jeo-code 0.6.41 → 0.7.0

package/src/agent/json.ts

@@ -51,27 +51,94 @@ export function tryExtractJsonObject<T = unknown>(
 }
 
 /**
- * Parse `s` as JSON, tolerating a single class of common model slip: a trailing
- * comma right before a closing `}` or `]`. Returns `undefined` (not null — a bare
- * `null`/`false` is a legal JSON value) when nothing parses.
+ * Parse `s` as JSON, tolerating common model slips that produce *almost*-valid
+ * JSON. Returns `undefined` (not null — a bare `null`/`false` is a legal JSON
+ * value) when nothing parses. Repairs attempted, in order:
+ *   - a trailing comma right before a closing `}` or `]`;
+ *   - raw control characters (literal newlines/tabs/etc.) inside a string value,
+ *     which JSON forbids — a frequent slip when a tool argument carries multi-line
+ *     code (e.g. an `editBlock`/`content` payload the model failed to `\n`-escape).
  */
 function tryParse<T>(s: string): T | undefined {
   try {
     return JSON.parse(s) as T;
   } catch {
-    /* fall through to a trailing-comma repair */
+    /* fall through to layered repairs */
   }
-  const repaired = stripTrailingCommas(s);
-  if (repaired !== s) {
+  // Each repair targets one well-scoped, common slip; try the cheap single
+  // repairs first, then the combination, so valid JSON is never altered.
+  const candidates: string[] = [];
+  const noTrailing = stripTrailingCommas(s);
+  if (noTrailing !== s) candidates.push(noTrailing);
+  const escaped = escapeJsonControlChars(s);
+  if (escaped !== s) {
+    candidates.push(escaped);
+    const escapedNoTrailing = stripTrailingCommas(escaped);
+    if (escapedNoTrailing !== escaped) candidates.push(escapedNoTrailing);
+  }
+  for (const candidate of candidates) {
     try {
-      return JSON.parse(repaired) as T;
+      return JSON.parse(candidate) as T;
     } catch {
-      /* unrecoverable here */
+      /* try the next repair */
     }
   }
   return undefined;
 }
 
+/**
+ * Escape raw control characters (codepoint < 0x20) that appear *inside* a JSON
+ * string literal, where the JSON grammar requires them to be escaped. Models
+ * routinely emit literal newlines inside a multi-line tool argument (code in an
+ * `editBlock`/`content` field), which makes `JSON.parse` reject the whole object.
+ * String/escape state is tracked so control bytes outside strings (insignificant
+ * whitespace between tokens) are left untouched.
+ */
+function escapeJsonControlChars(s: string): string {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i]!;
+    if (inString) {
+      if (escaped) {
+        out += ch;
+        escaped = false;
+        continue;
+      }
+      if (ch === "\\") {
+        out += ch;
+        escaped = true;
+        continue;
+      }
+      if (ch === '"') {
+        out += ch;
+        inString = false;
+        continue;
+      }
+      const code = ch.charCodeAt(0);
+      if (code < 0x20) {
+        switch (ch) {
+          case "\n": out += "\\n"; break;
+          case "\r": out += "\\r"; break;
+          case "\t": out += "\\t"; break;
+          case "\b": out += "\\b"; break;
+          case "\f": out += "\\f"; break;
+          default: out += "\\u" + code.toString(16).padStart(4, "0"); break;
+        }
+        continue;
+      }
+      out += ch;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    }
+    out += ch;
+  }
+  return out;
+}
+
 /**
  * Remove a comma that directly precedes a closing `}` or `]` (ignoring
  * whitespace), but never a comma inside a string literal. String/escape state is

package/src/agent/loop-guards.ts

@@ -68,19 +68,30 @@ export function isVerificationSignal(cmd: string, output = ""): boolean {
 
 /**
  * Result-aware repeat nudge: tells the model WHY repeating the call won't help and what
- * to try instead, tailored to the repeated tool and its last actual result.
+ * to try instead, tailored to the repeated tool and its last actual result. When the
+ * previous attempt FAILED, prepend a reflection directive so the model extracts the
+ * lesson and changes tool/arguments instead of retrying the same failing call unchanged.
  */
 export function repeatHint(tool: string, prev?: { success: boolean; output: string }): string {
   const out = prev?.output ?? "";
   const empty = !prev || !prev.success || out.trim() === "" || /no match|0 match|no result|not found|no file/i.test(out);
+  const failed = prev !== undefined && !prev.success;
+  const reflect = failed
+    ? "The previous attempt FAILED — don't retry it unchanged; state what its result tells you, then change the tool or its arguments. "
+    : "";
+  let base: string;
   if (tool === "search" || tool === "find" || tool === "ls") {
-    return empty
+    base = empty
       ? `That '${tool}' returned nothing useful and will again — BROADEN it (a looser pattern, a parent directory, or a different tool such as ${tool === "search" ? "find" : "search"}), or call done if this lookup isn't needed.`
       : `That '${tool}' already returned results — open one of the hits with read, or move on; re-running it changes nothing.`;
+  } else if (tool === "read") {
+    base = `You already read that and its content is unchanged — use what you read, or read a DIFFERENT file.`;
+  } else if (tool === "bash") {
+    base = `That command already ran with the same output — change the command, or call done.`;
+  } else {
+    base = `That call's result is unchanged — take a different action, or call done.`;
   }
-  if (tool === "read") return `You already read that and its content is unchanged — use what you read, or read a DIFFERENT file.`;
-  if (tool === "bash") return `That command already ran with the same output — change the command, or call done.`;
-  return `That call's result is unchanged — take a different action, or call done.`;
+  return reflect + base;
 }
 
 /** Inputs for the done-verification gate (jeo's descendant of gjc's ultragoal-guard). */

package/src/agent/memory-okf.ts

@@ -24,7 +24,9 @@ export const JEO_TYPES = [
   "Gotcha",
   "UserPreference",
   "Reference",
+  "FailedAttempt",
 ] as const;
+
 export type JeoType = (typeof JEO_TYPES)[number];
 
 /** Reserved OKF filenames — never concept documents. */

package/src/agent/memory.ts

@@ -35,7 +35,9 @@ const TYPE_LAYOUT = [
   { type: "Command", dir: "commands", header: "Commands" },
   { type: "Gotcha", dir: "gotchas", header: "Gotchas" },
   { type: "UserPreference", dir: "preferences", header: "User Preferences" },
+  { type: "FailedAttempt", dir: "failed", header: "Failed Attempts" },
 ] as const;
+
 const DIR_BY_TYPE: Record<string, string> = Object.fromEntries(TYPE_LAYOUT.map(t => [t.type, t.dir]));
 
 export function memoryFilePath(cwd: string): string {
@@ -64,7 +66,9 @@ function headingToType(heading: string): string {
   const h = heading.toLowerCase();
   if (/\bcommand/.test(h)) return "Command";
   if (/gotcha|pitfall|caveat/.test(h)) return "Gotcha";
+  if (/failed|dead.?end|didn't work|doesn't work|avoid/.test(h)) return "FailedAttempt";
   if (/pref/.test(h)) return "UserPreference";
+
   if (/repo|fact/.test(h)) return "RepoFact";
   return "RepoFact";
 }
@@ -165,8 +169,10 @@ export async function migrateLegacyMemory(cwd: string): Promise<MigrationResult>
     await fs.rename(tmpPath, fullPath);
     written.push({ title: c.title, type: c.type });
   }
-  await rebuildIndex(bundleDir);
-  await updateLog(bundleDir, written);
+  await withIndexLock(bundleDir, async () => {
+    await rebuildIndex(bundleDir);
+    await updateLog(bundleDir, written);
+  });
   // Preserve the legacy doc as a rollback backup, off the active read path.
   const backupPath = `${memoryFilePath(cwd)}.bak`;
   await fs.rename(memoryFilePath(cwd), backupPath).catch(() => {});
@@ -449,6 +455,13 @@ async function findMarkdownFiles(dir: string): Promise<string[]> {
   return files;
 }
 
+/** Serialises concurrent same-process index/log writes; cross-process last-write-wins is fine (cosmetic files). */
+const _indexLocks = new Map<string, Promise<void>>();
+function withIndexLock(bundleDir: string, fn: () => Promise<void>): Promise<void> {
+  const next = (_indexLocks.get(bundleDir) ?? Promise.resolve()).then(fn, fn);
+  _indexLocks.set(bundleDir, next.catch(() => {}));
+  return next;
+}
 async function rebuildIndex(bundleDir: string): Promise<void> {
   const concepts = await loadConceptsFromBundle(bundleDir);
 
@@ -587,7 +600,8 @@ export async function distillSessionMemory(
           "You maintain a compact project memory bundle for a coding agent. " +
           "Extract durable learnings from the session transcript and merge them with the existing concepts. " +
           "Keep ONLY what helps future sessions in THIS repository: repo facts (structure, conventions, key files), " +
-          "commands that work (build/test/run), gotchas (failures and their fixes), and user preferences. " +
+          "commands that work (build/test/run), gotchas (failures and their fixes), user preferences, " +
+          "and approaches that were tried and FAILED (with the cause, so a future session does not repeat the dead end). " +
           "Drop session-specific noise (one-off tasks, transient errors, conversational detail). " +
           "CRITICAL RULES for concept granularity:\n" +
           "  1. Create ONE concept per distinct fact/command/gotcha/preference — never combine multiple learnings into a single concept.\n" +
@@ -595,12 +609,13 @@ export async function distillSessionMemory(
           "  3. Each Command concept covers exactly one command or workflow (e.g., 'bun test', NOT 'All bun commands').\n" +
           "  4. Each Gotcha covers exactly one failure mode and its fix.\n" +
           "  5. Each UserPreference covers exactly one observable preference.\n" +
+          "  5b. Each FailedAttempt covers exactly one approach that did not work plus the cause/symptom — phrase it so the next session avoids that dead end.\n" +
           "  6. RepoFact concepts describe structure/conventions — split by area (e.g., 'CLI entrypoint', 'Test setup').\n" +
           "  7. If an existing concept is a mega-concept (lists many things), REPLACE it with properly split granular concepts.\n" +
           "  8. Keep each concept body under 400 chars.\n\n" +
           "You must output a JSON object with a single key \"concepts\", which is an array of concept objects. " +
           "Each concept object must have the following fields:\n" +
-          "  - \"type\": one of \"RepoFact\", \"Command\", \"Gotcha\", \"UserPreference\"\n" +
+          "  - \"type\": one of \"RepoFact\", \"Command\", \"Gotcha\", \"UserPreference\", \"FailedAttempt\"\n" +
           "  - \"title\": a short, descriptive title (e.g., \"Bun test runner\")\n" +
           "  - \"description\": a brief one-line summary of the concept\n" +
           "  - \"body\": the detailed markdown content/body of the concept (≤400 chars)\n" +
@@ -707,10 +722,12 @@ export async function distillSessionMemory(
         }
       }
 
-      await rebuildIndex(bundleDir);
-      if (updatedConcepts.length > 0) {
-        await updateLog(bundleDir, updatedConcepts);
-      }
+      await withIndexLock(bundleDir, async () => {
+        await rebuildIndex(bundleDir);
+        if (updatedConcepts.length > 0) {
+          await updateLog(bundleDir, updatedConcepts);
+        }
+      });
       // Concepts now own the durable memory and the legacy blob (if any) was
       // folded into the merge above. Archive a lingering MEMORY.md off the active
       // read path so it can never break OKF conformance or shadow the bundle.

package/src/agent/state.ts

@@ -97,6 +97,9 @@ export interface Config {
   roles?: { smol?: string; slow?: string; plan?: string };
   gitAutoCommit?: boolean;
   hooks?: HookConfig;
+  computer?: {
+    enabled?: boolean;
+  };
 }
 
 export interface WorkflowTopologyComponent {
@@ -141,6 +144,10 @@ export interface WorkflowState {
   consensus?: string;
   /** ralplan: the critic's justification (bounded excerpt) for auditability. */
   consensus_detail?: string;
+  /** ralplan: hash of the exact plan content the consensus critic gated (round-13).
+   *  `jeo approve` recomputes the on-disk plan's hash and refuses if it differs, so a
+   *  schema-valid edit made AFTER the [OKAY] verdict cannot be silently approved. */
+  consensus_hash?: string;
   approved?: boolean;
   /** ultragoal terminal outcome. */
   status?: string;
@@ -477,7 +484,20 @@ export async function clearWorkflowState(
  * team-state.json last-writer-wins — tasks executed twice, completions lost.
  * O_EXCL lockfile carrying the holder's pid; a DEAD holder's stale lock is taken
  * over once, a LIVE holder refuses with an actionable error. Returns a release fn.
+ *
+ * Round-13 hardening: `process.kill(pid, 0)` alone cannot detect PID REUSE — a
+ * dead `jeo` pid recycled by an unrelated live process would look "alive" forever
+ * and starve the lock. The holder now HEARTBEATS the lock's `at` timestamp on an
+ * unref'd interval; a contender treats a lock as stale when the pid is dead OR the
+ * timestamp is older than the TTL (a live `jeo` run keeps it fresh, a dead/hung one
+ * or a reused pid lets it expire). Override the TTL with JEO_RUN_LOCK_TTL_MS.
  */
+const RUN_LOCK_TTL_MS = (() => {
+  const raw = Number(jeoEnv("RUN_LOCK_TTL_MS"));
+  return Number.isFinite(raw) && raw > 0 ? raw : 60_000;
+})();
+const RUN_LOCK_HEARTBEAT_MS = Math.max(1_000, Math.floor(RUN_LOCK_TTL_MS / 3));
+
 export async function acquireWorkflowRunLock(
   skill: "team" | "ultragoal",
   cwd: string = process.cwd(),
@@ -485,19 +505,27 @@ export async function acquireWorkflowRunLock(
   const stateDir = path.join(getLocalJeoDir(cwd), "state");
   await fs.mkdir(stateDir, { recursive: true });
   const lockPath = path.join(stateDir, `${skill}.lock`);
-  const payload = JSON.stringify({ pid: process.pid, at: Date.now() });
+  // Single source of the lock payload: exclusive-create on acquire, plain rewrite on heartbeat.
+  const stamp = (flag?: "wx") =>
+    fs.writeFile(lockPath, JSON.stringify({ pid: process.pid, at: Date.now() }), flag ? { flag } : {});
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      await fs.writeFile(lockPath, payload, { flag: "wx" });
+      await stamp("wx");
+      // Heartbeat: refresh `at` so a live run never looks stale; unref'd so it
+      // never keeps the process alive on its own.
+      const hb = setInterval(() => { stamp().catch(() => {}); }, RUN_LOCK_HEARTBEAT_MS);
+      hb.unref?.();
       return async () => {
+        clearInterval(hb);
         await fs.unlink(lockPath).catch(() => {});
       };
+
     } catch {
-      let holder: { pid?: number } = {};
+      let holder: { pid?: number; at?: number } = {};
       try {
-        holder = JSON.parse(await fs.readFile(lockPath, "utf-8")) as { pid?: number };
+        holder = JSON.parse(await fs.readFile(lockPath, "utf-8")) as { pid?: number; at?: number };
       } catch { /* unreadable/torn lock → treat as stale */ }
-      const alive = typeof holder.pid === "number" && holder.pid > 0 && (() => {
+      const pidAlive = typeof holder.pid === "number" && holder.pid > 0 && (() => {
         try {
           process.kill(holder.pid!, 0);
           return true;
@@ -505,12 +533,15 @@ export async function acquireWorkflowRunLock(
           return false;
         }
       })();
-      if (alive) {
+      const fresh = typeof holder.at === "number" && (Date.now() - holder.at) < RUN_LOCK_TTL_MS;
+      if (pidAlive && fresh) {
         throw new Error(
           `another 'jeo ${skill}' run (pid ${holder.pid}) holds ${lockPath} — wait for it to finish, or delete the lock file if that process is gone.`,
         );
       }
-      await fs.unlink(lockPath).catch(() => {}); // stale (dead/unreadable) → take over once
+      // stale: dead pid, unreadable lock, or a stalled/reused-pid holder whose
+      // heartbeat lapsed past the TTL → take over once.
+      await fs.unlink(lockPath).catch(() => {});
     }
   }
   throw new Error(`could not acquire ${lockPath} even after stale-lock takeover.`);

package/src/agent/task-tool.ts

@@ -13,6 +13,8 @@ import { runAgentLoop, type ToolHandler } from "./engine";
 import type { ToolResult } from "./tools";
 import type { Message } from "./loop";
 import { loadProjectContext, withProjectContext } from "./context-files";
+import { memoryPromptSection } from "./memory";
+
 import type { Config } from "./state";
 import {
   getSubagentRole,
@@ -51,7 +53,6 @@ export interface TaskSubEvent {
 }
 
 export interface TaskToolOptions {
-  /** Resolves per-role model + step overrides; `defaultModel` is the fallback. */
   /** Resolves per-role model/step/thinking overrides; `defaultModel` is the fallback. */
   config: Pick<Config, "defaultModel" | "subagents" | "thinkingLevel">;
   /** Forwarded to the subagent loop so Ctrl-C cancels nested work too. */
@@ -196,10 +197,13 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
     // session/global thinking level (the "(inherit)" row in the picker).
     const thinking = resolveSubagentThinking(role.id, opts.config) ?? opts.config.thinkingLevel;
     const projectContext = preloadedContext ?? await loadProjectContext(cwd);
+    const memorySection = await memoryPromptSection(cwd, taskText);
+    const systemBase = withProjectContext(subagentSystemPrompt(role), projectContext);
     const history: Message[] = [
-      { role: "system", content: withProjectContext(subagentSystemPrompt(role), projectContext) },
+      { role: "system", content: memorySection ? `${systemBase}\n\n${memorySection}` : systemBase },
       { role: "user", content: `${taskText}${context}` },
     ];
+
     const trace: string[] = [];
     let lastTarget = "";
     let currentStep = 0;
@@ -341,8 +345,13 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
         while (true) {
           const i = next++;
           if (i >= items.length) return;
-          results[i] = await runOne(role, items[i]!.task, items[i]!.context, cwd, { slot: { index: i + 1, total: items.length }, projectContext: batchContext, steer: workerSteer });
+          // Chain serial executor output into next task's context; parallel read-only stays isolated.
+          const chainNote = (!role.readOnly && i > 0 && results[i - 1])
+            ? `\n\n[Previous task result — for context, not instructions]:\n${results[i - 1]!.output.slice(0, 1_500)}`
+            : "";
+          results[i] = await runOne(role, items[i]!.task, items[i]!.context + chainNote, cwd, { slot: { index: i + 1, total: items.length }, projectContext: batchContext, steer: workerSteer });
         }
+
       };
       await Promise.all(Array.from({ length: limit }, () => worker()));
       const ok = results.filter(r => r.success).length;

package/src/agent/tool-schemas.ts

@@ -79,6 +79,25 @@ const SCHEMAS: Record<string, NativeToolSchema> = {
     description: "Search the web (synthesized answer + sources + citations). Optional recency, limit.",
     parameters: { type: "object", properties: { query: STRING, recency: STRING, limit: { type: "number" } }, required: ["query"] },
   },
+  computer: {
+    name: "computer",
+    description: "Execute desktop automation actions (screenshot, click, double_click, move, drag, scroll, type, keypress, wait, batch).",
+    parameters: {
+      type: "object",
+      properties: {
+        action: STRING,
+        x: { type: "number" },
+        y: { type: "number" },
+        text: STRING,
+        key: STRING,
+        deltaX: { type: "number" },
+        deltaY: { type: "number" },
+        duration: { type: "number" },
+        actions: { type: "array", items: { type: "object" } },
+      },
+      required: ["action"],
+    },
+  },
   done: {
     name: "done",
     description: "Call when the task is fully implemented AND verified. The reason is shown to the user as your message.",

package/src/ai/model-catalog.ts

@@ -108,6 +108,10 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
     images: !id.includes("gpt-oss"),
     company: id.includes("claude") ? "Anthropic via Antigravity" : id.includes("gpt") ? "OpenAI via Antigravity" : "Google Antigravity",
   })),
+  // Tencent
+  { canonical: "deepseek-v4-pro", provider: "tencent", providerModel: "deepseek-v4-pro", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "deepseek-v4-flash", provider: "tencent", providerModel: "deepseek-v4-flash", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "minimax-m3", provider: "tencent", providerModel: "minimax-m3", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
   // Ollama (local)
   { canonical: "qwen2.5", provider: "ollama", providerModel: "ollama/qwen2.5:0.5b", contextTokens: 32_768, maxOutputTokens: 8_192, thinking: [], images: false },
 ];

package/src/ai/providers/anthropic.ts

@@ -416,7 +416,7 @@ export const anthropicAdapter: ProviderAdapter = {
         index?: number;
         content_block?: { type?: string; name?: string; data?: string };
         delta?: { type?: string; text?: string; partial_json?: string; thinking?: string; signature?: string; stop_reason?: string };
-        message?: { usage?: AnthropicUsage };
+        message?: { usage?: AnthropicUsage; stop_reason?: string };
         usage?: { output_tokens?: number };
       };
       try {
@@ -452,11 +452,14 @@ export const anthropicAdapter: ProviderAdapter = {
         const tb = thinkBlocks.get(evt.index) ?? { text: "" };
         tb.signature = (tb.signature ?? "") + evt.delta.signature;
         thinkBlocks.set(evt.index, tb);
-      } else if (evt.type === "message_start" && evt.message?.usage) {
-        // Cache only — usage is reported ONCE at message_delta so an accumulating
-        // sink can't double-count input (and a pre-first-chunk retry that replays
-        // message_start is harmless).
-        cachedInput = totalInputTokens(evt.message.usage);
+      } else if (evt.type === "message_start" && evt.message) {
+        if (evt.message.stop_reason) stopReason = evt.message.stop_reason;
+        if (evt.message.usage) {
+          // Cache only — usage is reported ONCE at message_delta so an accumulating
+          // sink can't double-count input (and a pre-first-chunk retry that replays
+          // message_start is harmless).
+          cachedInput = totalInputTokens(evt.message.usage);
+        }
       } else if (evt.type === "message_delta") {
         if (evt.delta?.stop_reason) stopReason = evt.delta.stop_reason;
         if (evt.usage) options.onUsage?.({ inputTokens: cachedInput, outputTokens: evt.usage.output_tokens });
@@ -465,6 +468,7 @@ export const anthropicAdapter: ProviderAdapter = {
     // Emit captured thinking blocks as replay artifacts (signed thought + signature).
     for (const tb of thinkBlocks.values()) {
       if (tb.text || tb.signature) {
+        yieldedAny = true;
         options.onReasoningArtifact?.({ provider: "anthropic", model: options.model, text: tb.text || undefined, signature: tb.signature });
       }
     }

package/src/ai/providers/openai-compatible-catalog.ts

@@ -67,6 +67,8 @@ export const OPENAI_COMPAT_PROVIDERS: readonly OpenAICompatProviderDef[] = [
   // Anthropic-Messages-protocol providers (served via makeAnthropicCompatibleAdapter).
   { name: "zai", label: "z.ai", baseUrl: "https://api.z.ai/api/anthropic", apiKeyEnv: "ZAI_API_KEY", defaultModel: "zai/glm-5.2", protocol: "anthropic" },
   { name: "minimax", label: "MiniMax", baseUrl: "https://api.minimax.io/anthropic", apiKeyEnv: "MINIMAX_API_KEY", defaultModel: "minimax/minimax-m3", protocol: "anthropic" },
+  // Tencent Cloud MaaS (international) serves deepseek-v4 / minimax-m3 over the Anthropic Messages wire format at tokenhub-intl; `${base}/v1/messages` is pinned by the adapter.
+  { name: "tencent", label: "Tencent", baseUrl: "https://tokenhub-intl.tencentcloudmaas.com", apiKeyEnv: "TENCENT_API_KEY", defaultModel: "tencent/deepseek-v4-pro", knownModels: ["deepseek-v4-pro", "deepseek-v4-flash", "minimax-m3"], protocol: "anthropic" },
 ];
 
 const BY_NAME = new Map<string, OpenAICompatProviderDef>(OPENAI_COMPAT_PROVIDERS.map(p => [p.name, p]));

package/src/ai/types.ts

@@ -1,6 +1,7 @@
 import type { Credential } from "../auth";
 
-export type ProviderName = "anthropic" | "openai" | "gemini" | "antigravity" | "ollama" | "lmstudio" | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax";
+export type ProviderName = "anthropic" | "openai" | "gemini" | "antigravity" | "ollama" | "lmstudio" | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
+
 
 /** An image attached to a (user) message — base64 payload + IANA media type. */
 export interface ImageAttachment {

package/src/auth/index.ts

@@ -19,7 +19,7 @@ export {
   logoutOAuth,
 } from "./oauth";
 export type { OauthFlowDef } from "./oauth";
-export { refreshOAuthToken, rotateOAuthToken } from "./refresh";
+export { refreshOAuthToken, rotateOAuthToken, classifyRefreshFailure } from "./refresh";
 export type { RefreshResult } from "./refresh";
 export { OAUTH_FLOW_REGISTRY } from "./flows";
 export type { OAuthFlow } from "./flows";

package/src/auth/refresh.ts

@@ -6,12 +6,30 @@ import {
   snapshotProvider,
   acquireLock,
   releaseLock,
+  clearOauthToken,
   type AuthProvider,
   isOAuthProvider,
   type Credential,
 } from "./storage";
 import { OAUTH_FLOW_REGISTRY } from "./flows";
-import type { StoredOAuth } from "../agent/state";
+import { readGlobalConfig, type StoredOAuth } from "../agent/state";
+
+// gjc auth-broker refresher parity: a refresh attempt fails either *definitively*
+// (the refresh token itself is dead — invalid_grant / revoked / a 401-403 that is
+// not a network blip) or *transiently* (timeout / connection reset). A definitive
+// failure must stop us re-attempting a doomed refresh on every call; a transient
+// one must leave the credential untouched for the next sweep.
+const DEFINITIVE_REFRESH_RE = /invalid_grant|invalid_token|revoked|unauthorized|expired.*refresh|refresh.*expired/i;
+const TRANSIENT_REFRESH_RE = /timeout|network|fetch failed|ECONNREFUSED/i;
+const HTTP_401_403_RE = /\b(401|403)\b/;
+
+/** Classify an OAuth refresh error as a dead-token ("definitive") vs retryable ("transient") failure. */
+export function classifyRefreshFailure(err: unknown): "definitive" | "transient" {
+  const msg = (err as Error)?.message ?? String(err);
+  if (DEFINITIVE_REFRESH_RE.test(msg)) return "definitive";
+  if (HTTP_401_403_RE.test(msg) && !TRANSIENT_REFRESH_RE.test(msg)) return "definitive";
+  return "transient";
+}
 
 export interface RefreshResult {
   refreshed: boolean;
@@ -55,7 +73,34 @@ export async function refreshOAuthToken(provider: AuthProvider): Promise<Refresh
     }
 
     const flow = OAUTH_FLOW_REGISTRY[provider];
-    const fresh = await flow.refresh(stored.refresh);
+    let fresh: Awaited<ReturnType<typeof flow.refresh>>;
+    try {
+      fresh = await flow.refresh(stored.refresh);
+    } catch (err) {
+      if (classifyRefreshFailure(err) === "definitive") {
+        // Dead refresh token: re-attempting it on every resolution only burns a
+        // round-trip and then emits an opaque stale-token 401. Clear it so the
+        // next resolution degrades cleanly to an API key (or a logged-out state
+        // that prompts re-login). Mirrors gjc auth-broker disableCredentialById.
+        await clearOauthToken(provider);
+        const cfg = await readGlobalConfig();
+        const apiKey = cfg.providers[provider];
+        return {
+          refreshed: false,
+          reason: "refresh_token_invalid",
+          credential: apiKey
+            ? { kind: "api_key", provider, token: apiKey }
+            : { kind: "none", provider },
+        };
+      }
+      // Transient failure: keep the credential and surface the stale access token
+      // so the in-flight call can try once more; the next expiry sweep retries.
+      return {
+        refreshed: false,
+        reason: "refresh_transient_error",
+        credential: { kind: "oauth", provider, token: stored.access, projectId: stored.projectId },
+      };
+    }
     const next: StoredOAuth = {
       access: fresh.access,
       refresh: fresh.refresh || stored.refresh,

package/src/auth/storage.ts

@@ -8,11 +8,13 @@ import { jeoEnv } from "../util/env";
 /** Providers with an interactive OAuth login + refresh flow. */
 export type OAuthProvider = "anthropic" | "openai" | "gemini" | "antigravity";
 /** Every provider jeo resolves a credential for: OAuth-capable ∪ API-key-only. */
-export type AuthProvider = OAuthProvider | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax";
+export type AuthProvider = OAuthProvider | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
+
 
 export const OAUTH_PROVIDERS: readonly OAuthProvider[] = ["anthropic", "openai", "gemini", "antigravity"];
 /** API-key-only providers (no OAuth flow) — resolved from config.providers / `<NAME>_API_KEY`. */
-export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "kimi", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax"];
+export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "kimi", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax", "tencent"];
+
 /** Narrow an AuthProvider to the OAuth-capable subset (xai/kimi have no OAuth flow). */
 export function isOAuthProvider(p: AuthProvider): p is OAuthProvider {
   return (OAUTH_PROVIDERS as readonly string[]).includes(p);
@@ -167,9 +169,13 @@ export async function resolveCredential(provider: AuthProvider): Promise<Credent
           }).catch(() => {});
         }
         const result = await refreshPromise;
-        if (result.refreshed && result.credential.kind === "oauth") {
-          return result.credential;
-        }
+        // refreshOAuthToken encodes the best credential for every outcome: the
+        // fresh token on success, the stale token on a transient blip, and an
+        // API-key/logged-out fallback after a definitive (dead refresh token)
+        // failure cleared the credential. Return it directly instead of reusing
+        // the in-memory stale token, so a dead OAuth credential degrades cleanly
+        // (to an API key or re-login) rather than looping on a doomed refresh.
+        return result.credential;
       } catch {
         // Fall through and use the (stale) access token; the provider call will surface a 401.
       }

package/src/cli/runner.ts

@@ -235,6 +235,15 @@ export const COMMANDS: readonly CommandSpec[] = [
       return args => Promise.resolve(m.runLedger(args));
     },
   },
+  {
+    name: "computer",
+    summary: "Execute desktop automation actions (screenshot, click, type, keypress, scroll, drag, wait, batch).",
+    usage: "computer <action> [args]",
+    loader: async () => {
+      const m = await import("../commands/computer");
+      return args => m.runComputerCommand(args);
+    },
+  },
 ];
 
 export function findCommand(name: string): CommandSpec | undefined {

package/src/cli.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { dispatch } from "./cli/runner";
+import { restoreTerminalState } from "./util/terminal-restore";
 import pkg from "../package.json";
 
 const APP_NAME = "jeo";
@@ -16,11 +17,26 @@ if (typeof Bun !== "undefined" && Bun.semver?.order(Bun.version, MIN_BUN_VERSION
 }
 process.title = APP_NAME;
 
+// Last-resort crash net: a background `fetch()` socket error (or any stray
+// rejection/throw) can tear the process down outside the try/catch below, AFTER
+// the REPL has put stdin in raw mode + enabled bracketed paste. Without this the
+// shell is left mute ("error printed, then input is dead"). Restore the terminal
+// SYNCHRONOUSLY, print one clean line, and exit non-zero — never a raw stack dump.
+const fatal = (err: unknown): never => {
+  restoreTerminalState();
+  const msg = (err as Error)?.message ?? String(err);
+  process.stderr.write(`error: ${msg}\n`);
+  process.exit(1);
+};
+process.on("uncaughtException", fatal);
+process.on("unhandledRejection", fatal);
+
 try {
   const code = await dispatch(process.argv.slice(2), { appName: APP_NAME, version: VERSION });
   if (code !== 0) process.exit(code);
 } catch (err) {
   // Service-readiness: never surface a raw stack trace to users; clean error + non-zero exit.
+  restoreTerminalState();
   process.stderr.write(`error: ${(err as Error)?.message ?? String(err)}\n`);
   process.exit(1);
 }