workflow:${inv.skill.name}:abort]${reason ? ` reason: ${reason}` : ""}`
+          };
+          if (sessionId) {
+            await appendMessage(sessionId, endMsg, cwd);
+          }
+          return;
         }
-        return;
-      }
 
-      const useOneShotTui = shouldUseOneShotTui(flags.noTui);
-      if (!useOneShotTui) {
-        console.log(`▶ Running skill: ${inv.skill.name}${inv.intent ? ` — ${inv.intent}` : ""}`);
-      }
-      const task = buildSkillTask(inv.skill, inv.intent, inv.invokedAs);
-      const { reply, rendered, usage } = await runTurn(task, useOneShotTui, undefined, { userCard: null });
-      if (!rendered) console.log(stripMarkdown(renderMarkdownTables(reply)) + usage);
-      else if (usage) console.log(usage.trim());
-    };
+        const useOneShotTui = shouldUseOneShotTui(flags.noTui);
+        if (!useOneShotTui) {
+          console.log(`▶ Running skill: ${inv.skill.name}${inv.intent ? ` — ${inv.intent}` : ""}`);
+        }
+        const task = buildSkillTask(inv.skill, inv.intent, inv.invokedAs);
+        const { reply, rendered, usage } = await runTurn(task, useOneShotTui, undefined, { userCard: null });
+        if (!rendered) console.log(stripMarkdown(renderMarkdownTables(reply)) + usage);
+        else if (usage) console.log(usage.trim());
+      };
 
-    // `$a $b … [intent]` — run every resolved skill in order; a lone `$skill` is a chain of 1.
-    const skillChain = parseSkillChain(messageContent, resolvedSkills);
-    if (skillChain && skillChain.invocations.length) {
-      if (skillChain.unresolved.length) {
-        console.log(`(skipping unknown skill${skillChain.unresolved.length > 1 ? "s" : ""}: ${skillChain.unresolved.map(u => `$${u}`).join(", ")})`);
+      // `$a $b … [intent]` — run every resolved skill in order; a lone `$skill` is a chain of 1.
+      const skillChain = parseSkillChain(messageContent, resolvedSkills);
+      if (skillChain && skillChain.invocations.length) {
+        if (skillChain.unresolved.length) {
+          console.log(`(skipping unknown skill${skillChain.unresolved.length > 1 ? "s" : ""}: ${skillChain.unresolved.map(u => `$${u}`).join(", ")})`);
+        }
+        if (skillChain.invocations.length > 1) {
+          console.log(`▶ Chaining ${skillChain.invocations.length} skills: ${skillChain.invocations.map(i => `$${i.skill.name}`).join(" → ")}`);
+        }
+        for (const inv of skillChain.invocations) {
+          await runOneSkillShot(inv);
+        }
+        await maybeDistillOneShot();
+        return;
       }
-      if (skillChain.invocations.length > 1) {
-        console.log(`▶ Chaining ${skillChain.invocations.length} skills: ${skillChain.invocations.map(i => `$${i.skill.name}`).join(" → ")}`);
+      // A `$skill` invocation resolves to a single skill (by name, declared alias, or unique prefix).
+      const skillInvocation = parseSkillInvocation(messageContent, resolvedSkills);
+      if (skillInvocation) {
+        await runOneSkillShot(skillInvocation);
+        await maybeDistillOneShot();
+        return;
       }
-      for (const inv of skillChain.invocations) {
-        await runOneSkillShot(inv);
+      try {
+        const { reply, rendered, usage } = await runTurn(messageContent, shouldUseOneShotTui(flags.noTui));
+        if (!rendered) console.log(stripMarkdown(renderMarkdownTables(reply)) + usage);
+        else if (usage) console.log(usage.trim());
+      } catch (err) {
+        console.log(`! ${friendlyProviderError(err)}`);
       }
       await maybeDistillOneShot();
       return;
+    } finally {
+      await sessionNotifyEndpoint?.stop().catch(() => {});
     }
-    // A `$skill` invocation resolves to a single skill (by name, declared alias, or unique prefix).
-    const skillInvocation = parseSkillInvocation(messageContent, resolvedSkills);
-    if (skillInvocation) {
-      await runOneSkillShot(skillInvocation);
-      await maybeDistillOneShot();
-      return;
-    }
-    try {
-      const { reply, rendered, usage } = await runTurn(messageContent, shouldUseOneShotTui(flags.noTui));
-      if (!rendered) console.log(stripMarkdown(renderMarkdownTables(reply)) + usage);
-      else if (usage) console.log(usage.trim());
-    } catch (err) {
-      console.log(`! ${friendlyProviderError(err)}`);
-    }
-    await maybeDistillOneShot();
-    return;
   }
 
   // INTERACTIVE mode
@@ -2416,7 +2430,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // the OAuth Codex gate from the first keystroke, instead of only after the network
   // discovery below happens to land.
   const aliasNames = Object.keys(await listAliases());
-  const cachedModels = await rehydrateLiveModels().catch(() => null);
+  await rehydrateLiveModels().catch(() => null);
+  const completionConfig = await readGlobalConfig();
+  const cachedCompletionModels = liveProviderCatalogModels({ openaiBaseUrl: completionConfig.openaiBaseUrl ?? process.env.OPENAI_BASE_URL });
   void getLiveModels()
     .then(r => {
       liveModelsCache ??= r;
@@ -2431,14 +2447,16 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // access to were un-completable for the first seconds of every session.
     const liveFromDiscovery = liveModelsCache ? flattenModels(liveModelsCache).map(e => e.model) : null;
     const cachedFor = (p: string): string[] =>
-      cachedModels?.providers.filter(entry => entry.provider === p).flatMap(entry => entry.models) ?? [];
+      cachedCompletionModels.filter(entry => entry.provider === p).map(entry => entry.canonical);
     return {
       ...base,
       slashCommands: [...base.slashCommands, ...skillSlashDetails.map(d => d.command)],
-      liveModels: liveFromDiscovery ?? (cachedModels?.providers.flatMap(entry => entry.models) ?? []),
+      liveModels: liveFromDiscovery ?? cachedCompletionModels.map(entry => entry.canonical),
       aliases: aliasNames,
       skillNames: resolvedSkillTokens,
-      modelsForProvider: p => liveModelsCache?.find(r => r.provider === p)?.models ?? cachedFor(p),
+      modelsForProvider: p => liveModelsCache
+        ? flattenModels(liveModelsCache.filter(r => r.provider === p)).map(entry => entry.model)
+        : cachedFor(p),
       mentionPaths,
     };
   };