jeo-code 0.12.5 → 0.12.6

package/CHANGELOG.md

@@ -9,6 +9,14 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.6] - 2026-10-17
+_Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls._
+
+### Fixed
+- **OpenAI subscription startup behind a configured proxy** — account-confirmed Codex models keep their OAuth transport instead of sending a keyless request to the OpenAI-compatible endpoint. Cold calls confirm the subscription catalog first; explicit per-call URLs, configured proxy keys, and endpoint-discovered models retain their existing routes. Subscription requests use the direct Codex backend, not the configured proxy.
+- **Provider-specific authentication recovery** — HTTP 401/403 errors name the appropriate login or API-key configuration, omit unrelated Antigravity advice for OpenAI, preserve exact status codes, and no longer treat a structured non-authentication failure as a credential rejection merely because its body mentions 401.
+- **Account-bound subscription catalogs** — distinguish opaque bearer identities without exposing tokens, reject discovery results that finish after an account switch, share concurrent same-account catalog requests, and keep cancellation of one caller from interrupting other callers.
+
 ## [0.12.5] - 2026-10-17
 _Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing._
 
@@ -2579,7 +2587,8 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.11.4...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.6...HEAD
+[0.12.6]: https://github.com/akillness/jeo-code/releases/tag/v0.12.6
 [0.11.4]: https://github.com/akillness/jeo-code/releases/tag/v0.11.4
 [0.11.3]: https://github.com/akillness/jeo-code/releases/tag/v0.11.3
 [0.11.2]: https://github.com/akillness/jeo-code/releases/tag/v0.11.2

package/README.ja.md

@@ -416,10 +416,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -417,10 +417,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -409,10 +409,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -414,10 +414,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 - **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.5",
+  "version": "0.12.6",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-cache.ts

@@ -60,6 +60,21 @@ function cachePath(): string {
   return path.join(cacheDir(), "model-catalog-cache.json");
 }
 
+/** Account-bound catalog identity; opaque manual bearers must not share a scope. */
+export async function openAIOauthAccountScope(credential?: Credential): Promise<string | undefined> {
+  let selected = credential;
+  if (!selected) {
+    const snapshot = await snapshotProvider("openai");
+    if (!snapshot.oauth) return undefined;
+    selected = { kind: "oauth", provider: "openai", token: snapshot.oauth };
+  }
+  if (selected.kind !== "oauth" || selected.provider !== "openai") return undefined;
+  const stored = await getStoredOAuth("openai");
+  const accountId = extractChatgptAccountId(selected.token)
+    || (stored?.access === selected.token ? stored.accountId?.trim() : undefined);
+  return accountId || `token:${createHash("sha256").update(selected.token).digest("hex")}`;
+}
+
 /** Peek at the selected OAuth account without importing or refreshing credentials. */
 export async function antigravityAccountScope(credential?: Credential): Promise<string | undefined> {
   try {
@@ -251,14 +266,7 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
 /** Read + apply in one step. Returns the cache so callers can decide about refreshing. */
 export async function rehydrateLiveModels(): Promise<ModelCacheFile | null> {
   const cache = await readModelCache();
-  let accountId: string | undefined;
-  try {
-    const stored = await getStoredOAuth("openai");
-    const jwtAccountId = stored ? extractChatgptAccountId(stored.access) : undefined;
-    accountId = jwtAccountId || stored?.accountId;
-  } catch {
-    accountId = undefined;
-  }
+  const accountId = await openAIOauthAccountScope();
   const antigravityAccountId = await antigravityAccountScope();
   setOpenAIOauthAccountScope(accountId);
   setAntigravityAccountScope(antigravityAccountId);

package/src/ai/model-catalog.ts

@@ -255,12 +255,17 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
 }
 
 /** A confirmed account catalog is authoritative; use the snapshot before discovery. */
-export function isCodexModel(model: string): boolean {
+export function isCodexModel(model: string, accountId = activeOpenAIOauthScope): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  const confirmed = liveCodexModels.get(activeOpenAIOauthScope);
+  const confirmed = liveCodexModels.get(oauthScope(accountId));
   return confirmed ? confirmed.has(wire) : CODEX_MODELS.includes(wire);
 }
 
+/** Whether discovery (including a restored account cache) established a Codex catalog. */
+export function hasConfirmedCodexCatalog(accountId = activeOpenAIOauthScope): boolean {
+  return liveCodexModels.has(oauthScope(accountId));
+}
+
 /** Test-only reset for live Codex observations and the active account scope. */
 export function resetLiveCodexModels(): void {
   liveCodexModels.clear();

package/src/ai/model-discovery.ts

@@ -24,7 +24,7 @@ import {
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { getStoredOAuth } from "../auth/storage";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
-import { antigravityAccountScope } from "./model-cache";
+import { antigravityAccountScope, openAIOauthAccountScope } from "./model-cache";
 import { getAntigravityUserAgent, resolveAntigravityProjectId } from "./providers/antigravity";
 import { discoverGoogleProjectId, ANTIGRAVITY_DISCOVERY_METADATA } from "../auth/flows/google-project";
 import { getKimiCommonHeaders } from "../auth/flows/kimi";
@@ -412,6 +412,7 @@ export async function listProviderModels(
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
+  let oauthCatalogScope: string | undefined;
   let source: ProviderModelsResult["source"] = "keyless";
   if (provider === "xai") {
     // xAI (Grok) is API-key only and not an OAuth AuthProvider: resolve its key
@@ -466,8 +467,9 @@ export async function listProviderModels(
     if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
       const stored = await getStoredOAuth("openai").catch(() => undefined);
       const jwtAccountId = extractChatgptAccountId(cred.token);
-      oauthAccountId = jwtAccountId || stored?.accountId;
-      setOpenAIOauthAccountScope(oauthAccountId);
+      oauthAccountId = jwtAccountId || (stored?.access === cred.token ? stored.accountId : undefined);
+      oauthCatalogScope = await openAIOauthAccountScope(cred);
+      setOpenAIOauthAccountScope(oauthCatalogScope);
     }
     // Gemini models are exposed ONLY under API-key auth: a gemini OAuth token can
     // still list models from generativelanguage.googleapis.com, but it can no
@@ -484,7 +486,7 @@ export async function listProviderModels(
     }
   }
 
-  const scope = { ...(oauthAccountId ? { accountId: oauthAccountId } : {}), ...(baseUrl ? { baseUrl } : {}) };
+  const scope = { ...(oauthCatalogScope ? { accountId: oauthCatalogScope } : {}), ...(baseUrl ? { baseUrl } : {}) };
   const timeout = opts.timeoutMs ?? DEFAULT_TIMEOUT;
   let signal = opts.signal ? AbortSignal.any([opts.signal, AbortSignal.timeout(timeout)]) : AbortSignal.timeout(timeout);
   let initialAntigravityScope: string | undefined;
@@ -578,6 +580,12 @@ export async function listProviderModels(
     }
     const allModels = [...new Set(ids)].sort();
     const models = allModels.slice(0, limit);
+    if (provider === "openai" && source === "oauth" && !baseUrl) {
+      if (await openAIOauthAccountScope() !== oauthCatalogScope) {
+        return { provider, models: [], ok: false, source, error: "account changed during model discovery", ...scope };
+      }
+      setOpenAIOauthAccountScope(oauthCatalogScope);
+    }
     if (provider === "antigravity") {
       const currentScope = await antigravityAccountScope();
       if (currentScope !== scope.accountId && currentScope !== initialAntigravityScope) {
@@ -594,7 +602,7 @@ export async function listProviderModels(
       replace: provider === "openai" || provider === "antigravity",
       ...(source === "oauth" && scope.accountId ? { accountId: scope.accountId } : {}),
     });
-    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthAccountId);
+    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthCatalogScope);
     if (provider === "kimi" && source === "oauth") recordLiveKimiCodeModels(allModels);
     return {
       provider,

package/src/ai/model-manager.ts

@@ -6,12 +6,15 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor, BUILTIN_ALIASES } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel, isKimiCodeModel, findLiveCatalogModel } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel, isKimiCodeModel, findLiveCatalogModel, hasConfirmedCodexCatalog, isLiveProviderModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { allCompatNames, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
 import { withRetry, defaultRetryable, withConnectionContext, isConnectionError, ConnectionContextError, type RetryOptions } from "../util/retry";
 import { jeoEnv } from "../util/env";
 import type { Config } from "../agent/state";
+import { listProviderModels } from "./model-discovery";
+import type { ProviderModelsResult } from "./model-discovery";
+import { openAIOauthAccountScope } from "./model-cache";
 
 
 
@@ -404,6 +407,8 @@ interface Resolved {
   baseUrl: string | undefined;
 }
 
+const codexCatalogInFlight = new Map<string, Promise<ProviderModelsResult>>();
+
 /**
  * The credential to actually use for a provider call. A configured local OpenAI-compatible base
  * URL must use the standard /chat/completions path, but the openai adapter dispatches on
@@ -436,7 +441,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   }
   const adapter = providerRegistry.get(provider)!;
 
-  const baseUrl =
+  let baseUrl =
     options.baseUrl ??
     (provider === "openai" ? config.openaiBaseUrl : undefined) ??
     (provider === "ollama" ? config.ollamaBaseUrl : undefined) ??
@@ -503,6 +508,47 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   const credentialProvider = provider as AuthProvider;
   const credential = await resolveCredential(credentialProvider);
   const effective = effectiveCredentialForProvider(credentialProvider, credential, config, model);
+  // A subscription catalog is independent of a configured OpenAI-compatible
+  // endpoint. Keep its OAuth transport rather than replacing it with "no-key".
+  // Explicit endpoint overrides, proxy keys and endpoint-discovered models win.
+  if (provider === "openai" && baseUrl && options.baseUrl === undefined
+    && effective.kind === "oauth" && !config.providers.openai
+    && !isLiveProviderModel("openai", model, { openaiBaseUrl: baseUrl })) {
+    options.signal?.throwIfAborted();
+    const accountScope = await openAIOauthAccountScope(effective);
+    if (accountScope && !hasConfirmedCodexCatalog(accountScope)) {
+      let discovery = codexCatalogInFlight.get(accountScope);
+      if (!discovery) {
+        // One caller's cancellation must not cancel another agent's catalog read.
+        discovery = listProviderModels("openai", { config, codexCatalog: true });
+        codexCatalogInFlight.set(accountScope, discovery);
+        void discovery.finally(() => codexCatalogInFlight.delete(accountScope)).catch(() => {});
+      }
+      const signal = options.signal;
+      if (signal) {
+        const aborted = Promise.withResolvers<never>();
+        const onAbort = () => aborted.reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        try {
+          signal.throwIfAborted();
+          await Promise.race([discovery, aborted.promise]);
+        } finally {
+          signal.removeEventListener("abort", onAbort);
+        }
+      } else {
+        await discovery;
+      }
+    }
+    options.signal?.throwIfAborted();
+    if (await openAIOauthAccountScope() !== accountScope) {
+      throw new Error("OpenAI credential changed during model discovery; retry the request.");
+    }
+    // Never infer cloud eligibility from the bundled snapshot when discovery fails.
+    if (accountScope && hasConfirmedCodexCatalog(accountScope) && isCodexModel(model, accountScope)) {
+      baseUrl = undefined;
+      callOptions.baseUrl = undefined;
+    }
+  }
   const isLocalOpenAi = provider === "openai" && !!baseUrl;
   if (provider === "openai" && effective.kind === "oauth" && !isLocalOpenAi && !oauthServesModel("openai", model)) {
     throw new Error(

package/src/util/provider-error.ts

@@ -9,6 +9,8 @@ import { companyLabel } from "../ai/model-catalog";
 import { ProviderHttpError, ProviderStreamError } from "../ai/providers/errors";
 import { AgyCliError } from "../agent/antigravity-cli";
 import { sanitizeForTerminal } from "../tui/components/code-view";
+import { OAUTH_PROVIDERS, API_KEY_ONLY_PROVIDERS } from "../auth/storage";
+import { openaiCompatDef, allCompatNames } from "../ai/providers/openai-compatible-catalog";
 // Re-export: engine.ts and callers import the refusal predicate from here; the
 // definition lives in retry.ts so defaultRetryable can fail fast without a cycle.
 export { isRefusalError } from "./retry";
@@ -72,6 +74,12 @@ function retryAfterMsOf(err: unknown): number | undefined {
   return err instanceof ProviderHttpError ? err.retryAfterMs : undefined;
 }
 
+function authProviderForLabel(label: string): string | undefined {
+  const normalized = label.toLowerCase() === "openai codex" ? "openai" : label.toLowerCase();
+  const matches = (id: string) => id === normalized || companyLabel(id).toLowerCase() === normalized;
+  return OAUTH_PROVIDERS.find(matches) ?? API_KEY_ONLY_PROVIDERS.find(matches) ?? allCompatNames().find(matches);
+}
+
 export function friendlyProviderError(err: unknown): string {
   if (err instanceof AgyCliError) return sanitizeForTerminal(err.message);
   if (err instanceof ConnectionContextError) {
@@ -92,7 +100,10 @@ export function friendlyProviderError(err: unknown): string {
   // Tencent/groq that speak Anthropic's/OpenAI's wire protocol — see
   // `relabelProviderError`); only guess from message text for errors that never
   // carried a `.provider` field (bare Error, a re-wrapped doneReason string, …).
-  const provider = knownErrorProvider(err) ?? (
+  const reportedProvider = knownErrorProvider(err) ?? /^(?:Error:\s*)?([^\r\n]+?) (?:request failed|stream failed|rejected the credential)\b/i.exec(msg)?.[1] ?? /^(?:Error:\s*)?(OpenAI(?: Codex)?|Antigravity|Anthropic|Gemini|Google)\b/i.exec(msg)?.[1];
+  // A raw prefix may contain a secret, not a provider name. Only registry labels
+  // may survive redaction or the round trip through an engine's doneReason.
+  const provider = reportedProvider && authProviderForLabel(reportedProvider) ? reportedProvider : (
     /antigravity/i.test(msg)
       ? "Antigravity"
       : /anthropic/i.test(msg)
@@ -117,8 +128,28 @@ export function friendlyProviderError(err: unknown): string {
       : "";
     return `Rate limited by ${provider} (HTTP 429).${retry} Auto-retry cannot clear this window right now — slow your request rate, wait for the reset, or switch model with /model (a local ollama model never rate-limits).`;
   }
-  if (status === 401 || status === 403 || /\b40[13]\b/.test(msg)) {
-    return `${provider} rejected the credential (HTTP ${status ?? "401/403"}). Run 'jeo auth status', re-login with /provider login <name>, and for Antigravity prefer '/provider login antigravity' (gemini login only works when the Cloud Code Assist backend authorizes that token).`;
+  const credentialStatus = status ?? Number(/\b(401|403)\b/.exec(msg)?.[1]);
+  if (credentialStatus === 401 || credentialStatus === 403) {
+    const authProvider = authProviderForLabel(provider);
+    let hint = "Check the configured credentials with 'jeo setup' or /provider.";
+    if (authProvider === "openai") {
+      hint = "For ChatGPT/Codex, run 'jeo auth login openai' or /provider login openai. For API/custom endpoints, check OPENAI_API_KEY and OPENAI_BASE_URL (config: providers.openai / openaiBaseUrl).";
+    } else if (authProvider === "gemini") {
+      hint = "Check GEMINI_API_KEY. For Google OAuth, select an antigravity/* model and run 'jeo auth login antigravity' or /provider login antigravity.";
+    } else if (authProvider === "antigravity") {
+      hint = "Run 'jeo auth login antigravity' or /provider login antigravity; a Gemini login only works when Cloud Code Assist authorizes that token.";
+    } else if (authProvider === "kimi") {
+      hint = "For Kimi Code, run 'jeo auth login kimi'. For the Moonshot API, check KIMI_API_KEY or set it with /provider key kimi <key>.";
+    } else if (authProvider && !OAUTH_PROVIDERS.some(id => id === authProvider)) {
+      const apiKeyEnv = openaiCompatDef(authProvider)?.apiKeyEnv ?? `${authProvider.toUpperCase()}_API_KEY`;
+      const command = API_KEY_ONLY_PROVIDERS.some(id => id === authProvider)
+        ? ` Set the key with /provider key ${authProvider} <key> or 'jeo auth login ${authProvider} --token <key>'.`
+        : " Update the custom provider's configured credentials.";
+      hint = `Check ${apiKeyEnv} or providers.${authProvider}.${command}`;
+    } else if (authProvider) {
+      hint = `Run 'jeo auth login ${authProvider}' or /provider login ${authProvider}; for API keys, check providers.${authProvider}.`;
+    }
+    return `${provider} rejected the credential (HTTP ${credentialStatus}). Run 'jeo auth status'. ${hint}`;
   }
   // A persistent 5xx (server-side fault on the provider's backend) — `ProviderHttpError`
   // already embeds the numeric status directly in its message ("… failed (HTTP 500) …",