jeo-code 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -9,6 +9,33 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.1] - 2026-10-16
+_Logged-in OpenAI subscription models were invisible on proxy-configured machines._
+
+### Fixed
+- **OpenAI OAuth catalog discarded when a custom base URL is set** (`src/ai/model-discovery.ts`) — with `OPENAI_BASE_URL`/config `openaiBaseUrl` configured, discovery dropped the stored OAuth credential, probed the proxy keyless (`auth rejected`), and the Codex second pass never fired (it only covered `api_key` primaries). OpenAI has no static fallback by design, so the picker showed zero models despite a valid login. New `codexCatalog` option queries the ChatGPT subscription catalog ignoring any custom base URL; `discoverModels` now appends it whenever the primary pass did not already return the OAuth catalog. The post-login report (`jeo auth login openai`) uses it too.
+
+### Verified
+- Live on a proxy-configured machine: `openai` rows went from 1 failed keyless row to keyless-fail + 7-model OAuth catalog; `providerPickEntries` returns 7 rows. `bun run typecheck` clean; discovery suites green including 2 new regression tests.
+
+## [0.12.1] - 2026-10-16
+_Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend._
+
+### Added
+- **Opt-in official agy discovery and execution** — `agy/<official-cli-slug>` selects the installed, externally authenticated official CLI as a full agent, not a raw-model adapter or CCA alias. `/model provider agy` reads the live `agy models` list, preserves exact slugs, and reports empty lists and failures without static fallback. CLI catalogs stay process-local; no identity or credential parity with jeo OAuth is assumed.
+- **Session-owned resume and process lifecycle** — saved jeo sessions retain their own CLI conversation ID rather than resuming the CLI's unrelated latest conversation. Turns support cancellation and bounded timeouts. The requested model and upstream quota/auth/permission errors remain visible, with no fallback to CCA, another model, or another account.
+- **Explicit execution boundary** — the CLI owns its tools, sandbox, permissions, and conversation; jeo approvals do not mediate its inner tool calls. The bridge is text-only, excluded from automatic raw-model/subagent routing, and rejects images and jeo-only tool/system/step/thinking controls it cannot enforce.
+
+### Changed
+- **CCA account model discovery** — combine `agentModelSorts`, `tieredModelIds`, and `defaultAgentModelId` instead of treating one metadata list as the whole chat catalog. Existing `antigravity/<CCA-id>` discovery remains scoped to the selected jeo OAuth account, without claiming direct CCA Argon support.
+
+### Fixed
+- **Malformed normalized CCA IDs** — reject invalid discovery responses instead of replacing an account's known-good cache with malformed IDs. Authoritative empty lists remain empty, failed discovery remains a failure, and existing account-cache isolation is preserved.
+
+### Verification and release status
+- A real, isolated source-jeo invocation of `jeo launch --model agy/gemini-4-argon-low --plan --no-tui --no-session --no-skills "Explain this repository"` exited **0**, reporting **30.5k input / 11 output tokens**. This verifies that CLI bridge invocation, not direct CCA Argon access or availability for every account.
+- Three independent code, TypeScript, and security reviewers identified six failure-path issues; test-first fixes and regression coverage are in progress. Final release gates and public publication are not yet claimed.
+
 ## [0.12.0] - 2026-10-16
 _Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router._
 

package/README.ja.md

@@ -395,10 +395,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
 - **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -397,10 +397,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
 - **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -389,10 +389,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
 - **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -393,10 +393,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
+- **[0.12.1]** (2026-10-16) — Explicitly select the official agy full agent with its own live model catalog and session, separate from jeo's Cloud Code Assist backend.
 - **[0.12.0]** (2026-10-16) — Karpathy behavioral guardrails become always-on discipline, and skill routing gains an ECC single-harness inventory plus a Jev-style advisory router.
 - **[0.11.6]** (2026-10-16) — Live Antigravity account model discovery now serves the actual account's available models instead of assuming static availability.
-- **[0.11.5]** (2026-10-04) — Anthropic login now runs Opus 5.5 and Sonnet 5.5 as the selected models: the OAuth client version gate and incompatible fast-mode temperature are fixed, with real request and streaming responses verified.
-- **[0.11.4]** (2026-10-01) — The release pipeline could not actually release: 13 tests failed on Linux CI only, and the stored npm token no longer authenticated. Both are fixed at the root — the suite is order-independent, and publishing no longer depends on a secret that can expire.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-discovery.ts

@@ -63,6 +63,17 @@ export interface DiscoveryOptions {
    * queries both OpenAI catalogs when both credentials are configured.
    */
   preferOAuth?: boolean;
+  /**
+   * Query the ChatGPT Codex OAuth catalog even when a custom OpenAI base URL
+   * (config `openaiBaseUrl` or `OPENAI_BASE_URL`) is configured. A stored
+   * subscription is an independent catalog that lives at ChatGPT, never at
+   * the proxy — without this, a proxy-configured machine silently drops the
+   * OAuth credential, probes the proxy keyless, and surfaces zero models
+   * despite a valid login. Implies `preferOAuth` for OpenAI. Used by
+   * `discoverModels`' second pass and the post-login report; has no effect
+   * on other providers.
+   */
+  codexCatalog?: boolean;
 }
 
 const DEFAULT_TIMEOUT = 5000;
@@ -106,6 +117,7 @@ export function discoveryRequest(
   cred: Credential | undefined,
   baseUrl?: string,
   oauthAccountId?: string,
+  opts?: { forceCodexCatalog?: boolean },
 ): { url: string; headers: Record<string, string>; method?: "GET" | "POST"; body?: string } {
   // Catalog-driven compat providers: OpenAI `${base}/models` (Bearer) or Anthropic
   // `${base}/v1/models` (x-api-key). Both return { data: [{ id }] }.
@@ -123,7 +135,7 @@ export function discoveryRequest(
       return { url: "https://api.anthropic.com/v1/models", headers: anthropicHeaders(cred!) };
     case "openai": {
       const token = cred?.kind === "oauth" || cred?.kind === "api_key" ? cred.token : "";
-      if (cred?.kind === "oauth" && !baseUrl && !process.env.OPENAI_BASE_URL) {
+      if (cred?.kind === "oauth" && (opts?.forceCodexCatalog || (!baseUrl && !process.env.OPENAI_BASE_URL))) {
         const accountId = extractChatgptAccountId(token) || oauthAccountId;
         const headers: Record<string, string> = {
           Authorization: `Bearer ${token}`,
@@ -348,6 +360,11 @@ export async function listProviderModels(
   const fetchImpl = opts.fetchImpl ?? fetch;
   const limit = opts.limit ?? (provider === "openai" || provider === "antigravity" ? Number.POSITIVE_INFINITY : DEFAULT_LIMIT);
   let baseUrl = opts.baseUrl;
+  // An explicit Codex-catalog request (discoverModels' second pass, the
+  // post-login report) ignores every custom base URL: the subscription
+  // catalog lives at ChatGPT, never at the proxy. Function-scoped (not
+  // block-scoped) so the request builder below can see it.
+  const forceCodexCatalog = provider === "openai" && !!opts.codexCatalog;
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
@@ -365,7 +382,7 @@ export async function listProviderModels(
     cred = raw;
     source = cred.kind === "oauth" ? "oauth" : cred.kind === "api_key" ? "api_key" : "none";
     const config = opts.config ?? (await readGlobalConfig());
-    if (provider === "openai") baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
+    if (provider === "openai" && !forceCodexCatalog) baseUrl = (baseUrl ?? config.openaiBaseUrl ?? process.env.OPENAI_BASE_URL)?.replace(/\/+$/, "");
 
     if (provider === "antigravity") {
       // Antigravity lists models from the LIVE Cloud Code Assist endpoint
@@ -390,12 +407,13 @@ export async function listProviderModels(
     // no api-key header), so never swap its credential to an api_key.
     // `preferOAuth` (post-login report only) skips this swap so the report
     // reflects the freshly stored OAuth credential, not an unrelated key.
-    if (provider !== "antigravity" && cred.kind === "oauth" && config.providers?.[prov] && !opts.preferOAuth) {
+    // `codexCatalog` implies the same (plus base-URL immunity above).
+    if (provider !== "antigravity" && cred.kind === "oauth" && config.providers?.[prov] && !opts.preferOAuth && !forceCodexCatalog) {
       // An API key is the broader, documented path — prefer it for live discovery.
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";
     }
-    if (provider === "openai" && baseUrl && cred.kind === "oauth") {
+    if (provider === "openai" && baseUrl && cred.kind === "oauth" && !forceCodexCatalog) {
       // Subscription credentials belong to ChatGPT, not a configured proxy.
       const key = config.providers?.openai;
       cred = key ? { kind: "api_key", provider: "openai", token: key } : { kind: "none", provider: "openai" };
@@ -456,7 +474,7 @@ export async function listProviderModels(
       }
       setAntigravityAccountScope(scope.accountId);
     }
-    const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId);
+    const { url, headers, method, body: requestBody } = discoveryRequest(provider, cred, baseUrl, oauthAccountId, forceCodexCatalog ? { forceCodexCatalog: true } : undefined);
     const res = await fetchImpl(url, { method: method ?? "GET", headers, body: requestBody, signal });
     if (!res.ok) {
       const reason = res.status === 401 || res.status === 403 ? "auth rejected" : `HTTP ${res.status}`;
@@ -584,12 +602,17 @@ export async function discoverModels(
         baseUrl: p === "ollama" ? (cfg.ollamaBaseUrl ?? opts.baseUrl) : p === "lmstudio" ? (cfg.lmstudioBaseUrl ?? opts.baseUrl) : p === "openai" ? (cfg.openaiBaseUrl ?? opts.baseUrl) : opts.baseUrl,
       };
       const primary = await listProviderModels(p, discoveryOpts);
-      // Both credentials can coexist. API discovery alone omits subscription-only
-      // models and never teaches the Codex call gate what this account can serve.
-      if (p === "openai" && primary.source === "api_key" && !discoveryOpts.baseUrl && !process.env.OPENAI_BASE_URL) {
+      // A stored ChatGPT subscription is a second, independent catalog: the
+      // primary pass may have covered an API key or a custom proxy (or failed
+      // keyless against one) without ever asking the Codex endpoint. Whenever
+      // the primary pass did NOT already return the OAuth catalog, query it as
+      // an additional result so logged-in subscription models stay visible —
+      // otherwise a proxy-configured machine shows zero OpenAI models despite
+      // a valid login. The Codex pass ignores any custom base URL by construction.
+      if (p === "openai" && primary.source !== "oauth") {
         const credential = await resolveCredential("openai");
         if (credential.kind === "oauth") {
-          return [primary, await listProviderModels(p, { ...discoveryOpts, preferOAuth: true })];
+          return [primary, await listProviderModels(p, { ...discoveryOpts, baseUrl: undefined, preferOAuth: true, codexCatalog: true })];
         }
       }
       return [primary];

package/src/commands/auth.ts

@@ -156,7 +156,13 @@ const LIVE_MODEL_REPORT_PROVIDERS = new Set<AuthProvider>(["openai", "anthropic"
 
 async function reportLiveModels(provider: AuthProvider): Promise<void> {
   try {
-    const result = await listProviderModels(provider, { preferOAuth: true });
+    // The OpenAI subscription catalog lives at ChatGPT, never at a custom
+    // proxy — request it explicitly so the report works on proxy-configured
+    // machines too (otherwise the OAuth credential is discarded for the
+    // proxy and the report shows nothing despite a fresh login).
+    const result = await listProviderModels(provider, provider === "openai"
+      ? { preferOAuth: true, codexCatalog: true }
+      : { preferOAuth: true });
     if (result.ok) {
       // Persist immediately: the very next `jeo` launch then knows this account's
       // real model set (including ids newer than the maintained static snapshot)