jeo-code 0.12.4 → 0.12.6

package/CHANGELOG.md

@@ -9,6 +9,27 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.6] - 2026-10-17
+_Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls._
+
+### Fixed
+- **OpenAI subscription startup behind a configured proxy** — account-confirmed Codex models keep their OAuth transport instead of sending a keyless request to the OpenAI-compatible endpoint. Cold calls confirm the subscription catalog first; explicit per-call URLs, configured proxy keys, and endpoint-discovered models retain their existing routes. Subscription requests use the direct Codex backend, not the configured proxy.
+- **Provider-specific authentication recovery** — HTTP 401/403 errors name the appropriate login or API-key configuration, omit unrelated Antigravity advice for OpenAI, preserve exact status codes, and no longer treat a structured non-authentication failure as a credential rejection merely because its body mentions 401.
+- **Account-bound subscription catalogs** — distinguish opaque bearer identities without exposing tokens, reject discovery results that finish after an account switch, share concurrent same-account catalog requests, and keep cancellation of one caller from interrupting other callers.
+
+## [0.12.5] - 2026-10-17
+_Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing._
+
+### Added
+- **Interactive Setup Provider Options** (`src/commands/setup.ts`, `src/commands/setup-helpers.ts`) — added `antigravity` (Google Cloud Code Assist OAuth) and `kimi` (Moonshot API key / Kimi Code OAuth) to interactive setup provider selection, enabling browser OAuth, bearer token paste, or API key configuration with default models (`antigravity/gemini-3-flash`, `kimi-k2.5`). Updated `buildEnabledProviders` to recognize configured `kimi` credentials.
+- **Kimi Live Model Cache Rehydration** (`src/ai/model-cache.ts`) — cache hits for Kimi OAuth (`provider === 'kimi' && source === 'oauth'`) now rehydrate `recordLiveKimiCodeModels(entry.models)` alongside OpenAI Codex models.
+- **Immediate Model Cache on Provider Probe** (`src/commands/provider.ts`) — successful `jeo provider test <id>` and `jeo provider add` probing now immediately writes discovered custom/compatible models to the disk cache (`writeModelCache([result])`).
+
+### Fixed
+- **Model Cache Key Scoping** (`src/ai/model-cache.ts`) — fixed `keyOf` helper scoping and included `kimi` in source distinction so OAuth and API key catalogs do not clobber each other.
+- **OAuth Token Preservation in Setup** (`src/commands/setup.ts`) — fixed `delete next.oauth` condition to check `Object.keys(next.oauth).length === 0` so non-Anthropic/OpenAI/Gemini OAuth credentials (such as `antigravity` or `kimi`) are not inadvertently dropped on save.
+- **Auth Import Model Reporting** (`src/commands/auth.ts`) — added `antigravity` reporting to `reportLiveModels` following Gemini OAuth import.
+
 ## [0.12.4] - 2026-10-17
 _Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`._
 
@@ -2566,7 +2587,8 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.11.4...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.6...HEAD
+[0.12.6]: https://github.com/akillness/jeo-code/releases/tag/v0.12.6
 [0.11.4]: https://github.com/akillness/jeo-code/releases/tag/v0.11.4
 [0.11.3]: https://github.com/akillness/jeo-code/releases/tag/v0.11.3
 [0.11.2]: https://github.com/akillness/jeo-code/releases/tag/v0.11.2

package/README.ja.md

@@ -416,10 +416,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
+- **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
-- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -417,10 +417,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
+- **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
-- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -409,10 +409,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
+- **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
-- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -414,10 +414,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
+- **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
-- **[0.12.1]** (2026-10-16) — Logged-in OpenAI subscription models were invisible on proxy-configured machines.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-cache.ts

@@ -19,7 +19,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { jeoEnv } from "../util/env";
-import { recordLiveCodexModels, recordLiveProviderModels, setAntigravityAccountScope, setOpenAIOauthAccountScope } from "./model-catalog";
+import { recordLiveCodexModels, recordLiveKimiCodeModels, recordLiveProviderModels, setAntigravityAccountScope, setOpenAIOauthAccountScope } from "./model-catalog";
 import type { Credential } from "../auth";
 import { getStoredOAuth, snapshotProvider } from "../auth/storage";
 import { getAntigravityUserAgent } from "./providers/antigravity";
@@ -60,6 +60,21 @@ function cachePath(): string {
   return path.join(cacheDir(), "model-catalog-cache.json");
 }
 
+/** Account-bound catalog identity; opaque manual bearers must not share a scope. */
+export async function openAIOauthAccountScope(credential?: Credential): Promise<string | undefined> {
+  let selected = credential;
+  if (!selected) {
+    const snapshot = await snapshotProvider("openai");
+    if (!snapshot.oauth) return undefined;
+    selected = { kind: "oauth", provider: "openai", token: snapshot.oauth };
+  }
+  if (selected.kind !== "oauth" || selected.provider !== "openai") return undefined;
+  const stored = await getStoredOAuth("openai");
+  const accountId = extractChatgptAccountId(selected.token)
+    || (stored?.access === selected.token ? stored.accountId?.trim() : undefined);
+  return accountId || `token:${createHash("sha256").update(selected.token).digest("hex")}`;
+}
+
 /** Peek at the selected OAuth account without importing or refreshing credentials. */
 export async function antigravityAccountScope(credential?: Credential): Promise<string | undefined> {
   try {
@@ -158,7 +173,7 @@ export function mergeCacheEntries(
   const isScopedOAuth = (provider: ProviderName, source: ModelCacheSource): boolean =>
     (provider === "openai" || provider === "antigravity") && source === "oauth";
   const keyOf = (provider: ProviderName, baseUrl?: string, accountId?: string, source?: ModelCacheSource) =>
-    `${provider}\u0000${baseUrl?.replace(/\/+$/, "") ?? ""}\u0000${isScopedOAuth(provider, source ?? "none") ? accountId ?? "" : ""}\u0000${provider === "openai" || provider === "antigravity" ? source ?? "none" : ""}`;
+    `${provider}\u0000${baseUrl?.replace(/\/+$/, "") ?? ""}\u0000${isScopedOAuth(provider, source ?? "none") ? accountId ?? "" : ""}\u0000${provider === "openai" || provider === "antigravity" || provider === "kimi" ? source ?? "none" : ""}`;
   for (const entry of previous) {
     const scoped = isScopedOAuth(entry.provider, entry.source);
     if (entry.provider === "agy") continue;
@@ -240,6 +255,9 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
     if (isOpenAIOAuth && entry.accountId && !entry.baseUrl) {
       recordLiveCodexModels(entry.models, entry.accountId);
     }
+    if (entry.provider === "kimi" && entry.source === "oauth") {
+      recordLiveKimiCodeModels(entry.models);
+    }
     applied += entry.models.length;
   }
   return applied;
@@ -248,14 +266,7 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
 /** Read + apply in one step. Returns the cache so callers can decide about refreshing. */
 export async function rehydrateLiveModels(): Promise<ModelCacheFile | null> {
   const cache = await readModelCache();
-  let accountId: string | undefined;
-  try {
-    const stored = await getStoredOAuth("openai");
-    const jwtAccountId = stored ? extractChatgptAccountId(stored.access) : undefined;
-    accountId = jwtAccountId || stored?.accountId;
-  } catch {
-    accountId = undefined;
-  }
+  const accountId = await openAIOauthAccountScope();
   const antigravityAccountId = await antigravityAccountScope();
   setOpenAIOauthAccountScope(accountId);
   setAntigravityAccountScope(antigravityAccountId);

package/src/ai/model-catalog.ts

@@ -255,12 +255,17 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
 }
 
 /** A confirmed account catalog is authoritative; use the snapshot before discovery. */
-export function isCodexModel(model: string): boolean {
+export function isCodexModel(model: string, accountId = activeOpenAIOauthScope): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  const confirmed = liveCodexModels.get(activeOpenAIOauthScope);
+  const confirmed = liveCodexModels.get(oauthScope(accountId));
   return confirmed ? confirmed.has(wire) : CODEX_MODELS.includes(wire);
 }
 
+/** Whether discovery (including a restored account cache) established a Codex catalog. */
+export function hasConfirmedCodexCatalog(accountId = activeOpenAIOauthScope): boolean {
+  return liveCodexModels.has(oauthScope(accountId));
+}
+
 /** Test-only reset for live Codex observations and the active account scope. */
 export function resetLiveCodexModels(): void {
   liveCodexModels.clear();
@@ -501,6 +506,30 @@ export const KIMI_CODE_MODELS: readonly string[] = [
   "kimi-k2",
 ];
 
+const liveKimiCodeModels = new Set<string>();
+
+/** Record ids confirmed by the Kimi Code OAuth `/v1/models` endpoint so brand-new
+ *  subscription models work immediately without waiting for a static catalog release. */
+export function recordLiveKimiCodeModels(ids: readonly string[]): void {
+  for (const id of ids) {
+    const trimmed = id.trim();
+    if (!trimmed) continue;
+    const wire = trimmed.startsWith("kimi/") ? trimmed.slice(5) : trimmed;
+    if (wire) liveKimiCodeModels.add(wire);
+  }
+}
+
+/** Whether `model` is served by the Kimi Code OAuth subscription endpoint. */
+export function isKimiCodeModel(model: string): boolean {
+  const wire = model.startsWith("kimi/") ? model.slice(5) : model;
+  return KIMI_CODE_MODELS.includes(wire) || liveKimiCodeModels.has(wire);
+}
+
+/** Test-only reset for live Kimi Code observations. */
+export function resetLiveKimiCodeModels(): void {
+  liveKimiCodeModels.clear();
+}
+
 /** Recency compare for `releaseDate` ("YYYY-MM"): `>0` when `a` is newer; a
  *  missing date sorts oldest, so an unconfirmed date never outranks a
  *  verified-newer model. */
@@ -639,6 +668,20 @@ export function inferCatalogMetadata(modelId: string): CatalogModel | undefined
       company: "xAI",
     };
   }
+  // Kimi / Moonshot
+  const kimi = id.match(/^kimi-(k\d+|latest|for-coding)/);
+  if (kimi) {
+    return {
+      canonical: raw,
+      provider: "kimi",
+      providerModel: id,
+      contextTokens: 256_000,
+      maxOutputTokens: 16_384,
+      thinking: FULL,
+      images: false,
+      company: "Moonshot",
+    };
+  }
 
   return undefined;
 }

package/src/ai/model-discovery.ts

@@ -16,6 +16,7 @@ import {
   catalogByProvider,
   KIMI_CODE_MODELS,
   recordLiveCodexModels,
+  recordLiveKimiCodeModels,
   recordLiveProviderModels,
   setOpenAIOauthAccountScope,
   setAntigravityAccountScope,
@@ -23,10 +24,10 @@ import {
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { getStoredOAuth } from "../auth/storage";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
-import { antigravityAccountScope } from "./model-cache";
+import { antigravityAccountScope, openAIOauthAccountScope } from "./model-cache";
 import { getAntigravityUserAgent, resolveAntigravityProjectId } from "./providers/antigravity";
 import { discoverGoogleProjectId, ANTIGRAVITY_DISCOVERY_METADATA } from "../auth/flows/google-project";
-
+import { getKimiCommonHeaders } from "../auth/flows/kimi";
 export interface ProviderModelsResult {
   provider: ProviderName;
   /** Discovered model ids (provider-qualified where the router expects it). */
@@ -185,6 +186,15 @@ export function discoveryRequest(
       return { url: "https://api.x.ai/v1/models", headers: token ? { Authorization: `Bearer ${token}` } : {} };
     }
     case "kimi": {
+      if (cred?.kind === "oauth") {
+        return {
+          url: "https://api.kimi.com/coding/v1/models",
+          headers: {
+            ...getKimiCommonHeaders(),
+            Authorization: `Bearer ${cred.token}`,
+          },
+        };
+      }
       const token = cred?.kind === "api_key" ? cred.token : "";
       return { url: "https://api.moonshot.ai/v1/models", headers: token ? { Authorization: `Bearer ${token}` } : {} };
     }
@@ -402,6 +412,7 @@ export async function listProviderModels(
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
+  let oauthCatalogScope: string | undefined;
   let source: ProviderModelsResult["source"] = "keyless";
   if (provider === "xai") {
     // xAI (Grok) is API-key only and not an OAuth AuthProvider: resolve its key
@@ -456,8 +467,9 @@ export async function listProviderModels(
     if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
       const stored = await getStoredOAuth("openai").catch(() => undefined);
       const jwtAccountId = extractChatgptAccountId(cred.token);
-      oauthAccountId = jwtAccountId || stored?.accountId;
-      setOpenAIOauthAccountScope(oauthAccountId);
+      oauthAccountId = jwtAccountId || (stored?.access === cred.token ? stored.accountId : undefined);
+      oauthCatalogScope = await openAIOauthAccountScope(cred);
+      setOpenAIOauthAccountScope(oauthCatalogScope);
     }
     // Gemini models are exposed ONLY under API-key auth: a gemini OAuth token can
     // still list models from generativelanguage.googleapis.com, but it can no
@@ -474,7 +486,7 @@ export async function listProviderModels(
     }
   }
 
-  const scope = { ...(oauthAccountId ? { accountId: oauthAccountId } : {}), ...(baseUrl ? { baseUrl } : {}) };
+  const scope = { ...(oauthCatalogScope ? { accountId: oauthCatalogScope } : {}), ...(baseUrl ? { baseUrl } : {}) };
   const timeout = opts.timeoutMs ?? DEFAULT_TIMEOUT;
   let signal = opts.signal ? AbortSignal.any([opts.signal, AbortSignal.timeout(timeout)]) : AbortSignal.timeout(timeout);
   let initialAntigravityScope: string | undefined;
@@ -568,6 +580,12 @@ export async function listProviderModels(
     }
     const allModels = [...new Set(ids)].sort();
     const models = allModels.slice(0, limit);
+    if (provider === "openai" && source === "oauth" && !baseUrl) {
+      if (await openAIOauthAccountScope() !== oauthCatalogScope) {
+        return { provider, models: [], ok: false, source, error: "account changed during model discovery", ...scope };
+      }
+      setOpenAIOauthAccountScope(oauthCatalogScope);
+    }
     if (provider === "antigravity") {
       const currentScope = await antigravityAccountScope();
       if (currentScope !== scope.accountId && currentScope !== initialAntigravityScope) {
@@ -584,7 +602,8 @@ export async function listProviderModels(
       replace: provider === "openai" || provider === "antigravity",
       ...(source === "oauth" && scope.accountId ? { accountId: scope.accountId } : {}),
     });
-    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthAccountId);
+    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthCatalogScope);
+    if (provider === "kimi" && source === "oauth") recordLiveKimiCodeModels(allModels);
     return {
       provider,
       models,
@@ -659,6 +678,12 @@ export async function discoverModels(
           return [primary, await listProviderModels(p, { ...discoveryOpts, baseUrl: undefined, preferOAuth: true, codexCatalog: true })];
         }
       }
+      if (p === "kimi" && primary.source !== "oauth") {
+        const credential = await resolveCredential("kimi");
+        if (credential.kind === "oauth") {
+          return [primary, await listProviderModels(p, { ...discoveryOpts, preferOAuth: true })];
+        }
+      }
       return [primary];
     }),
   );

package/src/ai/model-manager.ts

@@ -6,12 +6,15 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor, BUILTIN_ALIASES } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel, findLiveCatalogModel } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel, isKimiCodeModel, findLiveCatalogModel, hasConfirmedCodexCatalog, isLiveProviderModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { allCompatNames, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
 import { withRetry, defaultRetryable, withConnectionContext, isConnectionError, ConnectionContextError, type RetryOptions } from "../util/retry";
 import { jeoEnv } from "../util/env";
 import type { Config } from "../agent/state";
+import { listProviderModels } from "./model-discovery";
+import type { ProviderModelsResult } from "./model-discovery";
+import { openAIOauthAccountScope } from "./model-cache";
 
 
 
@@ -329,8 +332,7 @@ export function oauthServesModel(provider: AuthProvider, model: string): boolean
     return isCodexModel(model);
   }
   if (provider === "kimi") {
-    const wire = model.startsWith("kimi/") ? model.slice(5) : model;
-    return KIMI_CODE_MODELS.includes(wire);
+    return isKimiCodeModel(model);
   }
   if (isOAuthProvider(provider) && OAUTH_FLOW_REGISTRY[provider].verifiedEndToEnd === false) return false;
   return true;
@@ -405,6 +407,8 @@ interface Resolved {
   baseUrl: string | undefined;
 }
 
+const codexCatalogInFlight = new Map<string, Promise<ProviderModelsResult>>();
+
 /**
  * The credential to actually use for a provider call. A configured local OpenAI-compatible base
  * URL must use the standard /chat/completions path, but the openai adapter dispatches on
@@ -437,7 +441,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   }
   const adapter = providerRegistry.get(provider)!;
 
-  const baseUrl =
+  let baseUrl =
     options.baseUrl ??
     (provider === "openai" ? config.openaiBaseUrl : undefined) ??
     (provider === "ollama" ? config.ollamaBaseUrl : undefined) ??
@@ -504,6 +508,47 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   const credentialProvider = provider as AuthProvider;
   const credential = await resolveCredential(credentialProvider);
   const effective = effectiveCredentialForProvider(credentialProvider, credential, config, model);
+  // A subscription catalog is independent of a configured OpenAI-compatible
+  // endpoint. Keep its OAuth transport rather than replacing it with "no-key".
+  // Explicit endpoint overrides, proxy keys and endpoint-discovered models win.
+  if (provider === "openai" && baseUrl && options.baseUrl === undefined
+    && effective.kind === "oauth" && !config.providers.openai
+    && !isLiveProviderModel("openai", model, { openaiBaseUrl: baseUrl })) {
+    options.signal?.throwIfAborted();
+    const accountScope = await openAIOauthAccountScope(effective);
+    if (accountScope && !hasConfirmedCodexCatalog(accountScope)) {
+      let discovery = codexCatalogInFlight.get(accountScope);
+      if (!discovery) {
+        // One caller's cancellation must not cancel another agent's catalog read.
+        discovery = listProviderModels("openai", { config, codexCatalog: true });
+        codexCatalogInFlight.set(accountScope, discovery);
+        void discovery.finally(() => codexCatalogInFlight.delete(accountScope)).catch(() => {});
+      }
+      const signal = options.signal;
+      if (signal) {
+        const aborted = Promise.withResolvers<never>();
+        const onAbort = () => aborted.reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        try {
+          signal.throwIfAborted();
+          await Promise.race([discovery, aborted.promise]);
+        } finally {
+          signal.removeEventListener("abort", onAbort);
+        }
+      } else {
+        await discovery;
+      }
+    }
+    options.signal?.throwIfAborted();
+    if (await openAIOauthAccountScope() !== accountScope) {
+      throw new Error("OpenAI credential changed during model discovery; retry the request.");
+    }
+    // Never infer cloud eligibility from the bundled snapshot when discovery fails.
+    if (accountScope && hasConfirmedCodexCatalog(accountScope) && isCodexModel(model, accountScope)) {
+      baseUrl = undefined;
+      callOptions.baseUrl = undefined;
+    }
+  }
   const isLocalOpenAi = provider === "openai" && !!baseUrl;
   if (provider === "openai" && effective.kind === "oauth" && !isLocalOpenAi && !oauthServesModel("openai", model)) {
     throw new Error(

package/src/commands/auth.ts

@@ -152,7 +152,7 @@ async function runAuthLogin(rest: string[]): Promise<void> {
  * already succeeded and is not rolled back by this check. Prints only model
  * ids/count — no tokens/secrets.
  */
-const LIVE_MODEL_REPORT_PROVIDERS = new Set<AuthProvider>(["openai", "anthropic", "antigravity"]);
+const LIVE_MODEL_REPORT_PROVIDERS = new Set<AuthProvider>(["openai", "anthropic", "antigravity", "kimi"]);
 
 async function reportLiveModels(provider: AuthProvider): Promise<void> {
   try {
@@ -249,6 +249,7 @@ async function runAuthImport(rest: string[]): Promise<void> {
     }
     const expiryMsg = expires ? fmtExpiry(expires) : "";
     console.log(`Expiry status:${expiryMsg || " valid"}`);
+    await reportLiveModels("antigravity");
   } catch (err: any) {
     console.log(`[FAILED] ${err.message}`);
     process.exitCode = 1;
@@ -335,8 +336,16 @@ async function selectProvider(
   console.log("  1) anthropic   (real PKCE OAuth, verified end-to-end)");
   console.log("  2) openai      (real PKCE OAuth, Codex backend)");
   console.log("  3) gemini      (real Google OAuth, Cloud Code Assist)");
-  const ans = (await rl.question("Choose [1-3]: ")).trim();
-  const map: Record<string, AuthProvider> = { "1": "anthropic", "2": "openai", "3": "gemini" };
+  console.log("  4) antigravity (Google Cloud Code Assist OAuth)");
+  console.log("  5) kimi        (Kimi Code OAuth device authorization)");
+  const ans = (await rl.question("Choose [1-5]: ")).trim();
+  const map: Record<string, AuthProvider> = {
+    "1": "anthropic",
+    "2": "openai",
+    "3": "gemini",
+    "4": "antigravity",
+    "5": "kimi",
+  };
   const p = map[ans];
   if (!p) {
     console.log("Invalid choice.");

package/src/commands/provider.ts

@@ -31,6 +31,7 @@ import {
   normalizeProviderId,
 } from "../ai/providers/custom-providers";
 import { listProviderModels } from "../ai/model-discovery";
+import { writeModelCache } from "../ai/model-cache";
 import { describeProvider } from "../ai/provider-status";
 
 const USAGE = [
@@ -186,6 +187,7 @@ async function probe(id: string, opts: { failOnError: boolean }): Promise<void>
     if (shown.length) console.log(`              ${shown.join(", ")}${result.models.length > shown.length ? ", …" : ""}`);
     const first = result.models[0];
     console.log(`  status    : OK — use it with 'jeo launch --model ${first ? qualify(first) : `${id}/<model>`}'`);
+    await writeModelCache([result]);
     return;
   }
 

package/src/commands/setup-helpers.ts

@@ -76,6 +76,7 @@ export function buildEnabledProviders(config: Config): string[] {
   if (cfg.providers?.anthropic || cfg.oauth?.anthropic) enabled.push("anthropic");
   if (cfg.providers?.openai || cfg.oauth?.openai) enabled.push("openai");
   if (cfg.providers?.gemini || cfg.oauth?.gemini || cfg.providers?.antigravity || cfg.oauth?.antigravity) enabled.push("google-oauth");
+  if (cfg.providers?.kimi || cfg.oauth?.kimi) enabled.push("kimi");
   if (cfg.ollamaBaseUrl) enabled.push(`ollama(${cfg.ollamaBaseUrl})`);
   if (cfg.openaiBaseUrl) enabled.push(`openai-compatible(${cfg.openaiBaseUrl})`);
   return enabled;

package/src/commands/setup.ts

@@ -24,12 +24,14 @@ function reportModelChoice(r: { warning?: string; suggestions: string[] }): void
   if (r.suggestions.length) console.log(`  Did you mean: ${r.suggestions.join(", ")}?`);
 }
 
-type ProviderChoice = "anthropic" | "openai" | "gemini" | "ollama" | "lmstudio" | "openai-compatible";
+type ProviderChoice = "anthropic" | "openai" | "gemini" | "antigravity" | "kimi" | "ollama" | "lmstudio" | "openai-compatible";
 
 const DEFAULT_MODELS: Record<ProviderChoice, string> = {
   anthropic: "claude-sonnet-4-6",
   openai: "gpt-4o",
   gemini: "gemini-2.0-flash",
+  antigravity: "antigravity/gemini-3-flash",
+  kimi: "kimi-k2.5",
   ollama: "ollama/llama3.1:8b",
   lmstudio: "openai/local-model",
   "openai-compatible": "openai/local-model",
@@ -87,16 +89,19 @@ export async function runSetupCommand(): Promise<void> {
   console.log("  1) anthropic           — Claude (API key or OAuth bearer)");
   console.log("  2) openai              — GPT (API key or OAuth bearer)");
   console.log("  3) gemini              — Google AI Studio (API key or OAuth bearer)");
-  console.log("  4) ollama              — local Ollama (no auth)");
-  console.log("  5) lmstudio            — local LM Studio (OpenAI-compatible)");
-  console.log("  6) openai-compatible   — custom OpenAI-compatible (vLLM, llama-cpp-server, ...)");
-  console.log("  7) skip                — keep existing values, just change defaults\n");
-
-  const sel = (await rl.question("Configure which provider? [1-7]: ")).trim();
+  console.log("  4) antigravity         — Google Cloud Code Assist (OAuth)");
+  console.log("  5) kimi                — Kimi / Moonshot (API key or Kimi Code OAuth)");
+  console.log("  6) ollama              — local Ollama (no auth)");
+  console.log("  7) lmstudio            — local LM Studio (OpenAI-compatible)");
+  console.log("  8) openai-compatible   — custom OpenAI-compatible (vLLM, llama-cpp-server, ...)");
+  console.log("  9) skip                — keep existing values, just change defaults\n");
+
+  const sel = (await rl.question("Configure which provider? [1-9]: ")).trim();
   const map: Record<string, ProviderChoice | "skip"> = {
     "1": "anthropic", "2": "openai", "3": "gemini",
-    "4": "ollama",    "5": "lmstudio", "6": "openai-compatible",
-    "7": "skip",
+    "4": "antigravity", "5": "kimi",
+    "6": "ollama",    "7": "lmstudio", "8": "openai-compatible",
+    "9": "skip",
   };
   const choice = map[sel] ?? "skip";
 
@@ -108,7 +113,7 @@ export async function runSetupCommand(): Promise<void> {
   next.providers = next.providers || {};
   next.oauth = next.oauth || {};
 
-  if (choice === "anthropic" || choice === "openai" || choice === "gemini") {
+  if (choice === "anthropic" || choice === "openai" || choice === "gemini" || choice === "antigravity" || choice === "kimi") {
     const authMode = (
       await rl.question("Auth mode: (b)rowser OAuth login, (t)oken paste, or api (k)ey? [b]: ")
     ).trim().toLowerCase();
@@ -223,7 +228,7 @@ export async function runSetupCommand(): Promise<void> {
   rl.close();
 
   // Drop empty oauth/providers to keep config tidy.
-  if (next.oauth && !next.oauth.anthropic && !next.oauth.openai && !next.oauth.gemini) delete next.oauth;
+  if (next.oauth && Object.keys(next.oauth).length === 0) delete next.oauth;
 
   await saveGlobalConfig(next);
   console.log("\n[SUCCESS] Configuration saved to ~/.jeo/config.json");

package/src/util/provider-error.ts

@@ -9,6 +9,8 @@ import { companyLabel } from "../ai/model-catalog";
 import { ProviderHttpError, ProviderStreamError } from "../ai/providers/errors";
 import { AgyCliError } from "../agent/antigravity-cli";
 import { sanitizeForTerminal } from "../tui/components/code-view";
+import { OAUTH_PROVIDERS, API_KEY_ONLY_PROVIDERS } from "../auth/storage";
+import { openaiCompatDef, allCompatNames } from "../ai/providers/openai-compatible-catalog";
 // Re-export: engine.ts and callers import the refusal predicate from here; the
 // definition lives in retry.ts so defaultRetryable can fail fast without a cycle.
 export { isRefusalError } from "./retry";
@@ -72,6 +74,12 @@ function retryAfterMsOf(err: unknown): number | undefined {
   return err instanceof ProviderHttpError ? err.retryAfterMs : undefined;
 }
 
+function authProviderForLabel(label: string): string | undefined {
+  const normalized = label.toLowerCase() === "openai codex" ? "openai" : label.toLowerCase();
+  const matches = (id: string) => id === normalized || companyLabel(id).toLowerCase() === normalized;
+  return OAUTH_PROVIDERS.find(matches) ?? API_KEY_ONLY_PROVIDERS.find(matches) ?? allCompatNames().find(matches);
+}
+
 export function friendlyProviderError(err: unknown): string {
   if (err instanceof AgyCliError) return sanitizeForTerminal(err.message);
   if (err instanceof ConnectionContextError) {
@@ -92,7 +100,10 @@ export function friendlyProviderError(err: unknown): string {
   // Tencent/groq that speak Anthropic's/OpenAI's wire protocol — see
   // `relabelProviderError`); only guess from message text for errors that never
   // carried a `.provider` field (bare Error, a re-wrapped doneReason string, …).
-  const provider = knownErrorProvider(err) ?? (
+  const reportedProvider = knownErrorProvider(err) ?? /^(?:Error:\s*)?([^\r\n]+?) (?:request failed|stream failed|rejected the credential)\b/i.exec(msg)?.[1] ?? /^(?:Error:\s*)?(OpenAI(?: Codex)?|Antigravity|Anthropic|Gemini|Google)\b/i.exec(msg)?.[1];
+  // A raw prefix may contain a secret, not a provider name. Only registry labels
+  // may survive redaction or the round trip through an engine's doneReason.
+  const provider = reportedProvider && authProviderForLabel(reportedProvider) ? reportedProvider : (
     /antigravity/i.test(msg)
       ? "Antigravity"
       : /anthropic/i.test(msg)
@@ -117,8 +128,28 @@ export function friendlyProviderError(err: unknown): string {
       : "";
     return `Rate limited by ${provider} (HTTP 429).${retry} Auto-retry cannot clear this window right now — slow your request rate, wait for the reset, or switch model with /model (a local ollama model never rate-limits).`;
   }
-  if (status === 401 || status === 403 || /\b40[13]\b/.test(msg)) {
-    return `${provider} rejected the credential (HTTP ${status ?? "401/403"}). Run 'jeo auth status', re-login with /provider login <name>, and for Antigravity prefer '/provider login antigravity' (gemini login only works when the Cloud Code Assist backend authorizes that token).`;
+  const credentialStatus = status ?? Number(/\b(401|403)\b/.exec(msg)?.[1]);
+  if (credentialStatus === 401 || credentialStatus === 403) {
+    const authProvider = authProviderForLabel(provider);
+    let hint = "Check the configured credentials with 'jeo setup' or /provider.";
+    if (authProvider === "openai") {
+      hint = "For ChatGPT/Codex, run 'jeo auth login openai' or /provider login openai. For API/custom endpoints, check OPENAI_API_KEY and OPENAI_BASE_URL (config: providers.openai / openaiBaseUrl).";
+    } else if (authProvider === "gemini") {
+      hint = "Check GEMINI_API_KEY. For Google OAuth, select an antigravity/* model and run 'jeo auth login antigravity' or /provider login antigravity.";
+    } else if (authProvider === "antigravity") {
+      hint = "Run 'jeo auth login antigravity' or /provider login antigravity; a Gemini login only works when Cloud Code Assist authorizes that token.";
+    } else if (authProvider === "kimi") {
+      hint = "For Kimi Code, run 'jeo auth login kimi'. For the Moonshot API, check KIMI_API_KEY or set it with /provider key kimi <key>.";
+    } else if (authProvider && !OAUTH_PROVIDERS.some(id => id === authProvider)) {
+      const apiKeyEnv = openaiCompatDef(authProvider)?.apiKeyEnv ?? `${authProvider.toUpperCase()}_API_KEY`;
+      const command = API_KEY_ONLY_PROVIDERS.some(id => id === authProvider)
+        ? ` Set the key with /provider key ${authProvider} <key> or 'jeo auth login ${authProvider} --token <key>'.`
+        : " Update the custom provider's configured credentials.";
+      hint = `Check ${apiKeyEnv} or providers.${authProvider}.${command}`;
+    } else if (authProvider) {
+      hint = `Run 'jeo auth login ${authProvider}' or /provider login ${authProvider}; for API keys, check providers.${authProvider}.`;
+    }
+    return `${provider} rejected the credential (HTTP ${credentialStatus}). Run 'jeo auth status'. ${hint}`;
   }
   // A persistent 5xx (server-side fault on the provider's backend) — `ProviderHttpError`
   // already embeds the numeric status directly in its message ("… failed (HTTP 500) …",