jeo-code 0.11.6 → 0.12.1

package/CHANGELOG.md

@@ -9,6 +9,45 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.1] - 2026-10-16
+_Logged-in OpenAI subscription models were invisible on proxy-configured machines._
+
+### Fixed
+- **OpenAI OAuth catalog discarded when a custom base URL is set** (`src/ai/model-discovery.ts`) — with `OPENAI_BASE_URL`/config `openaiBaseUrl` configured, discovery dropped the stored OAuth credential, probed the proxy keyless (`auth rejected`), and the Codex second pass never fired (it only covered `api_key` primaries). OpenAI has no static fallback by design, so the picker showed zero models despite a valid login. New `codexCatalog` option queries the ChatGPT subscription catalog ignoring any custom base URL; `discoverModels` now appends it whenever the primary pass did not already return the OAuth catalog. The post-login report (`jeo auth login openai`) uses it too.
+
+### Verified
+- Live on a proxy-configured machine: `openai` rows went from 1 failed keyless row to keyless-fail + 7-model OAuth catalog; `providerPickEntries` returns 7 rows. `bun run typecheck` clean; discovery suites green including 2 new regression tests.
+
+## [0.12.1] - 2026-10-16
+_Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend._
+
+### Added
+- **Opt-in official agy discovery and execution** — `agy/<official-cli-slug>` selects the installed, externally authenticated official CLI as a full agent, not a raw-model adapter or CCA alias. `/model provider agy` reads the live `agy models` list, preserves exact slugs, and reports empty lists and failures without static fallback. CLI catalogs stay process-local; no identity or credential parity with jeo OAuth is assumed.
+- **Session-owned resume and process lifecycle** — saved jeo sessions retain their own CLI conversation ID rather than resuming the CLI's unrelated latest conversation. Turns support cancellation and bounded timeouts. The requested model and upstream quota/auth/permission errors remain visible, with no fallback to CCA, another model, or another account.
+- **Explicit execution boundary** — the CLI owns its tools, sandbox, permissions, and conversation; jeo approvals do not mediate its inner tool calls. The bridge is text-only, excluded from automatic raw-model/subagent routing, and rejects images and jeo-only tool/system/step/thinking controls it cannot enforce.
+
+### Changed
+- **CCA account model discovery** — combine `agentModelSorts`, `tieredModelIds`, and `defaultAgentModelId` instead of treating one metadata list as the whole chat catalog. Existing `antigravity/<CCA-id>` discovery remains scoped to the selected jeo OAuth account, without claiming direct CCA Argon support.
+
+### Fixed
+- **Malformed normalized CCA IDs** — reject invalid discovery responses instead of replacing an account's known-good cache with malformed IDs. Authoritative empty lists remain empty, failed discovery remains a failure, and existing account-cache isolation is preserved.
+
+### Verification and release status
+- A real, isolated source-jeo invocation of `jeo launch --model agy/gemini-4-argon-low --plan --no-tui --no-session --no-skills "Explain this repository"` exited **0**, reporting **30.5k input / 11 output tokens**. This verifies that CLI bridge invocation, not direct CCA Argon access or availability for every account.
+- Three independent code, TypeScript, and security reviewers identified six failure-path issues; test-first fixes and regression coverage are in progress. Final release gates and public publication are not yet claimed.
+
+## [0.12.0] - 2026-10-16
+_Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router._
+
+### Added
+- **Bundled `karpathy-guidelines` skill** (`src/prompts/skills/karpathy-guidelines/SKILL.md`, registered in `src/skills/catalog.ts`) — the four `multica-ai/andrej-karpathy-skills` principles (think before coding, simplicity first, surgical changes, goal-driven execution), operationalized for jeo: ambiguity handling points at `deep-interview`, goal-driven verification points at the done-verification gate. Guidance-only, no executor or MCP tool.
+- **Always-on `KARPATHY_DISCIPLINE` prompt block** (`src/agent/engine.ts`, `src/commands/launch.ts`) — appended to `executorSystemPrompt()` and the interactive system prompt alongside `WORKING_DISCIPLINE`. Existing discipline constants are byte-stable; the Karpathy block is additive. The JEO workflow-routing brief now states the guidelines apply to every coding turn without an explicit skill invocation.
+- **ECC + Jev-style skill router** (`src/agent/skill-router.ts`, `docs/ecc-jev-routing.md`) — heuristic advisory `routeSkillsForTask()` (Jev `route-skills` parity: gate 0.30 / fit 0.30, `sharded` vs `shortlist` strategy, top-k 3, stopword-filtered overlap with a decisive explicit-name bonus, fail-open explicit-none) plus `inventorySkillConflicts()` (ECC single-harness rule: one skill identity, one source — duplicate normalized names from distinct paths are reported, never silently mixed). The router only suggests; `$skill` remains the sole execution entrypoint and the model is never switched.
+- **ECC/Jev operation-flow doc** (`docs/ecc-jev-routing.md`) — source analysis of `andrej-karpathy-skills`, ECC, and the Jev control plane, with the jeo-code mapping table and the per-turn flow.
+
+### Verified
+- `bun run typecheck` clean; new `test/karpathy-skill-router.test.ts` (8 tests: skill registration, four-principle prompt wiring, explicit-name routing, gate/fit explicit-none, sharded/shortlist strategy, inventory conflicts) green alongside the skill/prompt/engine suites (228 pass across 17 files).
+
 ## [0.11.6] - 2026-10-16
 _Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability._
 

package/README.ja.md

@@ -395,10 +395,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
+- **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
-- **[0.11.3]** (2026-10-01) — Remote control grew from one Telegram bot into one shared daemon serving Telegram, Discord, and Slack — and the workflow gates that were meant to block unverified work (`approve`/`team` plan identity, `done` re-checks, the autopilot ratchet) now actually block it.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -397,10 +397,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
+- **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
-- **[0.11.3]** (2026-10-01) — Remote control grew from one Telegram bot into one shared daemon serving Telegram, Discord, and Slack — and the workflow gates that were meant to block unverified work (`approve`/`team` plan identity, `done` re-checks, the autopilot ratchet) now actually block it.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -389,10 +389,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
+- **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
-- **[0.11.3]** (2026-10-01) — Remote control grew from one Telegram bot into one shared daemon serving Telegram, Discord, and Slack — and the workflow gates that were meant to block unverified work (`approve`/`team` plan identity, `done` re-checks, the autopilot ratchet) now actually block it.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -393,10 +393,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
+- **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
-- **[0.11.3]** (2026-10-01) — Remote control grew from one Telegram bot into one shared daemon serving Telegram, Discord, and Slack — and the workflow gates that were meant to block unverified work (`approve`/`team` plan identity, `done` re-checks, the autopilot ratchet) now actually block it.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.11.6",
+  "version": "0.12.1",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/engine.ts

@@ -227,6 +227,20 @@ export const VERIFICATION_DIRECTIVE =
   "Distinguish a passing test from a met requirement: never weaken, skip, or narrow a test to make it pass. " +
   "When you write tests, exercise observable behavior, edge values, branch conditions, invariants, and error handling — never assert defaults or tautologies.";
 
+/** Karpathy behavioral guardrails (multica-ai/andrej-karpathy-skills, MIT):
+ *  think-before-coding, simplicity-first, surgical-changes, goal-driven
+ *  execution — operationalized for jeo's tool loop. Kept SEPARATE from
+ *  WORKING_DISCIPLINE so existing prompt contracts stay byte-stable; callers
+ *  opt in by appending this block. Mirrors the bundled `karpathy-guidelines`
+ *  skill's SKILL.md in compact system-prompt form. */
+export const KARPATHY_DISCIPLINE = [
+  "Karpathy discipline (caution over speed on non-trivial work; use judgment on trivial one-liners):",
+  "- Think before coding: state assumptions explicitly; when multiple interpretations exist, present them instead of picking silently; push back when a simpler approach exists; stop and ask when confused.",
+  "- Simplicity first: minimum code that solves the problem — no unasked features, no single-use abstractions, no speculative flexibility, no impossible-scenario error handling. If 200 lines could be 50, rewrite it.",
+  "- Surgical changes: touch only what the request requires; match existing style; mention unrelated dead code instead of deleting it; remove only the orphans YOUR changes created. Every changed line must trace to the request.",
+  "- Goal-driven execution: turn tasks into verifiable goals (repro test before fix, tests-before/after for refactors, per-step verify checks) and loop until the verification signal passes — a stale pass from before the last edit does not count.",
+].join("\n");
+
 
 export function executorSystemPrompt(
   role = "Executor Agent, a senior software developer",
@@ -238,6 +252,7 @@ export function executorSystemPrompt(
     `Accomplish the user's request by calling tools and verifying your work.\n\n` +
     `${protocol}\n\n` +
     `${WORKING_DISCIPLINE}\n\n` +
+    `${KARPATHY_DISCIPLINE}\n\n` +
     `${OUTPUT_DISCIPLINE}\n\n` +
     verificationDirective
   );

package/src/agent/skill-router.ts

@@ -0,0 +1,163 @@
+/**
+ * ECC single-harness + Jev-style skill routing for jeo-code.
+ *
+ * Two concerns live here on purpose, mirroring the external operating layer:
+ *
+ * 1. ECC inventory (fail-closed on duplicates): exactly ONE harness path per
+ *    skill identity. A later skill dir's same-named skill OVERRIDES (that is the
+ *    documented `loadSkills` precedence), but two DIFFERENT source paths
+ *    claiming the same normalized name inside ONE resolution pass is a duplicate
+ *    installation — report it instead of silently shadowing.
+ *
+ * 2. Jev `route-skills` heuristic (advisory, always fail-open): scores a task
+ *    against the loaded skill catalog with zero I/O and returns a top-k
+ *    selection plus an advisory routing note. Gate and fit thresholds are both
+ *    `0.30`, matching the Jev control plane. This never installs skills, never
+ *    changes the model, and never throws — an empty/ambiguous task yields an
+ *    explicit none with a reason, not a guess.
+ */
+
+import type { SkillDoc } from "../skills/catalog";
+
+/** Gate below which no skill is selected (explicit none, reason "gate"). */
+export const SKILL_ROUTE_GATE = 0.3;
+/** Fit below which a top candidate is still rejected (explicit none, reason "fits"). */
+export const SKILL_ROUTE_FIT = 0.3;
+/** Max skills compared in one scoring shard (Jev `choiceCap` analogue). */
+export const SKILL_ROUTE_CHOICE_CAP = 6;
+/** Max skills returned. */
+export const SKILL_ROUTE_TOP_K = 3;
+
+export interface SkillRouteCandidate {
+  name: string;
+  score: number;
+  reasons: string[];
+}
+
+export interface SkillRouteSelection {
+  topK: SkillRouteCandidate[];
+  /** "gate" = nothing cleared the gate; "fits" = cleared gate but failed fit; "ok" = advisory selection. */
+  reason: "gate" | "fits" | "ok";
+  /** "sharded" when ceil(catalogSize / choiceCap) <= 4, otherwise "shortlist". */
+  strategy: "sharded" | "shortlist";
+  /** Advisory only — never an install or model instruction. */
+  routing: string;
+}
+
+const TOKEN_RE = /[a-z0-9][a-z0-9._-]*/gi;
+
+/** Closed-class / low-signal words excluded from routing overlap — without
+ *  this, chit-chat ("how are you") spuriously matches every long skill doc. */
+const STOPWORDS = new Set([
+  "the", "are", "you", "your", "and", "for", "with", "that", "this", "have",
+  "has", "had", "what", "when", "where", "which", "how", "why", "who", "whom",
+  "there", "here", "today", "hello", "please", "just", "like", "from", "into",
+  "over", "under", "about", "after", "before", "then", "than", "also", "only",
+  "very", "much", "more", "most", "some", "such", "will", "would", "could",
+  "should", "does", "did", "not", "but", "all",
+]);
+
+function tokens(text: string): Set<string> {
+  const out = new Set<string>();
+  for (const m of text.toLowerCase().matchAll(TOKEN_RE)) {
+    const t = m[0];
+    if (t.length >= 3 && !STOPWORDS.has(t)) out.add(t);
+  }
+  return out;
+}
+
+function skillText(s: SkillDoc): string {
+  return `${s.name} ${s.summary} ${s.whenToUse} ${s.details}`.toLowerCase();
+}
+
+/**
+ * Score one skill against the task: keyword overlap over the skill's own
+ * name/summary/when/details vocabulary. Name-token hits weigh more (explicit
+ * user intent, e.g. "ralplan" in the task). Pure, deterministic.
+ */
+export function scoreSkillForTask(task: string, skill: SkillDoc): { score: number; reasons: string[] } {
+  const taskTokens = tokens(task);
+  if (taskTokens.size === 0) return { score: 0, reasons: [] };
+  const text = skillText(skill);
+  const textTokens = tokens(text);
+  let overlap = 0;
+  const reasons: string[] = [];
+  for (const t of taskTokens) {
+    if (textTokens.has(t)) {
+      overlap++;
+      if (reasons.length < 5) reasons.push(t);
+    }
+  }
+  const nameTokens = tokens(skill.name.replace(/[:/]/g, " "));
+  let nameHits = 0;
+  for (const t of taskTokens) if (nameTokens.has(t)) nameHits++;
+  // Overlap ratio over task vocabulary + a decisive name bonus: an explicit
+  // skill-name mention in the task (e.g. "ralplan") must dominate generic
+  // vocabulary overlap from longer skill docs.
+  const score = overlap / taskTokens.size + Math.min(nameHits * 1.0, 1.5);
+  return { score, reasons };
+}
+
+/**
+ * Jev-style `route-skills`: heuristic top-k skill selection for one task.
+ * Never throws; empty input yields explicit none with reason "gate".
+ */
+export function routeSkillsForTask(task: string, skills: SkillDoc[], topK = SKILL_ROUTE_TOP_K): SkillRouteSelection {
+  const strategy: SkillRouteSelection["strategy"] =
+    Math.ceil(skills.length / SKILL_ROUTE_CHOICE_CAP) <= 4 ? "sharded" : "shortlist";
+  const trimmed = task.trim();
+  if (!trimmed) {
+    return { topK: [], reason: "gate", strategy, routing: "No task text — no skill suggested. Answer directly." };
+  }
+  const scored = skills.map(s => {
+    const { score, reasons } = scoreSkillForTask(trimmed, s);
+    return { name: s.name, score, reasons };
+  });
+  scored.sort((a, b) => b.score - a.score || (a.name < b.name ? -1 : 1));
+  const gated = scored.filter(c => c.score >= SKILL_ROUTE_GATE).slice(0, topK);
+  if (gated.length === 0) {
+    return { topK: [], reason: "gate", strategy, routing: "No skill cleared the gate — answer directly without a workflow skill." };
+  }
+  if (gated[0]!.score < SKILL_ROUTE_FIT) {
+    return { topK: [], reason: "fits", strategy, routing: "Top candidate failed the fit threshold — answer directly." };
+  }
+  const names = gated.map(c => `$${c.name}`).join(", ");
+  return {
+    topK: gated,
+    reason: "ok",
+    strategy,
+    routing: `Advisory only: the task resembles ${names}. Only follow a skill when the user invoked it via $skill or the task truly fits that bundled workflow; never recite skill docs.`,
+  };
+}
+
+/** One duplicate-identity report from an ECC inventory scan. */
+export interface SkillInventoryConflict {
+  normalized: string;
+  paths: string[];
+}
+
+/**
+ * ECC inventory scan: group resolved skills by normalized name and report
+ * identities claimed by more than one DISTINCT source path. Bundled skills
+ * (no `sourcePath`) share one canonical path so they never conflict with
+ * each other. Pure — no filesystem access.
+ */
+export function inventorySkillConflicts(skills: SkillDoc[]): SkillInventoryConflict[] {
+  const byName = new Map<string, Set<string>>();
+  for (const s of skills) {
+    const normalized = s.name.toLowerCase();
+    const p = s.sourcePath ?? `(bundled) src/prompts/skills/${s.name}/SKILL.md`;
+    let set = byName.get(normalized);
+    if (!set) {
+      set = new Set();
+      byName.set(normalized, set);
+    }
+    set.add(p);
+  }
+  const out: SkillInventoryConflict[] = [];
+  for (const [normalized, paths] of byName) {
+    if (paths.size > 1) out.push({ normalized, paths: [...paths].sort() });
+  }
+  out.sort((a, b) => (a.normalized < b.normalized ? -1 : 1));
+  return out;
+}

package/src/ai/model-discovery.ts

@@ -63,6 +63,17 @@ export interface DiscoveryOptions {
    * queries both OpenAI catalogs when both credentials are configured.
    */
   preferOAuth?: boolean;
+  /**
+   * Query the ChatGPT Codex OAuth catalog even when a custom OpenAI base URL
+   * (config `openaiBaseUrl` or `OPENAI_BASE_URL`) is configured. A stored
+   * subscription is an independent catalog that lives at ChatGPT, never at
+   * the proxy — without this, a proxy-configured machine silently drops the
+   * OAuth credential, probes the proxy keyless, and surfaces zero models
+   * despite a valid login. Implies `preferOAuth` for OpenAI. Used by
+   * `discoverModels`' second pass and the post-login report; has no effect
+   * on other providers.
+   */
+  codexCatalog?: boolean;
 }
 
 const DEFAULT_TIMEOUT = 5000;
@@ -106,6 +117,7 @@ export function discoveryRequest(
   cred: Credential | undefined,
   baseUrl?: string,
   oauthAccountId?: string,
+  opts?: { forceCodexCatalog?: boolean },
 ): { url: string; headers: Record<string, string>; method?: "GET" | "POST"; body?: string } {
   // Catalog-driven compat providers: OpenAI `${base}/models` (Bearer) or Anthropic
   // `${base}/v1/models` (x-api-key). Both return { data: [{ id }] }.
@@ -123,7 +135,7 @@ export function discoveryRequest(
       return { url: "https://api.anthropic.com/v1/models", headers: anthropicHeaders(cred!) };
     case "openai": {
       const token = cred?.kind === "oauth" || cred?.kind === "api_key" ? cred.token : "";
-      if (cred?.kind === "oauth" && !baseUrl && !process.env.OPENAI_BASE_URL) {
+      if (cred?.kind === "oauth" && (opts?.forceCodexCatalog || (!baseUrl && !process.env.OPENAI_BASE_URL))) {
         const accountId = extractChatgptAccountId(token) || oauthAccountId;
         const headers: Record<string, string> = {
           Authorization: `Bearer ${token}`,
@@ -348,6 +360,11 @@ export async function listProviderModels(
   const fetchImpl = opts.fetchImpl ?? fetch;
   const limit = opts.limit ?? (provider === "openai" || provider === "antigravity" ? Number.POSITIVE_INFINITY : DEFAULT_LIMIT);
   let baseUrl = opts.baseUrl;
+  // An explicit Codex-catalog request (discoverModels' second pass, the
+  // post-login report) ignores every custom base URL: the subscription
+  // catalog lives at ChatGPT, never at the proxy. Function-scoped (not
+  // block-scoped) so the request builder below can see it.
+  const forceCodexCatalog = provider === "openai" && !!opts.codexCatalog;
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
@@ -365,7 +382,7 @@ export async function listProviderModels(
     cred = raw;
     source = cred.kind === "oauth" ? "oauth" : cred.kind === "api_key" ? "api_key" : "none";
     const config = opts.config ?? (await readGlobalConfig());
-    if (provider === "openai") baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
+    if (provider === "openai" && !forceCodexCatalog) baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
 
     if (provider === "antigravity") {
       // Antigravity lists models from the LIVE Cloud Code Assist endpoint
@@ -390,12 +407,13 @@ export async function listProviderModels(
     // no api-key header), so never swap its credential to an api_key.
     // `preferOAuth` (post-login report only) skips this swap so the report
     // reflects the freshly stored OAuth credential, not an unrelated key.
-    if (provider !== "antigravity" && cred.kind === "oauth" && config.providers?.[prov] && !opts.preferOAuth) {
+    // `codexCatalog` implies the same (plus base-URL immunity above).
+    if (provider !== "antigravity" && cred.kind === "oauth" && config.providers?.[prov] && !opts.preferOAuth && !forceCodexCatalog) {
       // An API key is the broader, documented path — prefer it for live discovery.
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";
     }
-    if (provider === "openai" && baseUrl && cred.kind === "oauth") {
+    if (provider === "openai" && baseUrl && cred.kind === "oauth" && !forceCodexCatalog) {
       // Subscription credentials belong to ChatGPT, not a configured proxy.
       const key = config.providers?.openai;
       cred = key ? { kind: "api_key", provider: "openai", token: key } : { kind: "none", provider: "openai" };
@@ -456,7 +474,7 @@ export async function listProviderModels(
       }
       setAntigravityAccountScope(scope.accountId);
     }
-    const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId);
+    const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId, forceCodexCatalog ? { forceCodexCatalog: true } : undefined);
     const res = await fetchImpl(url, { method: method ?? "GET", headers, body: requestBody, signal });
     if (!res.ok) {
       const reason = res.status === 401 || res.status === 403 ? "auth rejected" : `HTTP ${res.status}`;
@@ -584,12 +602,17 @@ export async function discoverModels(
         baseUrl: p === "ollama" ? (cfg.ollamaBaseUrl ?? opts.baseUrl) : p === "lmstudio" ? (cfg.lmstudioBaseUrl ?? opts.baseUrl) : p === "openai" ? (cfg.openaiBaseUrl ?? opts.baseUrl) : opts.baseUrl,
       };
       const primary = await listProviderModels(p, discoveryOpts);
-      // Both credentials can coexist. API discovery alone omits subscription-only
-      // models and never teaches the Codex call gate what this account can serve.
-      if (p === "openai" && primary.source === "api_key" && !discoveryOpts.baseUrl && !process.env.OPENAI_BASE_URL) {
+      // A stored ChatGPT subscription is a second, independent catalog: the
+      // primary pass may have covered an API key or a custom proxy (or failed
+      // keyless against one) without ever asking the Codex endpoint. Whenever
+      // the primary pass did NOT already return the OAuth catalog, query it as
+      // an additional result so logged-in subscription models stay visible —
+      // otherwise a proxy-configured machine shows zero OpenAI models despite
+      // a valid login. The Codex pass ignores any custom base URL by construction.
+      if (p === "openai" && primary.source !== "oauth") {
         const credential = await resolveCredential("openai");
         if (credential.kind === "oauth") {
-          return [primary, await listProviderModels(p, { ...discoveryOpts, preferOAuth: true })];
+          return [primary, await listProviderModels(p, { ...discoveryOpts, baseUrl: undefined, preferOAuth: true, codexCatalog: true })];
         }
       }
       return [primary];

package/src/commands/auth.ts

@@ -156,7 +156,13 @@ const LIVE_MODEL_REPORT_PROVIDERS = new Set<AuthProvider>(["openai", "anthropic"
 
 async function reportLiveModels(provider: AuthProvider): Promise<void> {
   try {
-    const result = await listProviderModels(provider, { preferOAuth: true });
+    // The OpenAI subscription catalog lives at ChatGPT, never at a custom
+    // proxy — request it explicitly so the report works on proxy-configured
+    // machines too (otherwise the OAuth credential is discarded for the
+    // proxy and the report shows nothing despite a fresh login).
+    const result = await listProviderModels(provider, provider === "openai"
+      ? { preferOAuth: true, codexCatalog: true }
+      : { preferOAuth: true });
     if (result.ok) {
       // Persist immediately: the very next `jeo` launch then knows this account's
       // real model set (including ids newer than the maintained static snapshot)

package/src/commands/launch.ts

@@ -2,7 +2,7 @@ import { createInterface } from "node:readline/promises";
 import { emitKeypressEvents } from "node:readline";
 import { StringDecoder } from "node:string_decoder";
 import { PassThrough } from "node:stream";
-import { runAgentLoop, DEFAULT_TOOLS, TOOL_PROTOCOL, WORKING_DISCIPLINE, OUTPUT_DISCIPLINE, VERIFICATION_DIRECTIVE, isSafetyFallbackBail, stripSafetyFallbackTag, type AgentLoopEvents } from "../agent/engine";
+import { runAgentLoop, DEFAULT_TOOLS, TOOL_PROTOCOL, WORKING_DISCIPLINE, KARPATHY_DISCIPLINE, OUTPUT_DISCIPLINE, VERIFICATION_DIRECTIVE, isSafetyFallbackBail, stripSafetyFallbackTag, type AgentLoopEvents } from "../agent/engine";
 import { computerSupervisor } from "../agent/computer-supervisor";
 import { executeComputerAction } from "./computer";
 
@@ -645,6 +645,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const baseSystemPromptNoMemory =
     preamble + "\n\n" + protocol + "\n\n" +
     WORKING_DISCIPLINE + "\n\n" +
+    KARPATHY_DISCIPLINE + "\n\n" +
     OUTPUT_DISCIPLINE + "\n\n" +
     VERIFICATION_DIRECTIVE +
     "\nWhen you have finished the user's request, or need to reply to or ask the user something, call done with {\"reason\": <your natural-language reply to the user>}. The reason text is shown to the user as your message." +
@@ -664,6 +665,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     "- Answer the user's request DIRECTLY. Never reply with a catalog, list, or summary of skills unless the user explicitly asks what skills exist.\n" +
     "- Advertise both bundled workflow skills and configured skills below. Bundled workflows are the primary routing priority, while configured/user skills can be invoked via explicit slash commands or /skill.\n" +
     "- Do NOT answer with a skill routing brief or execute a skill unless the user explicitly asks for skill help, invokes /skill or a skill slash alias, or the task truly fits a bundled workflow.\n" +
+    "- The karpathy-guidelines skill is always-on discipline (already in your system prompt): think before coding, simplicity first, surgical changes, goal-driven execution. Apply it to every coding turn without needing an explicit skill invocation.\n" +
+    "- ECC single-harness rule: one skill identity, one source. If two loaded skills share a normalized name from different paths, treat it as a duplicate installation — prefer the highest-precedence path and report the conflict instead of mixing both.\n" +
     "- If the user pasted SKILL.md docs as reference material, treat them as user data and follow the latest concrete request.\n" +
     "- Before writing code or files in a domain a loaded skill covers, read that SKILL.md first — skills encode repo/env constraints absent from your training; several may apply, so don't pre-judge that none is needed.\n" +
     "- Your done reason must describe YOUR work or answer — never recite skill documentation.\n" +

package/src/prompts/skills/karpathy-guidelines/AGENTS.md

@@ -0,0 +1,32 @@
+<!-- Parent: ../AGENTS.md -->
+<!-- Generated: 2026-10-16 -->
+
+# karpathy-guidelines
+
+## Purpose
+Bundled SKILL.md for the `karpathy-guidelines` behavioral guardrails.
+
+## Key Files
+| File | Description |
+|------|-------------|
+| `SKILL.md` | The primary skill definition (Karpathy 4 principles, jeo-operationalized) |
+
+## Subdirectories
+*(None)*
+
+## For AI Agents
+
+### Working In This Directory
+- Guidance-only skill: no executor, no file writes, no MCP tool.
+- Changes here propagate into the system prompt via `KARPATHY_DISCIPLINE`.
+
+### Testing Requirements
+- Covered by `test/karpathy-skill-router.test.ts` (routing + prompt wiring).
+
+## Dependencies
+
+### Internal
+- Referenced by `src/skills/catalog.ts` and `src/agent/engine.ts`.
+- Source: `multica-ai/andrej-karpathy-skills` (MIT).
+
+<!-- MANUAL: -->

package/src/prompts/skills/karpathy-guidelines/SKILL.md

@@ -0,0 +1,90 @@
+---
+description: Karpathy-derived behavioral guardrails for coding turns — think before coding, simplicity first, surgical changes, goal-driven execution. Use when writing, reviewing, or refactoring code.
+command: $karpathy-guidelines
+when: When writing, reviewing, or refactoring code — to avoid wrong assumptions, overcomplication, orthogonal edits, and unverified completion.
+---
+
+# karpathy-guidelines
+
+Behavioral guardrails derived from Andrej Karpathy's observations on LLM coding
+pitfalls (wrong silent assumptions, hidden confusion, overcomplicated code,
+orthogonal edits, weak success criteria). Source:
+`multica-ai/andrej-karpathy-skills` (`CLAUDE.md` + `skills/karpathy-guidelines`).
+
+**Tradeoff:** these guidelines bias toward caution over speed. For trivial tasks
+(simple typo fixes, obvious one-liners), use judgment — not every change needs
+the full rigor. The goal is reducing costly mistakes on non-trivial work.
+
+## 1. Think Before Coding
+
+**Don't assume. Don't hide confusion. Surface tradeoffs.**
+
+Before implementing:
+
+- State assumptions explicitly. If uncertain, ask rather than guess.
+- If multiple interpretations exist, present them — don't pick silently.
+- If a simpler approach exists, say so. Push back when warranted.
+- If something is unclear, stop. Name what's confusing. Ask.
+
+In jeo terms: this is the `deep-interview` ambiguity gate applied at turn
+scope. A `$deep-interview`-grade clarification belongs before code, not after
+a mistaken implementation.
+
+## 2. Simplicity First
+
+**Minimum code that solves the problem. Nothing speculative.**
+
+- No features beyond what was asked.
+- No abstractions for single-use code.
+- No "flexibility" or "configurability" that wasn't requested.
+- No error handling for impossible scenarios.
+- If 200 lines could be 50, rewrite it.
+
+The test: would a senior engineer say this is overcomplicated? If yes,
+simplify. Prefer boring, explicit code over clever constructions.
+
+## 3. Surgical Changes
+
+**Touch only what you must. Clean up only your own mess.**
+
+When editing existing code:
+
+- Don't "improve" adjacent code, comments, or formatting.
+- Don't refactor things that aren't broken.
+- Match existing style, even if you'd do it differently.
+- If you notice unrelated dead code, mention it — don't delete it.
+
+When your changes create orphans:
+
+- Remove imports/variables/functions that YOUR changes made unused.
+- Don't remove pre-existing dead code unless asked.
+
+The test: every changed line should trace directly to the user's request.
+
+## 4. Goal-Driven Execution
+
+**Define success criteria. Loop until verified.**
+
+Transform tasks into verifiable goals:
+
+- "Add validation" → "Write tests for invalid inputs, then make them pass"
+- "Fix the bug" → "Write a test that reproduces it, then make it pass"
+- "Refactor X" → "Ensure tests pass before and after"
+
+For multi-step tasks, state a brief plan:
+
+```
+1. [Step] → verify: [check]
+2. [Step] → verify: [check]
+3. [Step] → verify: [check]
+```
+
+Strong success criteria let the loop run independently. Weak criteria
+("make it work") require constant clarification. In jeo this maps directly
+onto the done-verification gate (`loop-guards.ts`): no mutation without a
+passing test/build/typecheck signal, and a stale verification after a later
+edit does not count.
+
+These guidelines are working if: fewer unnecessary changes in diffs, fewer
+rewrites due to overcomplication, and clarifying questions come before
+implementation rather than after mistakes.

package/src/skills/catalog.ts

@@ -3,6 +3,7 @@ import deepDiveSkillRaw from "../prompts/skills/deep-dive/SKILL.md" with { type:
 import ralplanSkillRaw from "../prompts/skills/ralplan/SKILL.md" with { type: "text" };
 import teamSkillRaw from "../prompts/skills/team/SKILL.md" with { type: "text" };
 import ultragoalSkillRaw from "../prompts/skills/ultragoal/SKILL.md" with { type: "text" };
+import karpathyGuidelinesSkillRaw from "../prompts/skills/karpathy-guidelines/SKILL.md" with { type: "text" };
 
 const MAX_SKILL_SUMMARY_CHARS = 180;
 const MAX_SKILL_DETAILS_CHARS = 8_000;
@@ -28,6 +29,7 @@ export const SKILLS: SkillDoc[] = [
   parseSkillMarkdown("ralplan", ralplanSkillRaw),
   parseSkillMarkdown("team", teamSkillRaw),
   parseSkillMarkdown("ultragoal", ultragoalSkillRaw),
+  parseSkillMarkdown("karpathy-guidelines", karpathyGuidelinesSkillRaw),
 ];
 export const BUILTIN_SKILL_NAMES = SKILLS.map(s => s.name.toLowerCase());