jeo-code 0.12.5 → 0.12.7

package/CHANGELOG.md

@@ -9,6 +9,25 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.7] - 2026-10-18
+_Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization._
+
+### Fixed
+- **Screenshot vision feedback** — carry PNG attachments through tool execution, batches, and native Anthropic/OpenAI Responses replay instead of spilling base64 as text. Preserve CLI screenshot base64 stdout.
+- **Desktop input** — use Quartz scroll events on macOS (cliclick `w:` waits rather than scrolling), release the mouse after dragging on macOS/Linux, normalize macOS key aliases/modifier combinations, and terminate Linux text options before user text.
+- **Execution reliability** — drain subprocess pipes concurrently with exit, use collision-resistant screenshot paths, reject non-finite numeric inputs and out-of-range waits/scrolls, and explicitly reject unsupported platforms. Existing enablement/supervisor gates remain unchanged.
+
+### Documentation
+- Added [desktop setup and troubleshooting](docs/computer-use.md), including platform requirements, OS permissions, coordinate caveats, and supported action semantics.
+
+## [0.12.6] - 2026-10-17
+_Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls._
+
+### Fixed
+- **OpenAI subscription startup behind a configured proxy** — account-confirmed Codex models keep their OAuth transport instead of sending a keyless request to the OpenAI-compatible endpoint. Cold calls confirm the subscription catalog first; explicit per-call URLs, configured proxy keys, and endpoint-discovered models retain their existing routes. Subscription requests use the direct Codex backend, not the configured proxy.
+- **Provider-specific authentication recovery** — HTTP 401/403 errors name the appropriate login or API-key configuration, omit unrelated Antigravity advice for OpenAI, preserve exact status codes, and no longer treat a structured non-authentication failure as a credential rejection merely because its body mentions 401.
+- **Account-bound subscription catalogs** — distinguish opaque bearer identities without exposing tokens, reject discovery results that finish after an account switch, share concurrent same-account catalog requests, and keep cancellation of one caller from interrupting other callers.
+
 ## [0.12.5] - 2026-10-17
 _Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing._
 
@@ -2579,7 +2598,8 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.11.4...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.6...HEAD
+[0.12.6]: https://github.com/akillness/jeo-code/releases/tag/v0.12.6
 [0.11.4]: https://github.com/akillness/jeo-code/releases/tag/v0.11.4
 [0.11.3]: https://github.com/akillness/jeo-code/releases/tag/v0.11.3
 [0.11.2]: https://github.com/akillness/jeo-code/releases/tag/v0.11.2

package/README.ja.md

@@ -416,10 +416,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
-- **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -417,10 +417,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
-- **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -409,10 +409,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
-- **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -414,10 +414,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
+- **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 - **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
-- **[0.12.3]** (2026-10-17) — Anthropic static model catalog trimmed to claude-5.x with live API discovery, and `/route off` strictly fixes the active model with no failover.
-- **[0.12.2]** (2026-10-16) — Select Argon through the official agy full agent, with its own live catalog and session, separately from jeo's Cloud Code Assist backend.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/engine.ts

@@ -1215,6 +1215,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       const { tool, arguments: args } = call;
       let success: boolean;
       let output: string;
+      let images: import("../ai/types").ImageAttachment[] | undefined;
 
       if (tool === "done") {
         success = false;
@@ -1242,6 +1243,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
               const onProgress = ev.onToolProgress ? (partial: string) => ev.onToolProgress!(tool, partial) : undefined;
               const res = await handler(args ?? {}, cwd, onProgress);
               success = res.success;
+              images = res.images;
               output = res.success ? res.output : (res.error ? (res.output ? `${res.error}\n${res.output}` : res.error) : res.output);
             } catch (err: any) {
               success = false;
@@ -1250,7 +1252,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           }
         }
       }
-      return { success, output };
+      return { success, output, images };
     };
 
     const WRITE_TOOLS = new Set(["write", "edit"]);
@@ -1293,7 +1295,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       }
     }
 
-    const results: { success: boolean; output: string; executed: boolean }[] = Array.from(
+    const results: { success: boolean; output: string; executed: boolean; images?: import("../ai/types").ImageAttachment[] }[] = Array.from(
       { length: toolCalls.length },
       () => ({ success: false, output: "", executed: false })
     );
@@ -1385,6 +1387,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       }));
       pushAssistantTurn(history, responseText, reasonBuf, artifactBuf, toolUse);
       const resultMsg: Message = { role: "user", content: resultBlocks.join("\n\n"), toolResults };
+      const images = indices.flatMap(idx => results[idx].images ?? []);
+      if (images.length) resultMsg.images = images;
       if (hookExtra) resultMsg.toolResultExtra = hookExtra;
       history.push(resultMsg);
     };

package/src/agent/tools.ts

@@ -22,6 +22,7 @@ async function readMutationLock(cwd: string): Promise<WorkflowState | null> {
 }
 
 export interface ToolResult {
+  images?: import("../ai/types").ImageAttachment[];
   success: boolean;
   output: string;
   error?: string;

package/src/ai/model-cache.ts

@@ -60,6 +60,21 @@ function cachePath(): string {
   return path.join(cacheDir(), "model-catalog-cache.json");
 }
 
+/** Account-bound catalog identity; opaque manual bearers must not share a scope. */
+export async function openAIOauthAccountScope(credential?: Credential): Promise<string | undefined> {
+  let selected = credential;
+  if (!selected) {
+    const snapshot = await snapshotProvider("openai");
+    if (!snapshot.oauth) return undefined;
+    selected = { kind: "oauth", provider: "openai", token: snapshot.oauth };
+  }
+  if (selected.kind !== "oauth" || selected.provider !== "openai") return undefined;
+  const stored = await getStoredOAuth("openai");
+  const accountId = extractChatgptAccountId(selected.token)
+    || (stored?.access === selected.token ? stored.accountId?.trim() : undefined);
+  return accountId || `token:${createHash("sha256").update(selected.token).digest("hex")}`;
+}
+
 /** Peek at the selected OAuth account without importing or refreshing credentials. */
 export async function antigravityAccountScope(credential?: Credential): Promise<string | undefined> {
   try {
@@ -251,14 +266,7 @@ export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccou
 /** Read + apply in one step. Returns the cache so callers can decide about refreshing. */
 export async function rehydrateLiveModels(): Promise<ModelCacheFile | null> {
   const cache = await readModelCache();
-  let accountId: string | undefined;
-  try {
-    const stored = await getStoredOAuth("openai");
-    const jwtAccountId = stored ? extractChatgptAccountId(stored.access) : undefined;
-    accountId = jwtAccountId || stored?.accountId;
-  } catch {
-    accountId = undefined;
-  }
+  const accountId = await openAIOauthAccountScope();
   const antigravityAccountId = await antigravityAccountScope();
   setOpenAIOauthAccountScope(accountId);
   setAntigravityAccountScope(antigravityAccountId);

package/src/ai/model-catalog.ts

@@ -255,12 +255,17 @@ export function recordLiveCodexModels(ids: readonly string[], accountId?: string
 }
 
 /** A confirmed account catalog is authoritative; use the snapshot before discovery. */
-export function isCodexModel(model: string): boolean {
+export function isCodexModel(model: string, accountId = activeOpenAIOauthScope): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  const confirmed = liveCodexModels.get(activeOpenAIOauthScope);
+  const confirmed = liveCodexModels.get(oauthScope(accountId));
   return confirmed ? confirmed.has(wire) : CODEX_MODELS.includes(wire);
 }
 
+/** Whether discovery (including a restored account cache) established a Codex catalog. */
+export function hasConfirmedCodexCatalog(accountId = activeOpenAIOauthScope): boolean {
+  return liveCodexModels.has(oauthScope(accountId));
+}
+
 /** Test-only reset for live Codex observations and the active account scope. */
 export function resetLiveCodexModels(): void {
   liveCodexModels.clear();

package/src/ai/model-discovery.ts

@@ -24,7 +24,7 @@ import {
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { getStoredOAuth } from "../auth/storage";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
-import { antigravityAccountScope } from "./model-cache";
+import { antigravityAccountScope, openAIOauthAccountScope } from "./model-cache";
 import { getAntigravityUserAgent, resolveAntigravityProjectId } from "./providers/antigravity";
 import { discoverGoogleProjectId, ANTIGRAVITY_DISCOVERY_METADATA } from "../auth/flows/google-project";
 import { getKimiCommonHeaders } from "../auth/flows/kimi";
@@ -412,6 +412,7 @@ export async function listProviderModels(
 
   let cred: Credential | undefined;
   let oauthAccountId: string | undefined;
+  let oauthCatalogScope: string | undefined;
   let source: ProviderModelsResult["source"] = "keyless";
   if (provider === "xai") {
     // xAI (Grok) is API-key only and not an OAuth AuthProvider: resolve its key
@@ -466,8 +467,9 @@ export async function listProviderModels(
     if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
       const stored = await getStoredOAuth("openai").catch(() => undefined);
       const jwtAccountId = extractChatgptAccountId(cred.token);
-      oauthAccountId = jwtAccountId || stored?.accountId;
-      setOpenAIOauthAccountScope(oauthAccountId);
+      oauthAccountId = jwtAccountId || (stored?.access === cred.token ? stored.accountId : undefined);
+      oauthCatalogScope = await openAIOauthAccountScope(cred);
+      setOpenAIOauthAccountScope(oauthCatalogScope);
     }
     // Gemini models are exposed ONLY under API-key auth: a gemini OAuth token can
     // still list models from generativelanguage.googleapis.com, but it can no
@@ -484,7 +486,7 @@ export async function listProviderModels(
     }
   }
 
-  const scope = { ...(oauthAccountId ? { accountId: oauthAccountId } : {}), ...(baseUrl ? { baseUrl } : {}) };
+  const scope = { ...(oauthCatalogScope ? { accountId: oauthCatalogScope } : {}), ...(baseUrl ? { baseUrl } : {}) };
   const timeout = opts.timeoutMs ?? DEFAULT_TIMEOUT;
   let signal = opts.signal ? AbortSignal.any([opts.signal, AbortSignal.timeout(timeout)]) : AbortSignal.timeout(timeout);
   let initialAntigravityScope: string | undefined;
@@ -578,6 +580,12 @@ export async function listProviderModels(
     }
     const allModels = [...new Set(ids)].sort();
     const models = allModels.slice(0, limit);
+    if (provider === "openai" && source === "oauth" && !baseUrl) {
+      if (await openAIOauthAccountScope() !== oauthCatalogScope) {
+        return { provider, models: [], ok: false, source, error: "account changed during model discovery", ...scope };
+      }
+      setOpenAIOauthAccountScope(oauthCatalogScope);
+    }
     if (provider === "antigravity") {
       const currentScope = await antigravityAccountScope();
       if (currentScope !== scope.accountId && currentScope !== initialAntigravityScope) {
@@ -594,7 +602,7 @@ export async function listProviderModels(
       replace: provider === "openai" || provider === "antigravity",
       ...(source === "oauth" && scope.accountId ? { accountId: scope.accountId } : {}),
     });
-    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthAccountId);
+    if (provider === "openai" && source === "oauth" && !baseUrl) recordLiveCodexModels(allModels, oauthCatalogScope);
     if (provider === "kimi" && source === "oauth") recordLiveKimiCodeModels(allModels);
     return {
       provider,

package/src/ai/model-manager.ts

@@ -6,12 +6,15 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor, BUILTIN_ALIASES } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel, isKimiCodeModel, findLiveCatalogModel } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel, isKimiCodeModel, findLiveCatalogModel, hasConfirmedCodexCatalog, isLiveProviderModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { allCompatNames, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
 import { withRetry, defaultRetryable, withConnectionContext, isConnectionError, ConnectionContextError, type RetryOptions } from "../util/retry";
 import { jeoEnv } from "../util/env";
 import type { Config } from "../agent/state";
+import { listProviderModels } from "./model-discovery";
+import type { ProviderModelsResult } from "./model-discovery";
+import { openAIOauthAccountScope } from "./model-cache";
 
 
 
@@ -404,6 +407,8 @@ interface Resolved {
   baseUrl: string | undefined;
 }
 
+const codexCatalogInFlight = new Map<string, Promise<ProviderModelsResult>>();
+
 /**
  * The credential to actually use for a provider call. A configured local OpenAI-compatible base
  * URL must use the standard /chat/completions path, but the openai adapter dispatches on
@@ -436,7 +441,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   }
   const adapter = providerRegistry.get(provider)!;
 
-  const baseUrl =
+  let baseUrl =
     options.baseUrl ??
     (provider === "openai" ? config.openaiBaseUrl : undefined) ??
     (provider === "ollama" ? config.ollamaBaseUrl : undefined) ??
@@ -503,6 +508,47 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   const credentialProvider = provider as AuthProvider;
   const credential = await resolveCredential(credentialProvider);
   const effective = effectiveCredentialForProvider(credentialProvider, credential, config, model);
+  // A subscription catalog is independent of a configured OpenAI-compatible
+  // endpoint. Keep its OAuth transport rather than replacing it with "no-key".
+  // Explicit endpoint overrides, proxy keys and endpoint-discovered models win.
+  if (provider === "openai" && baseUrl && options.baseUrl === undefined
+    && effective.kind === "oauth" && !config.providers.openai
+    && !isLiveProviderModel("openai", model, { openaiBaseUrl: baseUrl })) {
+    options.signal?.throwIfAborted();
+    const accountScope = await openAIOauthAccountScope(effective);
+    if (accountScope && !hasConfirmedCodexCatalog(accountScope)) {
+      let discovery = codexCatalogInFlight.get(accountScope);
+      if (!discovery) {
+        // One caller's cancellation must not cancel another agent's catalog read.
+        discovery = listProviderModels("openai", { config, codexCatalog: true });
+        codexCatalogInFlight.set(accountScope, discovery);
+        void discovery.finally(() => codexCatalogInFlight.delete(accountScope)).catch(() => {});
+      }
+      const signal = options.signal;
+      if (signal) {
+        const aborted = Promise.withResolvers<never>();
+        const onAbort = () => aborted.reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        try {
+          signal.throwIfAborted();
+          await Promise.race([discovery, aborted.promise]);
+        } finally {
+          signal.removeEventListener("abort", onAbort);
+        }
+      } else {
+        await discovery;
+      }
+    }
+    options.signal?.throwIfAborted();
+    if (await openAIOauthAccountScope() !== accountScope) {
+      throw new Error("OpenAI credential changed during model discovery; retry the request.");
+    }
+    // Never infer cloud eligibility from the bundled snapshot when discovery fails.
+    if (accountScope && hasConfirmedCodexCatalog(accountScope) && isCodexModel(model, accountScope)) {
+      baseUrl = undefined;
+      callOptions.baseUrl = undefined;
+    }
+  }
   const isLocalOpenAi = provider === "openai" && !!baseUrl;
   if (provider === "openai" && effective.kind === "oauth" && !isLocalOpenAi && !oauthServesModel("openai", model)) {
     throw new Error(

package/src/ai/providers/anthropic.ts

@@ -240,6 +240,7 @@ export function buildAnthropicMessages(messages: Message[], model: string, think
       const blocks: AnthropicContentBlock[] = m.toolResults.map(tr => ({
         type: "tool_result", tool_use_id: tr.id, content: tr.output, is_error: tr.isError,
       }));
+      for (const img of m.images ?? []) blocks.push({ type: "image", source: { type: "base64", media_type: img.mediaType, data: img.data } });
       if (m.toolResultExtra) blocks.push({ type: "text", text: m.toolResultExtra });
       return { role: "user", content: blocks };
     }

package/src/ai/providers/openai-responses.ts

@@ -87,6 +87,7 @@ export function buildResponsesInput(messages: Message[], modelKey: string, strip
         && nonSystem[i - 1].role === "assistant" && responsesNativizable(nonSystem[i - 1], modelKey)) {
       for (const tr of m.toolResults) items.push({ type: "function_call_output", call_id: tr.id, output: tr.output });
       if (m.toolResultExtra) items.push({ role: "user", content: [{ type: "input_text", text: m.toolResultExtra }] });
+      if (m.images?.length) items.push({ role: "user", content: m.images.map(img => ({ type: "input_image", image_url: `data:${img.mediaType};base64,${img.data}` })) });
       return;
     }
     items.push(plain(m));

package/src/commands/computer.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
 import { computerSupervisor } from "../agent/computer-supervisor";
+import type { ImageAttachment } from "../ai/types";
 import { readGlobalConfig } from "../agent/state";
 
 export interface ComputerAction {
@@ -36,9 +37,11 @@ async function logAudit(action: ComputerAction, success: boolean, error?: string
 async function runCommand(cmd: string[]): Promise<{ success: boolean; stdout: string; stderr: string }> {
   try {
     const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
-    await proc.exited;
-    const stdout = await new Response(proc.stdout).text();
-    const stderr = await new Response(proc.stderr).text();
+    const [stdout, stderr] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ]);
     return {
       success: proc.exitCode === 0,
       stdout,
@@ -53,7 +56,7 @@ async function runCommand(cmd: string[]): Promise<{ success: boolean; stdout: st
   }
 }
 
-export async function executeComputerAction(action: ComputerAction, opts?: { enabledOverride?: boolean }): Promise<{ success: boolean; output: string; error?: string }> {
+export async function executeComputerAction(action: ComputerAction, opts?: { enabledOverride?: boolean }): Promise<{ success: boolean; output: string; error?: string; images?: ImageAttachment[] }> {
   let enabled = opts?.enabledOverride;
   if (enabled === undefined) {
     const config = await readGlobalConfig().catch(() => null);
@@ -68,6 +71,18 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
   }
 
 
+  if (!action || typeof action !== "object") return { success: false, output: "", error: "Expected a computer action object." };
+  for (const field of ["x", "y", "deltaX", "deltaY", "duration"] as const) {
+    if (action[field] !== undefined && (typeof action[field] !== "number" || !Number.isFinite(action[field]))) {
+      return { success: false, output: "", error: `Invalid finite number for ${field}.` };
+    }
+  }
+  if (action.duration !== undefined && (action.duration < 0 || action.duration > 60)) {
+    return { success: false, output: "", error: "duration must be between 0 and 60 seconds." };
+  }
+  if (os.platform() !== "darwin" && os.platform() !== "linux") {
+    return { success: false, output: "", error: "Computer use supports macOS and Linux/X11 only." };
+  }
   // Read-only actions don't need supervisor inputAllowed check
   const isReadOnly = action.action === "screenshot" || action.action === "wait";
   if (!isReadOnly) {
@@ -83,7 +98,7 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
   switch (action.action) {
     case "screenshot": {
       const tmpDir = os.tmpdir();
-      const screenPath = path.join(tmpDir, `jeo-screen-${Date.now()}.png`);
+      const screenPath = path.join(tmpDir, `jeo-screen-${crypto.randomUUID()}.png`);
       let cmd: string[];
       if (isMac) {
         cmd = ["screencapture", "-x", screenPath];
@@ -100,7 +115,7 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
         const base64 = bytes.toString("base64");
         await fs.unlink(screenPath).catch(() => {});
         await logAudit(action, true);
-        return { success: true, output: base64 };
+        return { success: true, output: "Screenshot captured.", images: [{ mediaType: "image/png", data: base64 }] };
       } catch (err: any) {
         await logAudit(action, false, err.message);
         return { success: false, output: "", error: `Failed to read screenshot file: ${err.message}` };
@@ -164,9 +179,9 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
       }
       let cmd: string[];
       if (isMac) {
-        cmd = ["cliclick", `dd:${action.x},${action.y}`];
+        cmd = ["cliclick", "dd:.", `dm:${action.x},${action.y}`, `du:${action.x},${action.y}`];
       } else {
-        cmd = ["xdotool", "mousemove", String(action.x), String(action.y), "mousedown", "1"];
+        cmd = ["xdotool", "mousedown", "1", "mousemove", String(action.x), String(action.y), "mouseup", "1"];
       }
       const res = await runCommand(cmd);
       await logAudit(action, res.success, res.success ? undefined : res.stderr);
@@ -179,9 +194,14 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
       let cmd: string[];
       const dx = action.deltaX ?? 0;
       const dy = action.deltaY ?? 0;
+      if (!Number.isInteger(dx) || !Number.isInteger(dy) || Math.abs(dx) > 1000 || Math.abs(dy) > 1000) {
+        return { success: false, output: "", error: "Scroll deltas must be integers between -1000 and 1000." };
+      }
+      if (dx === 0 && dy === 0) return { success: true, output: "Scroll skipped (zero deltas)." };
       if (isMac) {
-        // cliclick scroll deltaY deltaX
-        cmd = ["cliclick", `w:${dy},${dx}`];
+        // cliclick's w: command WAITS; it cannot scroll. Use Quartz line events.
+        cmd = ["/usr/bin/osascript", "-l", "JavaScript", "-e",
+          `ObjC.import('Cocoa'); var event = $.CGEventCreateScrollWheelEvent(null, 1, 2, ${dy}, ${dx}); $.CGEventPost(0, event);`];
       } else {
         // xdotool click 4 (scroll up), 5 (scroll down), 6 (scroll left), 7 (scroll right)
         const actions: string[] = [];
@@ -212,7 +232,7 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
       if (isMac) {
         cmd = ["cliclick", `t:${action.text}`];
       } else {
-        cmd = ["xdotool", "type", action.text];
+        cmd = ["xdotool", "type", "--clearmodifiers", "--", action.text];
       }
       const res = await runCommand(cmd);
       await logAudit(action, res.success, res.success ? undefined : res.stderr);
@@ -227,7 +247,16 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
       }
       let cmd: string[];
       if (isMac) {
-        cmd = ["cliclick", `kp:${action.key}`];
+        const aliases: Record<string, string> = { return: "return", enter: "return", escape: "esc", backspace: "delete", arrowup: "arrow-up", arrowdown: "arrow-down", arrowleft: "arrow-left", arrowright: "arrow-right", pageup: "page-up", pagedown: "page-down" };
+        const parts = action.key.toLowerCase().split("+");
+        const key = parts.pop()!;
+        const modifiers = parts.map(p => ({ command: "cmd", meta: "cmd", control: "ctrl", option: "alt" }[p] ?? p));
+        if (modifiers.some(p => !["cmd", "ctrl", "alt", "shift", "fn"].includes(p))) {
+          return { success: false, output: "", error: "Unknown key modifier." };
+        }
+        const press = key.length === 1 ? `t:${key}` : `kp:${aliases[key] ?? key}`;
+        cmd = ["cliclick", ...(modifiers.length ? [`kd:${modifiers.join(",")}`] : []), press,
+          ...(modifiers.length ? [`ku:${modifiers.join(",")}`] : [])];
       } else {
         cmd = ["xdotool", "key", action.key];
       }
@@ -250,6 +279,7 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
         return { success: false, output: "", error: "Missing actions array for batch action." };
       }
       const results: string[] = [];
+      const images: ImageAttachment[] = [];
       for (let i = 0; i < action.actions.length; i++) {
         const subAction = action.actions[i];
         const res = await executeComputerAction(subAction, opts);
@@ -257,12 +287,13 @@ export async function executeComputerAction(action: ComputerAction, opts?: { ena
         if (!res.success) {
           const err = `Batch failed at step ${i}: ${res.error}`;
           await logAudit(action, false, err);
-          return { success: false, output: results.join("\n"), error: err };
+          return { success: false, output: results.join("\n"), error: err, images };
         }
         results.push(`Step ${i}: ${res.output}`);
+        images.push(...(res.images ?? []));
       }
       await logAudit(action, true);
-      return { success: true, output: results.join("\n") };
+      return { success: true, output: results.join("\n"), images };
     }
 
     default:
@@ -329,7 +360,7 @@ export async function runComputerCommand(args: string[]): Promise<void> {
   const res = await executeComputerAction(action);
   if (res.success) {
     if (actionName === "screenshot") {
-      console.log(res.output); // base64 output
+      console.log(res.images?.[0]?.data ?? res.output); // preserve CLI base64 output
     } else {
       console.log(res.output);
     }

package/src/util/provider-error.ts

@@ -9,6 +9,8 @@ import { companyLabel } from "../ai/model-catalog";
 import { ProviderHttpError, ProviderStreamError } from "../ai/providers/errors";
 import { AgyCliError } from "../agent/antigravity-cli";
 import { sanitizeForTerminal } from "../tui/components/code-view";
+import { OAUTH_PROVIDERS, API_KEY_ONLY_PROVIDERS } from "../auth/storage";
+import { openaiCompatDef, allCompatNames } from "../ai/providers/openai-compatible-catalog";
 // Re-export: engine.ts and callers import the refusal predicate from here; the
 // definition lives in retry.ts so defaultRetryable can fail fast without a cycle.
 export { isRefusalError } from "./retry";
@@ -72,6 +74,12 @@ function retryAfterMsOf(err: unknown): number | undefined {
   return err instanceof ProviderHttpError ? err.retryAfterMs : undefined;
 }
 
+function authProviderForLabel(label: string): string | undefined {
+  const normalized = label.toLowerCase() === "openai codex" ? "openai" : label.toLowerCase();
+  const matches = (id: string) => id === normalized || companyLabel(id).toLowerCase() === normalized;
+  return OAUTH_PROVIDERS.find(matches) ?? API_KEY_ONLY_PROVIDERS.find(matches) ?? allCompatNames().find(matches);
+}
+
 export function friendlyProviderError(err: unknown): string {
   if (err instanceof AgyCliError) return sanitizeForTerminal(err.message);
   if (err instanceof ConnectionContextError) {
@@ -92,7 +100,10 @@ export function friendlyProviderError(err: unknown): string {
   // Tencent/groq that speak Anthropic's/OpenAI's wire protocol — see
   // `relabelProviderError`); only guess from message text for errors that never
   // carried a `.provider` field (bare Error, a re-wrapped doneReason string, …).
-  const provider = knownErrorProvider(err) ?? (
+  const reportedProvider = knownErrorProvider(err) ?? /^(?:Error:\s*)?([^\r\n]+?) (?:request failed|stream failed|rejected the credential)\b/i.exec(msg)?.[1] ?? /^(?:Error:\s*)?(OpenAI(?: Codex)?|Antigravity|Anthropic|Gemini|Google)\b/i.exec(msg)?.[1];
+  // A raw prefix may contain a secret, not a provider name. Only registry labels
+  // may survive redaction or the round trip through an engine's doneReason.
+  const provider = reportedProvider && authProviderForLabel(reportedProvider) ? reportedProvider : (
     /antigravity/i.test(msg)
       ? "Antigravity"
       : /anthropic/i.test(msg)
@@ -117,8 +128,28 @@ export function friendlyProviderError(err: unknown): string {
       : "";
     return `Rate limited by ${provider} (HTTP 429).${retry} Auto-retry cannot clear this window right now — slow your request rate, wait for the reset, or switch model with /model (a local ollama model never rate-limits).`;
   }
-  if (status === 401 || status === 403 || /\b40[13]\b/.test(msg)) {
-    return `${provider} rejected the credential (HTTP ${status ?? "401/403"}). Run 'jeo auth status', re-login with /provider login <name>, and for Antigravity prefer '/provider login antigravity' (gemini login only works when the Cloud Code Assist backend authorizes that token).`;
+  const credentialStatus = status ?? Number(/\b(401|403)\b/.exec(msg)?.[1]);
+  if (credentialStatus === 401 || credentialStatus === 403) {
+    const authProvider = authProviderForLabel(provider);
+    let hint = "Check the configured credentials with 'jeo setup' or /provider.";
+    if (authProvider === "openai") {
+      hint = "For ChatGPT/Codex, run 'jeo auth login openai' or /provider login openai. For API/custom endpoints, check OPENAI_API_KEY and OPENAI_BASE_URL (config: providers.openai / openaiBaseUrl).";
+    } else if (authProvider === "gemini") {
+      hint = "Check GEMINI_API_KEY. For Google OAuth, select an antigravity/* model and run 'jeo auth login antigravity' or /provider login antigravity.";
+    } else if (authProvider === "antigravity") {
+      hint = "Run 'jeo auth login antigravity' or /provider login antigravity; a Gemini login only works when Cloud Code Assist authorizes that token.";
+    } else if (authProvider === "kimi") {
+      hint = "For Kimi Code, run 'jeo auth login kimi'. For the Moonshot API, check KIMI_API_KEY or set it with /provider key kimi <key>.";
+    } else if (authProvider && !OAUTH_PROVIDERS.some(id => id === authProvider)) {
+      const apiKeyEnv = openaiCompatDef(authProvider)?.apiKeyEnv ?? `${authProvider.toUpperCase()}_API_KEY`;
+      const command = API_KEY_ONLY_PROVIDERS.some(id => id === authProvider)
+        ? ` Set the key with /provider key ${authProvider} <key> or 'jeo auth login ${authProvider} --token <key>'.`
+        : " Update the custom provider's configured credentials.";
+      hint = `Check ${apiKeyEnv} or providers.${authProvider}.${command}`;
+    } else if (authProvider) {
+      hint = `Run 'jeo auth login ${authProvider}' or /provider login ${authProvider}; for API keys, check providers.${authProvider}.`;
+    }
+    return `${provider} rejected the credential (HTTP ${credentialStatus}). Run 'jeo auth status'. ${hint}`;
   }
   // A persistent 5xx (server-side fault on the provider's backend) — `ProviderHttpError`
   // already embeds the numeric status directly in its message ("… failed (HTTP 500) …",