jeo-code 0.6.39 → 0.6.41

package/CHANGELOG.md

@@ -6,6 +6,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.6.41] - 2026-06-21
+_The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6)._
+
+### Fixed
+- **The non-streaming `call()` path no longer false-aborts a long completion at 120s — it now matches the 300s streaming idle window.** v0.6.40's wire heartbeat only re-armed the streaming watchdog (`manager.stream()`); the non-streaming twin `manager.call()` — taken by every `callLlm` WITHOUT an `onToken` consumer (`compaction`, `ralplan`, `deep-interview`, `memory` distill, `goal-verifier`, and subagent/autopilot engine steps) — kept a hard 120s wall cap, so the exact unattended long-reasoning turns the release meant to protect still aborted, exhausted the attempt budget, and stopped the turn. The cap is now 300s, matching `STREAM_IDLE_TIMEOUT_MS`, via a new env-overridable `callTimeoutMs()` helper (`JEO_CALL_TIMEOUT_MS`) mirroring the existing `streamIdleMs()`. A wire heartbeat can't help here — the path collects an opaque buffered body with no per-chunk signal — so a wall clock is the only correct lever; non-streaming `readSse` sites and `call()`'s buffered reads are deliberately left without an idle watchdog (it would false-abort a healthy opaque read).
+
+### Verified
+- `bun run typecheck` clean; full suite **1756 pass / 0 fail** (216 files), including the new `callTimeoutMs` default + `JEO_CALL_TIMEOUT_MS` override parsing tests in `test/round-b.test.ts`.
+- `scripts/mem-probe.ts` (2000 turns × 40 tools): no long-term leak (per-turn slope **−610 bytes/turn**, exit-listeners flat at 1, heap returns to baseline).
+- `scripts/tmux-verify.sh battery`: **6/6 PASSED** on a fresh `jeo --tmux` boot (boot, `/help`, unknown `$skill`, `/agents`, `$ultragoal`, unresolved `/command`).
+
+## [0.6.40] - 2026-06-21
+_Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn._
+
+### Fixed
+- **A connected-but-quiet stream no longer trips a false `stream idle for <ms>ms (no chunk)` retry — wire-level heartbeat.** The v0.6.39 fix only counted reasoning/thinking deltas as activity, so a model that reasons server-side and streams NO thought tokens (only SSE keepalive/`ping` events, e.g. Anthropic `event: ping`, or events that never become a chunk) still looked stalled and got aborted+retried past the idle window. The SSE reader (`readLines`/`readSse`) now fires an `onStreamActivity` heartbeat on ANY bytes received from the provider — including keepalive comments and events filtered out before becoming a chunk or reasoning delta — threaded through every provider (`anthropic`, `openai`, `openai-responses`, `gemini`, `antigravity`, `ollama`). The idle watchdog re-arms while ANY wire activity advances and aborts only a genuinely dead socket (zero bytes for the idle window).
+- **The default stream-idle window is now 300s (was 120s) so a silent local backend no longer false-aborts and stops the turn.** Root cause of the recurring `stream idle … (no chunk)` halt for local/slow providers: a backend like Ollama / llama.cpp emits ZERO bytes (no keepalive) during model load + prompt-eval before the first token, which on modest hardware or a large context routinely exceeds 120s — the wire heartbeat has nothing to fire on, the watchdog aborts an alive-but-quiet generation, each retry re-incurs the same slow first byte, the attempt budget exhausts, and the turn stops. The cap now only bites a genuinely dead stream after 5 minutes; `JEO_STREAM_IDLE_MS` overrides it and Ctrl-C remains the interactive escape.
+
 ## [0.6.39] - 2026-06-21
 _A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6)._
 

package/README.ja.md

@@ -200,11 +200,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
+- **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.37]** (2026-06-20) — Two dead-end fixes: the boxed prompt's ↑/↓ now recalls input history on a soft-wrapped one-liner (only a genuine multi-line draft gets in-box caret nav), and every terminating Spec-first stage (deep-interview, ralplan, team) now surfaces a user-visible answer instead of silently stalling — re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.36]** (2026-06-20) — When `jeo --tmux` flips the mouse on so you can drag-select, the drag now actually lands on the system clipboard — the in-session tmux profile sets `set-clipboard on` + a local `copy-command` on the CURRENT session only — plus `/help` documents the drag-to-copy and the Shift/Option-drag escape hatch, re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.35]** (2026-06-20) — The prompt's Ctrl+C now clears a non-empty input box on the first press and only exits on the next press of an empty box; plus app-driven system-clipboard copy (OSC 52 + local tool, tmux-aware), drag-and-drop image attachment, a Ctrl-L prompt re-anchor, and a SIGCONT resume repaint — verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot check.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -200,11 +200,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
+- **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.37]** (2026-06-20) — Two dead-end fixes: the boxed prompt's ↑/↓ now recalls input history on a soft-wrapped one-liner (only a genuine multi-line draft gets in-box caret nav), and every terminating Spec-first stage (deep-interview, ralplan, team) now surfaces a user-visible answer instead of silently stalling — re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.36]** (2026-06-20) — When `jeo --tmux` flips the mouse on so you can drag-select, the drag now actually lands on the system clipboard — the in-session tmux profile sets `set-clipboard on` + a local `copy-command` on the CURRENT session only — plus `/help` documents the drag-to-copy and the Shift/Option-drag escape hatch, re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.35]** (2026-06-20) — The prompt's Ctrl+C now clears a non-empty input box on the first press and only exits on the next press of an empty box; plus app-driven system-clipboard copy (OSC 52 + local tool, tmux-aware), drag-and-drop image attachment, a Ctrl-L prompt re-anchor, and a SIGCONT resume repaint — verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot check.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -183,6 +183,7 @@ JEO_TUI_ALT_SCREEN=1            # legacy alt-screen turn (default: inline scroll
 JEO_STEP_BASE=24                # dynamic step budget: rolling base
 JEO_STEP_HARD_CAP=600           # absolute termination guarantee
 JEO_STREAM_MAX_MS=300000        # opt-in overall stream deadline (default off; bounds slow-drip streams)
+JEO_STREAM_IDLE_MS=300000       # per-chunk idle cap (default 300s); raise for slow/local backends silent before first token
 JEO_TOOL_OUTPUT_MAX=4000        # model-visible tool output cap (full output spills to artifacts)
 ```
 
@@ -200,11 +201,11 @@ Required npm token permissions (repository secret `NPM_TOKEN`):
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
+- **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.37]** (2026-06-20) — Two dead-end fixes: the boxed prompt's ↑/↓ now recalls input history on a soft-wrapped one-liner (only a genuine multi-line draft gets in-box caret nav), and every terminating Spec-first stage (deep-interview, ralplan, team) now surfaces a user-visible answer instead of silently stalling — re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.36]** (2026-06-20) — When `jeo --tmux` flips the mouse on so you can drag-select, the drag now actually lands on the system clipboard — the in-session tmux profile sets `set-clipboard on` + a local `copy-command` on the CURRENT session only — plus `/help` documents the drag-to-copy and the Shift/Option-drag escape hatch, re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.35]** (2026-06-20) — The prompt's Ctrl+C now clears a non-empty input box on the first press and only exits on the next press of an empty box; plus app-driven system-clipboard copy (OSC 52 + local tool, tmux-aware), drag-and-drop image attachment, a Ctrl-L prompt re-anchor, and a SIGCONT resume repaint — verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot check.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -200,11 +200,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
+- **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.37]** (2026-06-20) — Two dead-end fixes: the boxed prompt's ↑/↓ now recalls input history on a soft-wrapped one-liner (only a genuine multi-line draft gets in-box caret nav), and every terminating Spec-first stage (deep-interview, ralplan, team) now surfaces a user-visible answer instead of silently stalling — re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.36]** (2026-06-20) — When `jeo --tmux` flips the mouse on so you can drag-select, the drag now actually lands on the system clipboard — the in-session tmux profile sets `set-clipboard on` + a local `copy-command` on the CURRENT session only — plus `/help` documents the drag-to-copy and the Shift/Option-drag escape hatch, re-verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot.
-- **[0.6.35]** (2026-06-20) — The prompt's Ctrl+C now clears a non-empty input box on the first press and only exits on the next press of an empty box; plus app-driven system-clipboard copy (OSC 52 + local tool, tmux-aware), drag-and-drop image attachment, a Ctrl-L prompt re-anchor, and a SIGCONT resume repaint — verified leak-free (`mem-probe`) with a fresh `jeo --tmux` boot check.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.6.39",
+  "version": "0.6.41",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -126,6 +126,7 @@ export const ConfigSchema = z
         plan: z.string().optional(),
       })
       .optional(),
+    gitAutoCommit: z.boolean().optional(),
     hooks: HookConfigSchema.optional(),
   })
   .passthrough();

package/src/agent/state.ts

@@ -95,6 +95,7 @@ export interface Config {
    * `defaultModel`. Env `JEO_SMOL_MODEL`/`JEO_SLOW_MODEL`/`JEO_PLAN_MODEL` fill gaps.
    */
   roles?: { smol?: string; slow?: string; plan?: string };
+  gitAutoCommit?: boolean;
   hooks?: HookConfig;
 }
 

package/src/ai/model-manager.ts

@@ -383,16 +383,32 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
   return { adapter, callOptions, credential: credentialForCall(provider, effective, config, baseUrl), retry };
 }
 
-/** Hard cap for a single non-streaming provider request (service-readiness: a
- *  blackholed/unreachable provider must not hang the agent or `jeo team`). */
-const DEFAULT_CALL_TIMEOUT_MS = 120_000;
+/** Hard wall-clock cap for a single NON-streaming provider request (service-readiness: a
+ *  blackholed/unreachable provider must not hang the agent or `jeo team`). Unlike the
+ *  streaming idle watchdog, this path collects an opaque buffered body (`response.json()`,
+ *  or an internally-streamed collect in codexResponsesCall / antigravity.call) and exposes
+ *  no per-chunk signal — so a wall clock is the only lever and a wire heartbeat cannot help.
+ *  Raised to 300s to match STREAM_IDLE_TIMEOUT_MS: non-interactive turns (callLlm WITHOUT
+ *  onToken — compaction, ralplan, deep-interview, memory distill, goal-verify, and subagent/
+ *  autopilot engine steps) route here, and a long reasoning completion legitimately exceeds
+ *  120s; too-tight, it aborts an alive call, retries re-incur the same slow request, the
+ *  attempt budget exhausts, and the turn STOPS — the same false-failure the streaming
+ *  watchdog guards, on the path the wire heartbeat never reaches. */
+const DEFAULT_CALL_TIMEOUT_MS = 300_000;
 
 /** Per-chunk idle cap for streaming: a stream that emits NOTHING for this long is
  *  aborted, but a healthy long generation (chunks keep arriving) runs unbounded —
  *  unlike a single wall-clock cap that would kill a long-but-active stream.
- *  Opt-in override via JEO_STREAM_IDLE_MS for reasoning workloads whose "thinking"
- *  phase can legitimately emit no visible token for longer than the default. */
-const STREAM_IDLE_TIMEOUT_MS = 120_000;
+ *  Set to 300s (not 120s): the wire-level heartbeat already re-arms this watchdog on
+ *  ANY bytes (keepalive/ping) from remote providers, so this cap now only bites the
+ *  GENUINELY-silent case — chiefly local backends (Ollama / llama.cpp) whose model
+ *  load + prompt-eval before the first token emits zero bytes and no keepalive, and
+ *  can easily exceed 120s on modest hardware or a large context. A too-tight cap there
+ *  aborts an alive-but-quiet generation, retries re-incur the same slow first byte, the
+ *  attempt budget exhausts, and the turn STOPS — the exact false-failure this guards.
+ *  Opt-in override via JEO_STREAM_IDLE_MS for reasoning/local workloads whose silent
+ *  phase runs longer still; Ctrl-C remains the interactive escape for a truly dead one. */
+const STREAM_IDLE_TIMEOUT_MS = 300_000;
 
 /** Combine two abort signals into one. Preserves BOTH even when `AbortSignal.any`
  *  is unavailable (manual fallback), so neither the caller's cancel nor the timeout
@@ -498,6 +514,15 @@ export function streamIdleMs(env?: Record<string, string | undefined>): number {
   return Number.isFinite(n) && n > 0 ? n : STREAM_IDLE_TIMEOUT_MS;
 }
 
+/** Hard wall-clock cap (ms) for a NON-streaming provider call, falling back to the
+ *  built-in default. Mirrors streamIdleMs so a slow non-interactive turn (callLlm without
+ *  onToken) can relax the cap via JEO_CALL_TIMEOUT_MS without a code change. */
+export function callTimeoutMs(env?: Record<string, string | undefined>): number {
+  const raw = jeoEnv("CALL_TIMEOUT_MS", env);
+  const n = raw !== undefined ? parseInt(raw, 10) : NaN;
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_CALL_TIMEOUT_MS;
+}
+
 export async function* retryableStream(
   makeIter: () => AsyncIterator<string>,
   retry: RetryOptions,
@@ -519,7 +544,7 @@ export function createModelManager(): ModelManager {
     resolveProvider,
     async call(messages, options = {}) {
       const { adapter, callOptions, credential, retry } = await resolveCall(options);
-      return withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, DEFAULT_CALL_TIMEOUT_MS) }, credential), retry);
+      return withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, callTimeoutMs()) }, credential), retry);
     },
     async *stream(messages, options = {}) {
       const { adapter, callOptions, credential, retry } = await resolveCall(options, "stream");
@@ -531,11 +556,13 @@ export function createModelManager(): ModelManager {
         // JEO_STREAM_MAX_MS opts in to an OVERALL deadline (round-14): non-interactive
         // runs can bound a slow-drip stream the per-chunk idle alone never catches.
         let attempt: AbortController | null = null;
-        // Heartbeat: reasoning/thinking deltas are routed to onReasoning and NEVER yielded
-        // as a chunk, so a model that "thinks" (streams thought tokens) for longer than the
-        // idle window would otherwise look stalled and trip a false idle-stall retry. Wrap
-        // onReasoning/onReasoningStart to stamp lastActivityAt; the idle watchdog re-arms
-        // while thinking is actively streaming and only aborts a genuinely silent stream.
+        // Heartbeat: a long server-side "thinking" phase emits no yielded chunk, so the
+        // idle watchdog would otherwise look stalled and trip a false idle-stall retry.
+        // Two heartbeat sources bump lastActivityAt: (1) reasoning/thinking deltas routed
+        // to onReasoning, and (2) onStreamActivity — the wire-level heartbeat fired on ANY
+        // bytes from the provider stream (SSE keepalive/ping comments, events that never
+        // become a chunk). The watchdog re-arms while ANY activity advances and aborts only
+        // a genuinely dead stream (zero bytes for the idle window).
         let lastActivityAt = Date.now();
         const bump = () => { lastActivityAt = Date.now(); };
         const userOnReasoning = callOptions.onReasoning;
@@ -544,6 +571,10 @@ export function createModelManager(): ModelManager {
           ...callOptions,
           onReasoning: (delta: string) => { bump(); userOnReasoning?.(delta); },
           onReasoningStart: () => { bump(); userOnReasoningStart?.(); },
+          // Wire-level heartbeat: ANY bytes from the provider stream (SSE keepalive/ping
+          // comments, events that never become a chunk) stamp activity, so the idle
+          // watchdog re-arms for a connected-but-quiet stream and aborts only a dead one.
+          onStreamActivity: bump,
         };
         const makeIter = () => {
           attempt = new AbortController();
@@ -559,7 +590,7 @@ export function createModelManager(): ModelManager {
         });
       } else {
         // Fallback: providers without streaming yield the full response as one chunk.
-        yield await withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, DEFAULT_CALL_TIMEOUT_MS) }, credential), retry);
+        yield await withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, callTimeoutMs()) }, credential), retry);
       }
     },
   };

package/src/ai/providers/anthropic.ts

@@ -410,7 +410,7 @@ export const anthropicAdapter: ProviderAdapter = {
     // + signature_delta(signature). Accumulate per index and emit one ReasoningArtifact per
     // block on stream end so the signed thought can be replayed (gajae continuity).
     const thinkBlocks = new Map<number, { text: string; signature?: string }>();
-    for await (const data of readSse(response.body)) {
+    for await (const data of readSse(response.body, options.onStreamActivity)) {
       let evt: {
         type?: string;
         index?: number;

package/src/ai/providers/antigravity.ts

@@ -280,7 +280,7 @@ export const antigravityAdapter: ProviderAdapter = {
     let yielded = false;
     let usage: CcaUsage | undefined;
     const fnCalls: { tool: string; arguments: Record<string, unknown> }[] = [];
-    for await (const data of readSse(response.body)) {
+    for await (const data of readSse(response.body, options.onStreamActivity)) {
       let chunk: CcaChunk;
       try { chunk = JSON.parse(data); } catch { continue; }
       const thought = thoughtOf(chunk);

package/src/ai/providers/gemini.ts

@@ -259,7 +259,7 @@ async function* ccaTurn(messages: Message[], options: CallOptions, credential: C
   let lastEmptyReason: string | undefined;
   const fnCalls: { tool: string; arguments: Record<string, unknown> }[] = [];
   const seenSigs = new Set<string>();
-  for await (const data of readSse(response.body)) {
+  for await (const data of readSse(response.body, options.onStreamActivity)) {
     let chunk: CcaChunk;
     try {
       chunk = JSON.parse(data);
@@ -334,7 +334,7 @@ export const geminiAdapter: ProviderAdapter = {
     let lastEmptyReason: string | undefined;
     const fnCalls: { tool: string; arguments: Record<string, unknown> }[] = [];
     const seenSigs = new Set<string>();
-    for await (const data of readSse(response.body)) {
+    for await (const data of readSse(response.body, options.onStreamActivity)) {
       let chunk: GeminiChunk;
       try {
         chunk = JSON.parse(data);

package/src/ai/providers/ollama.ts

@@ -64,7 +64,7 @@ export const ollamaAdapter: ProviderAdapter = {
     let doneReason: string | undefined;
     // Route inline <think>…</think> (local reasoning models) to the reasoning channel.
     const think = createThinkSplitter(options.onReasoning);
-    for await (const line of readLines(response.body)) {
+    for await (const line of readLines(response.body, options.onStreamActivity)) {
       let chunk: { message?: { content?: string; thinking?: string }; done?: boolean; done_reason?: string; prompt_eval_count?: number; eval_count?: number; total_duration?: number };
       try {
         chunk = JSON.parse(line);

package/src/ai/providers/openai-responses.ts

@@ -279,7 +279,7 @@ export async function* codexResponsesStream(
   let yieldedAny = false;
   let incompleteReason: string | undefined;
   const toolAcc = new Map<number, { name: string; args: string }>();
-  for await (const data of readSse(response.body)) {
+  for await (const data of readSse(response.body, options.onStreamActivity)) {
     const ev = parseResponsesEvent(data);
     if (ev.reasoningDelta) options.onReasoning?.(ev.reasoningDelta);
     if (ev.reasoningItem) options.onReasoningArtifact?.({ provider: "openai", model: options.model, itemId: ev.reasoningItem.id, encrypted: ev.reasoningItem.encrypted });

package/src/ai/providers/openai.ts

@@ -201,7 +201,7 @@ export const openaiAdapter: ProviderAdapter = {
     // visible answer and onto the reasoning channel. No-op for models that never emit it.
     const think = createThinkSplitter(options.onReasoning);
     const toolAcc = new Map<number, { name: string; args: string }>();
-    for await (const data of readSse(response.body)) {
+    for await (const data of readSse(response.body, options.onStreamActivity)) {
       let chunk: { choices?: { delta?: OpenAIDelta; finish_reason?: string }[]; usage?: { prompt_tokens?: number; completion_tokens?: number } };
       try {
         chunk = JSON.parse(data);

package/src/ai/sse.ts

@@ -1,4 +1,7 @@
-export async function* readLines(stream: ReadableStream<Uint8Array>): AsyncGenerator<string> {
+export async function* readLines(
+  stream: ReadableStream<Uint8Array>,
+  onActivity?: () => void,
+): AsyncGenerator<string> {
   const reader = stream.getReader();
   const decoder = new TextDecoder("utf-8");
   let buffer = "";
@@ -8,6 +11,13 @@ export async function* readLines(stream: ReadableStream<Uint8Array>): AsyncGener
       if (done) {
         break;
       }
+      // Wire-level heartbeat: ANY bytes from the server (including SSE keepalive/ping
+      // comments and events that never become a yielded chunk) mark the stream as alive,
+      // so the idle watchdog re-arms instead of falsely aborting a connected-but-quiet
+      // stream (e.g. a model reasoning server-side that emits only ping events).
+      if (value && value.length > 0) {
+        onActivity?.();
+      }
       buffer += decoder.decode(value, { stream: true });
       const parts = buffer.split("\n");
       buffer = parts.pop() ?? "";
@@ -34,8 +44,11 @@ export async function* readLines(stream: ReadableStream<Uint8Array>): AsyncGener
   }
 }
 
-export async function* readSse(stream: ReadableStream<Uint8Array>): AsyncGenerator<string> {
-  for await (const line of readLines(stream)) {
+export async function* readSse(
+  stream: ReadableStream<Uint8Array>,
+  onActivity?: () => void,
+): AsyncGenerator<string> {
+  for await (const line of readLines(stream, onActivity)) {
     if (line.startsWith("data:")) {
       let data = line.slice(5);
       if (data.startsWith(" ")) {

package/src/ai/types.ts

@@ -125,6 +125,12 @@ export interface CallOptions {
    *  thoughtSignature / reasoning item id+encrypted). Separate from `onReasoning` (display
    *  text) because these arrive on different SSE events and are opaque replay data. */
   onReasoningArtifact?: (artifact: ReasoningArtifact) => void;
+  /** Internal wire-activity heartbeat: fired on ANY bytes received from the provider
+   *  stream — including SSE keepalive/ping comments and events that never become a
+   *  yielded chunk or reasoning delta. Set by the manager's streaming path so the idle
+   *  watchdog treats a connected-but-quiet stream (e.g. a model reasoning server-side
+   *  that emits only ping events) as alive. NOT forwarded to user callbacks. */
+  onStreamActivity?: () => void;
   /** NATIVE tool-calling: function declarations the model may call. Present only on the
    *  main agent step (never the prose wrap-up). Adapters with `supportsNativeTools` send
    *  these on the wire and re-serialize the structured tool call back into the engine's

package/src/commands/launch.ts

@@ -1025,6 +1025,31 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     }
     sessionUsage.turns++;
     const usage = result.usage ? `  (${result.usage.inputTokens} in / ${result.usage.outputTokens} out tokens)` : "";
+
+    if (turnConfig.gitAutoCommit) {
+      try {
+        const statusRes = Bun.spawnSync(["git", "status", "--porcelain"], { cwd, stdout: "pipe", stderr: "ignore" });
+        if (statusRes.exitCode === 0 && statusRes.stdout.toString().trim().length > 0) {
+          Bun.spawnSync(["git", "add", "."], { cwd });
+          const diffRes = Bun.spawnSync(["git", "diff", "--cached", "--name-status"], { cwd, stdout: "pipe", stderr: "ignore" });
+          const changedFiles = diffRes.stdout.toString().trim().split("\n").map(line => line.split("\t")[1]).filter(Boolean);
+          const fileSummary = changedFiles.length > 0 ? ` (modified: ${changedFiles.slice(0, 3).join(", ")}${changedFiles.length > 3 ? ", ..." : ""})` : "";
+          const commitMsg = `[jeo] auto-commit${fileSummary}\n\nPrompt: ${userInput.slice(0, 100)}${userInput.length > 100 ? "..." : ""}`;
+          const commitRes = Bun.spawnSync(["git", "commit", "-m", commitMsg], { cwd });
+          if (commitRes.exitCode === 0) {
+            if (tui) tui.events().onNotice?.(`(auto-committed changes to git)`);
+            else console.log(`(auto-committed changes to git)`);
+          } else {
+            if (tui) tui.events().onNotice?.(`(auto-commit failed: git commit returned non-zero)`);
+            else console.error(`(auto-commit failed: git commit returned non-zero)`);
+          }
+        }
+      } catch (e) {
+        if (tui) tui.events().onNotice?.(`(auto-commit failed: ${e instanceof Error ? e.message : String(e)})`);
+        else console.error(`(auto-commit failed: ${e instanceof Error ? e.message : String(e)})`);
+      }
+    }
+
     return { done: result.done, steps: result.steps, reply, rendered: !!tui, usage };
   };
 
@@ -3349,6 +3374,29 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         }
         continue;
       }
+      if (input === "/undo") {
+        try {
+          const logRes = Bun.spawnSync(["git", "log", "-1", "--pretty=%B"], { cwd, stdout: "pipe", stderr: "ignore" });
+          if (logRes.exitCode === 0) {
+            const msg = logRes.stdout.toString().trim();
+            if (msg.startsWith("[jeo] auto-commit:")) {
+              const resetRes = Bun.spawnSync(["git", "reset", "--hard", "HEAD~1"], { cwd, stdout: "pipe", stderr: "pipe" });
+              if (resetRes.exitCode === 0) {
+                console.log("(undid the last jeo auto-commit and restored the working tree)");
+              } else {
+                console.log(`! undo failed: ${resetRes.stderr.toString().trim()}`);
+              }
+            } else {
+              console.log("! the last commit was not made by jeo (no '[jeo] auto-commit:' prefix). Use git manually to revert.");
+            }
+          } else {
+            console.log("! undo failed: could not read git log (not a git repo?)");
+          }
+        } catch (err) {
+          console.log(`! undo failed: ${(err as Error).message}`);
+        }
+        continue;
+      }
       if (input === "/goal" || input.startsWith("/goal ")) {
         const arg = input.substring(5).trim();
         if (!arg) {