jeo-code 0.6.41 → 0.7.1

package/src/auth/storage.ts

@@ -8,11 +8,13 @@ import { jeoEnv } from "../util/env";
 /** Providers with an interactive OAuth login + refresh flow. */
 export type OAuthProvider = "anthropic" | "openai" | "gemini" | "antigravity";
 /** Every provider jeo resolves a credential for: OAuth-capable ∪ API-key-only. */
-export type AuthProvider = OAuthProvider | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax";
+export type AuthProvider = OAuthProvider | "xai" | "kimi" | "groq" | "deepseek" | "mistral" | "openrouter" | "together" | "cerebras" | "fireworks" | "nvidia" | "alibaba-coding-plan" | "huggingface" | "nanogpt" | "qwen-portal" | "synthetic" | "venice" | "zenmux" | "qianfan" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "minimax-code" | "minimax-code-cn" | "zai" | "minimax" | "tencent";
+
 
 export const OAUTH_PROVIDERS: readonly OAuthProvider[] = ["anthropic", "openai", "gemini", "antigravity"];
 /** API-key-only providers (no OAuth flow) — resolved from config.providers / `<NAME>_API_KEY`. */
-export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "kimi", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax"];
+export const API_KEY_ONLY_PROVIDERS: readonly AuthProvider[] = ["xai", "kimi", "groq", "deepseek", "mistral", "openrouter", "together", "cerebras", "fireworks", "nvidia", "alibaba-coding-plan", "huggingface", "nanogpt", "qwen-portal", "synthetic", "venice", "zenmux", "qianfan", "xiaomi", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "xiaomi-token-plan-sgp", "minimax-code", "minimax-code-cn", "zai", "minimax", "tencent"];
+
 /** Narrow an AuthProvider to the OAuth-capable subset (xai/kimi have no OAuth flow). */
 export function isOAuthProvider(p: AuthProvider): p is OAuthProvider {
   return (OAUTH_PROVIDERS as readonly string[]).includes(p);
@@ -167,9 +169,13 @@ export async function resolveCredential(provider: AuthProvider): Promise<Credent
           }).catch(() => {});
         }
         const result = await refreshPromise;
-        if (result.refreshed && result.credential.kind === "oauth") {
-          return result.credential;
-        }
+        // refreshOAuthToken encodes the best credential for every outcome: the
+        // fresh token on success, the stale token on a transient blip, and an
+        // API-key/logged-out fallback after a definitive (dead refresh token)
+        // failure cleared the credential. Return it directly instead of reusing
+        // the in-memory stale token, so a dead OAuth credential degrades cleanly
+        // (to an API key or re-login) rather than looping on a doomed refresh.
+        return result.credential;
       } catch {
         // Fall through and use the (stale) access token; the provider call will surface a 401.
       }

package/src/cli/runner.ts

@@ -235,6 +235,15 @@ export const COMMANDS: readonly CommandSpec[] = [
       return args => Promise.resolve(m.runLedger(args));
     },
   },
+  {
+    name: "computer",
+    summary: "Execute desktop automation actions (screenshot, click, type, keypress, scroll, drag, wait, batch).",
+    usage: "computer <action> [args]",
+    loader: async () => {
+      const m = await import("../commands/computer");
+      return args => m.runComputerCommand(args);
+    },
+  },
 ];
 
 export function findCommand(name: string): CommandSpec | undefined {

package/src/cli.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { dispatch } from "./cli/runner";
+import { restoreTerminalState } from "./util/terminal-restore";
 import pkg from "../package.json";
 
 const APP_NAME = "jeo";
@@ -16,11 +17,26 @@ if (typeof Bun !== "undefined" && Bun.semver?.order(Bun.version, MIN_BUN_VERSION
 }
 process.title = APP_NAME;
 
+// Last-resort crash net: a background `fetch()` socket error (or any stray
+// rejection/throw) can tear the process down outside the try/catch below, AFTER
+// the REPL has put stdin in raw mode + enabled bracketed paste. Without this the
+// shell is left mute ("error printed, then input is dead"). Restore the terminal
+// SYNCHRONOUSLY, print one clean line, and exit non-zero — never a raw stack dump.
+const fatal = (err: unknown): never => {
+  restoreTerminalState();
+  const msg = (err as Error)?.message ?? String(err);
+  process.stderr.write(`error: ${msg}\n`);
+  process.exit(1);
+};
+process.on("uncaughtException", fatal);
+process.on("unhandledRejection", fatal);
+
 try {
   const code = await dispatch(process.argv.slice(2), { appName: APP_NAME, version: VERSION });
   if (code !== 0) process.exit(code);
 } catch (err) {
   // Service-readiness: never surface a raw stack trace to users; clean error + non-zero exit.
+  restoreTerminalState();
   process.stderr.write(`error: ${(err as Error)?.message ?? String(err)}\n`);
   process.exit(1);
 }

package/src/commands/approve.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { createHash } from "node:crypto";
 import {
   readGlobalConfig,
   readWorkflowState,
@@ -75,8 +76,10 @@ export async function runApproveCommand(args: string[] = []): Promise<void> {
   // rubber stamp — validate the plan against the exact contract `jeo team`
   // enforces, so a schema-invalid/unknown-role plan is refused HERE instead of
   // aborting later at execution time.
+  let planContent = "";
   try {
-    const parsed = PlanSchema.safeParse(normalizePlanShape(parseYaml(await fs.readFile(resolvedInputPath, "utf-8"))));
+    planContent = await fs.readFile(resolvedInputPath, "utf-8");
+    const parsed = PlanSchema.safeParse(normalizePlanShape(parseYaml(planContent)));
     if (!parsed.success) {
       console.log(
         `[ERROR] Refusing to approve: the plan is not in the shape 'jeo team' executes (top-level 'steps:' list of { name, role? }).\n` +
@@ -114,6 +117,19 @@ export async function runApproveCommand(args: string[] = []): Promise<void> {
     return;
   }
 
+  // Round-13: verify the plan's hash matches the consensus hash to prevent silent edits
+  if (ralplanState.consensus_hash) {
+    const currentHash = createHash("sha256").update(planContent).digest("hex");
+    if (currentHash !== ralplanState.consensus_hash) {
+      console.log(
+        `[ERROR] Refusing to approve: the plan file has been modified since the consensus critic reviewed it.\n` +
+        `  Re-run 'jeo ralplan' to let the critic review the updated plan, then approve again.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  }
+
   // Update ralplan-state.json to approved: true
   ralplanState.approved = true;
   await writeWorkflowState("ralplan", ralplanState, cwd);

package/src/commands/computer.ts

@@ -0,0 +1,334 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { computerSupervisor } from "../agent/computer-supervisor";
+import { readGlobalConfig } from "../agent/state";
+
+export interface ComputerAction {
+  action: "screenshot" | "click" | "double_click" | "move" | "drag" | "scroll" | "type" | "keypress" | "wait" | "batch";
+  x?: number;
+  y?: number;
+  text?: string;
+  key?: string;
+  deltaX?: number;
+  deltaY?: number;
+  duration?: number;
+  actions?: ComputerAction[];
+}
+
+async function logAudit(action: ComputerAction, success: boolean, error?: string) {
+  try {
+    const auditDir = path.join(process.cwd(), ".jeo");
+    await fs.mkdir(auditDir, { recursive: true });
+    const auditPath = path.join(auditDir, "computer-audit.jsonl");
+    const logEntry = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      action,
+      success,
+      error,
+    }) + "\n";
+    await fs.appendFile(auditPath, logEntry, "utf-8");
+  } catch {
+    // best-effort
+  }
+}
+
+async function runCommand(cmd: string[]): Promise<{ success: boolean; stdout: string; stderr: string }> {
+  try {
+    const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
+    await proc.exited;
+    const stdout = await new Response(proc.stdout).text();
+    const stderr = await new Response(proc.stderr).text();
+    return {
+      success: proc.exitCode === 0,
+      stdout,
+      stderr,
+    };
+  } catch (err: any) {
+    return {
+      success: false,
+      stdout: "",
+      stderr: err.message || String(err),
+    };
+  }
+}
+
+export async function executeComputerAction(action: ComputerAction): Promise<{ success: boolean; output: string; error?: string }> {
+  const config = await readGlobalConfig().catch(() => null);
+  if (!config?.computer?.enabled) {
+    return {
+      success: false,
+      output: "",
+      error: "Computer use is disabled. Enable it by setting 'computer.enabled: true' in ~/.jeo/config.json",
+    };
+  }
+
+  // Read-only actions don't need supervisor inputAllowed check
+  const isReadOnly = action.action === "screenshot" || action.action === "wait";
+  if (!isReadOnly) {
+    if (!computerSupervisor.inputAllowed) {
+      const err = "Action blocked by fail-closed supervisor (kill switch not live, heartbeat stale, or suspended).";
+      await logAudit(action, false, err);
+      return { success: false, output: "", error: err };
+    }
+  }
+
+  const isMac = os.platform() === "darwin";
+
+  switch (action.action) {
+    case "screenshot": {
+      const tmpDir = os.tmpdir();
+      const screenPath = path.join(tmpDir, `jeo-screen-${Date.now()}.png`);
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["screencapture", "-x", screenPath];
+      } else {
+        cmd = ["scrot", "-z", screenPath];
+      }
+      const res = await runCommand(cmd);
+      if (!res.success) {
+        await logAudit(action, false, res.stderr);
+        return { success: false, output: "", error: `Failed to capture screenshot: ${res.stderr}` };
+      }
+      try {
+        const bytes = await fs.readFile(screenPath);
+        const base64 = bytes.toString("base64");
+        await fs.unlink(screenPath).catch(() => {});
+        await logAudit(action, true);
+        return { success: true, output: base64 };
+      } catch (err: any) {
+        await logAudit(action, false, err.message);
+        return { success: false, output: "", error: `Failed to read screenshot file: ${err.message}` };
+      }
+    }
+
+    case "click": {
+      if (action.x === undefined || action.y === undefined) {
+        return { success: false, output: "", error: "Missing coordinates x and y for click action." };
+      }
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["cliclick", `c:${action.x},${action.y}`];
+      } else {
+        cmd = ["xdotool", "mousemove", String(action.x), String(action.y), "click", "1"];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Clicked at (${action.x}, ${action.y})` }
+        : { success: false, output: "", error: `Click failed: ${res.stderr}` };
+    }
+
+    case "double_click": {
+      if (action.x === undefined || action.y === undefined) {
+        return { success: false, output: "", error: "Missing coordinates x and y for double_click action." };
+      }
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["cliclick", `dc:${action.x},${action.y}`];
+      } else {
+        cmd = ["xdotool", "mousemove", String(action.x), String(action.y), "click", "--repeat", "2", "--delay", "100", "1"];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Double clicked at (${action.x}, ${action.y})` }
+        : { success: false, output: "", error: `Double click failed: ${res.stderr}` };
+    }
+
+    case "move": {
+      if (action.x === undefined || action.y === undefined) {
+        return { success: false, output: "", error: "Missing coordinates x and y for move action." };
+      }
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["cliclick", `m:${action.x},${action.y}`];
+      } else {
+        cmd = ["xdotool", "mousemove", String(action.x), String(action.y)];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Moved cursor to (${action.x}, ${action.y})` }
+        : { success: false, output: "", error: `Move failed: ${res.stderr}` };
+    }
+
+    case "drag": {
+      if (action.x === undefined || action.y === undefined) {
+        return { success: false, output: "", error: "Missing coordinates x and y for drag action." };
+      }
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["cliclick", `dd:${action.x},${action.y}`];
+      } else {
+        cmd = ["xdotool", "mousemove", String(action.x), String(action.y), "mousedown", "1"];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Dragged to (${action.x}, ${action.y})` }
+        : { success: false, output: "", error: `Drag failed: ${res.stderr}` };
+    }
+
+    case "scroll": {
+      let cmd: string[];
+      const dx = action.deltaX ?? 0;
+      const dy = action.deltaY ?? 0;
+      if (isMac) {
+        // cliclick scroll deltaY deltaX
+        cmd = ["cliclick", `w:${dy},${dx}`];
+      } else {
+        // xdotool click 4 (scroll up), 5 (scroll down), 6 (scroll left), 7 (scroll right)
+        const actions: string[] = [];
+        if (dy > 0) {
+          for (let i = 0; i < dy; i++) actions.push("click", "4");
+        } else if (dy < 0) {
+          for (let i = 0; i < -dy; i++) actions.push("click", "5");
+        }
+        if (dx > 0) {
+          for (let i = 0; i < dx; i++) actions.push("click", "7");
+        } else if (dx < 0) {
+          for (let i = 0; i < -dx; i++) actions.push("click", "6");
+        }
+        cmd = ["xdotool", ...actions];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Scrolled by deltaX=${dx}, deltaY=${dy}` }
+        : { success: false, output: "", error: `Scroll failed: ${res.stderr}` };
+    }
+
+    case "type": {
+      if (action.text === undefined) {
+        return { success: false, output: "", error: "Missing text for type action." };
+      }
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["cliclick", `t:${action.text}`];
+      } else {
+        cmd = ["xdotool", "type", action.text];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Typed text: ${action.text}` }
+        : { success: false, output: "", error: `Type failed: ${res.stderr}` };
+    }
+
+    case "keypress": {
+      if (action.key === undefined) {
+        return { success: false, output: "", error: "Missing key for keypress action." };
+      }
+      let cmd: string[];
+      if (isMac) {
+        cmd = ["cliclick", `kp:${action.key}`];
+      } else {
+        cmd = ["xdotool", "key", action.key];
+      }
+      const res = await runCommand(cmd);
+      await logAudit(action, res.success, res.success ? undefined : res.stderr);
+      return res.success
+        ? { success: true, output: `Pressed key: ${action.key}` }
+        : { success: false, output: "", error: `Keypress failed: ${res.stderr}` };
+    }
+
+    case "wait": {
+      const ms = (action.duration ?? 1) * 1000;
+      await new Promise((resolve) => setTimeout(resolve, ms));
+      await logAudit(action, true);
+      return { success: true, output: `Waited for ${action.duration ?? 1} seconds` };
+    }
+
+    case "batch": {
+      if (!action.actions || !Array.isArray(action.actions)) {
+        return { success: false, output: "", error: "Missing actions array for batch action." };
+      }
+      const results: string[] = [];
+      for (let i = 0; i < action.actions.length; i++) {
+        const subAction = action.actions[i];
+        const res = await executeComputerAction(subAction);
+        if (!res.success) {
+          const err = `Batch failed at step ${i}: ${res.error}`;
+          await logAudit(action, false, err);
+          return { success: false, output: results.join("\n"), error: err };
+        }
+        results.push(`Step ${i}: ${res.output}`);
+      }
+      await logAudit(action, true);
+      return { success: true, output: results.join("\n") };
+    }
+
+    default:
+      return { success: false, output: "", error: `Unknown computer action: ${(action as any).action}` };
+  }
+}
+
+export async function runComputerCommand(args: string[]): Promise<void> {
+  const actionName = args[0];
+  if (!actionName) {
+    console.log("Usage: jeo computer <action> [args]");
+    console.log("Actions: screenshot, click, double_click, move, drag, scroll, type, keypress, wait, batch");
+    return;
+  }
+
+  const action: ComputerAction = { action: actionName as any };
+
+  // Parse arguments based on action
+  if (actionName === "click" || actionName === "double_click" || actionName === "move" || actionName === "drag") {
+    const x = parseInt(args[1] ?? "");
+    const y = parseInt(args[2] ?? "");
+    if (isNaN(x) || isNaN(y)) {
+      console.error(`Error: ${actionName} requires x and y coordinates.`);
+      process.exit(1);
+    }
+    action.x = x;
+    action.y = y;
+  } else if (actionName === "type") {
+    const text = args.slice(1).join(" ");
+    if (!text) {
+      console.error("Error: type requires text.");
+      process.exit(1);
+    }
+    action.text = text;
+  } else if (actionName === "keypress") {
+    const key = args[1];
+    if (!key) {
+      console.error("Error: keypress requires a key name.");
+      process.exit(1);
+    }
+    action.key = key;
+  } else if (actionName === "scroll") {
+    const dx = parseInt(args[1] ?? "0");
+    const dy = parseInt(args[2] ?? "0");
+    action.deltaX = dx;
+    action.deltaY = dy;
+  } else if (actionName === "wait") {
+    const duration = parseFloat(args[1] ?? "1");
+    action.duration = duration;
+  } else if (actionName === "batch") {
+    const jsonStr = args.slice(1).join(" ");
+    try {
+      action.actions = JSON.parse(jsonStr);
+    } catch (err: any) {
+      console.error(`Error: batch requires a valid JSON array of actions. ${err.message}`);
+      process.exit(1);
+    }
+  }
+
+  // Heartbeat to supervisor for CLI execution
+  computerSupervisor.setKillSwitchLive(true);
+  computerSupervisor.heartbeat();
+
+  const res = await executeComputerAction(action);
+  if (res.success) {
+    if (actionName === "screenshot") {
+      console.log(res.output); // base64 output
+    } else {
+      console.log(res.output);
+    }
+  } else {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+}

package/src/commands/launch/input.ts

@@ -1,3 +1,5 @@
+import { verticalCursorOffset } from "../../tui/components/input-box";
+
 export interface InFlightAbortHarness {
   controller: AbortController;
   handleSigint(): void;
@@ -24,6 +26,8 @@ interface AbortHarnessOptions {
    *  Without this hook the byte would be swallowed into the buffered input queue,
    *  which is why Ctrl+O historically "did nothing" while the TUI owned stdin. */
   onDetailKey?: () => void;
+  /** Invoked when Ctrl+\\ (\u001c) is pressed mid-turn — the safety kill-switch binding. */
+  onKillSwitch?: () => void;
   /** Invoked when an arrow / PageUp / PageDown key arrives mid-turn — scrolls the
    *  open Ctrl+O detail panel. dir -1 = up/back, +1 = down/forward; page = full jump. */
   onScrollKey?: (dir: -1 | 1, page: boolean) => void;
@@ -65,16 +69,51 @@ export function isGenuineMultilineDraft(line: string): boolean {
   return line.includes(MULTILINE_SENTINEL);
 }
 
-/** Whether an Up/Down keystroke should move the caret BETWEEN the box's visual rows
- *  (textarea feel) instead of falling through to readline's input-history recall. True
- *  only for a genuinely multi-line draft with no slash dropdown or history panel owning
- *  the arrows. A soft-wrapped one-liner returns false, so ↑ recalls the previous prompt
- *  rather than dragging the wrapped tail up a visual row. */
+/** Whether an Up/Down keystroke should be CONSIDERED for moving the caret between the
+ *  box's visual rows (textarea feel) instead of going straight to readline. True for any
+ *  non-empty draft when no slash dropdown or Ctrl+O history panel owns the arrows.
+ *
+ *  This is a gate, NOT the final decision: the caller still consults
+ *  `verticalCursorOffset`, which returns a target offset only when there is a visual row
+ *  to move to. So ↑/↓ edit a MULTI-ROW draft — whether it spans rows via explicit
+ *  Shift+Enter breaks OR a long line the box soft-wraps — yet still fall through to
+ *  input-history recall at the boundaries: ↑ on the TOP visual row, ↓ on the BOTTOM row,
+ *  and any single-visual-row draft (where `verticalCursorOffset` yields null). That
+ *  boundary-aware split gives full arrow-key cursor movement for editing multi-row input
+ *  while preserving "↑ recalls the previous prompt" once the caret can climb no higher. */
 export function shouldBoxVerticalNav(
   line: string,
   opts: { slashMatchCount: number; historyPanelOpen: boolean },
 ): boolean {
-  return isGenuineMultilineDraft(line) && opts.slashMatchCount === 0 && !opts.historyPanelOpen;
+  return line.length > 0 && opts.slashMatchCount === 0 && !opts.historyPanelOpen;
+}
+
+/** The action an Up/Down keystroke should take on the boxed prompt, given the draft and
+ *  caret. `expandedLine` has explicit breaks expanded to "\n" (the wrapped row model the
+ *  box renders); `rawLine` keeps the sentinels so a genuine multi-line draft is detectable.
+ *
+ *  - "move":    a visual row exists in `dir` → reposition the caret to `cursor` (textarea feel).
+ *  - "swallow": no row to move to AND the draft is a GENUINE multi-line message → keep the
+ *               keystroke INSIDE the box. Falling through to readline at the top/bottom edge
+ *               would recall input history and WIPE the multi-line draft the user is composing
+ *               (the "↓ cuts the lower text" bug) — so the boundary key is a deliberate no-op.
+ *  - "history": no row to move to on a SOFT-WRAPPED single line → fall through to readline so
+ *               ↑/↓ recall input history at the edges (the dominant one-liner REPL expectation). */
+export type BoxVerticalNavAction =
+  | { kind: "move"; cursor: number }
+  | { kind: "swallow" }
+  | { kind: "history" };
+
+export function boxVerticalNavAction(
+  expandedLine: string,
+  rawLine: string,
+  cursor: number,
+  width: number,
+  dir: "up" | "down",
+): BoxVerticalNavAction {
+  const next = verticalCursorOffset(expandedLine, cursor, width, dir);
+  if (next != null) return { kind: "move", cursor: next };
+  return isGenuineMultilineDraft(rawLine) ? { kind: "swallow" } : { kind: "history" };
 }
 
 
@@ -372,6 +411,10 @@ export function createInFlightAbortHarness(opts: AbortHarnessOptions = {}): InFl
       opts.onDetailKey?.();
       return;
     }
+    if (text === "\u001c") {
+      opts.onKillSwitch?.();
+      return;
+    }
     if (text === "\u001b[A") { opts.onScrollKey?.(-1, false); return; }
     if (text === "\u001b[B") { opts.onScrollKey?.(1, false); return; }
     if (text === "\u001b[5~") { opts.onScrollKey?.(-1, true); return; }

package/src/commands/launch.ts

@@ -62,7 +62,7 @@ import { liveModelPicker, renderLiveModelPicker, type ModelAssignmentBadge } fro
 import { loginPicker, renderLoginPicker, onboardingPicker, renderOnboardingPicker, apiKeyPicker, renderApiKeyPicker, subscriptionLoginPicker, type OnboardingAction } from "../tui/components/provider-picker";
 import { detectLanguage, languageLabel, parseLineRange, sliceLines, formatCodeBlock, formatDiff, sanitizeForTerminal } from "../tui/components/code-view";
 import { categoryBadge } from "../tui/components/category-index";
-import { renderInputFrame, verticalCursorOffset, type HighlightRange } from "../tui/components/input-box";
+import { renderInputFrame, type HighlightRange } from "../tui/components/input-box";
 
 import { renderStatusBar } from "../tui/components/status";
 import { detectColorLevel, ColorLevel, visibleWidth } from "../tui/components/color";
@@ -139,6 +139,7 @@ import {
   MULTILINE_SENTINEL,
   isGenuineMultilineDraft,
   shouldBoxVerticalNav,
+  boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
   restoreQueuedLinesToPrefill,
@@ -209,6 +210,7 @@ export {
   MULTILINE_SENTINEL,
   isGenuineMultilineDraft,
   shouldBoxVerticalNav,
+  boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
   restoreQueuedLinesToPrefill,
@@ -250,11 +252,11 @@ function providerDefaultModel(p: ProviderName): string {
  * empty.
  *
  * Live discovery yields ids only for a logged-in, reachable provider, and
- * `catalogOr` backfills the static catalog ONLY for OAuth sources — so an
- * API-key/keyless provider that isn't configured yet had an empty list and was
- * silently pinned to a bare default. Prefer live ids; else the provider's
- * capability catalog; else its single known default model (all 24 OpenAI-compat
- * providers carry one) so the user always sees at least one pickable id.
+ * `catalogOr` backfills the static catalog for OAuth sources and for API-key
+ * providers whose models-list endpoint is absent (HTTP 404, e.g. Tencent MaaS).
+ * A not-yet-configured provider still has an empty live list, so prefer live ids;
+ * else the provider's capability catalog; else its single known default model (all
+ * 24 OpenAI-compat providers carry one) so the user always sees at least one id.
  */
 export function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
@@ -1469,14 +1471,16 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         // Option/Cmd+Backspace) into the canonical control bytes it DOES act on.
         const combo = matchCursorCombo(data, i);
         if (combo) { out += combo[1]; i += combo[0].length; continue; }
-        // Up/Down inside a GENUINELY multi-line draft (explicit Shift+Enter breaks →
-        // SENTINEL) move the caret between the box's visual rows (textarea feel). A
-        // single line that merely SOFT-WRAPS is NOT treated as multi-line: ↑/↓ fall
-        // through to readline so they recall input history — the dominant REPL
-        // expectation. (Without this gate, ↑ on a wrapped one-liner jumped the caret up
-        // a visual row instead of recalling the previous prompt, so the last wrapped
-        // word appeared to "follow the caret up".) Skipped when a slash list or history
-        // panel owns ↑/↓, and at the top/bottom edge the keys still reach history.
+        // Up/Down move the caret BETWEEN the box's visual rows (textarea feel) for any
+        // MULTI-ROW draft — explicit Shift+Enter breaks (→ SENTINEL) OR a long line the
+        // box soft-wraps. The decision is boundary-aware: an in-box visual row exists →
+        // move the caret there. With NO row to move to (↑ on the TOP row, ↓ on the BOTTOM
+        // row), a SOFT-WRAPPED one-liner falls through to readline to recall input history
+        // (the dominant REPL expectation), but a GENUINE multi-line draft SWALLOWS the key
+        // instead — falling through there would let readline's history nav WIPE the
+        // multi-line message being composed (the "↓ cuts the lower text" bug). Skipped
+        // entirely when a slash list or Ctrl+O history panel owns ↑/↓.
+
         if ((data.startsWith("\u001b[", i) || data.startsWith("\u001bO", i)) && (data[i + 2] === "A" || data[i + 2] === "B")) {
           const dir = data[i + 2] === "A" ? "up" : "down";
           const line = activeRl?.line ?? "";
@@ -1484,8 +1488,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             const winCols = Math.max(24, (process.stdout.columns ?? 80) - 1);
             const textWidth = Math.max(1, Math.max(24, winCols) - 6);
             const cur = typeof activeRl.cursor === "number" ? activeRl.cursor : line.length;
-            const next = verticalCursorOffset(expandSentinel(line), cur, textWidth, dir);
-            if (next != null) { activeRl.cursor = next; i += 3; continue; }
+            const action = boxVerticalNavAction(expandSentinel(line), line, cur, textWidth, dir);
+            if (action.kind === "move") { activeRl.cursor = action.cursor; i += 3; continue; }
+            if (action.kind === "swallow") { i += 3; continue; } // keep the multi-line draft intact
           }
           out += data.slice(i, i + 3); i += 3; continue;
         }
@@ -2167,10 +2172,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       process.stdin.setRawMode(true);
     }
     process.stdin.resume();
-    const cols = Math.max(40, terminalSize().cols - 2);
-    const rows = Math.max(6, terminalSize().rows - 6);
     let rendered = 0;
     const repaint = () => {
+      // Re-measure on EVERY paint so the picker tracks live terminal resizes. The old code
+      // captured cols/rows ONCE at open, so a picker left open across a resize never reflowed
+      // and stayed pinned to its opening geometry — it never recovered after a shrink→grow.
+      const cols = Math.max(40, terminalSize().cols - 2);
+      const rows = Math.max(6, terminalSize().rows - 6);
       const lines = render(cols, rows).map(line => truncateAnsi(line, cols));
       const total = Math.max(rendered, lines.length);
       // First paint: drop down ONCE to start on a fresh row; subsequent paints:
@@ -2205,6 +2213,19 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       rendered = 0;
     };
     repaint();
+    // Reflow the picker on terminal resize. The terminal has already reflowed the old
+    // block's rows, so `rendered` no longer maps 1:1 to physical rows: drop the stale
+    // accounting, wipe the visible screen (scrollback kept), and repaint at the freshly
+    // measured geometry. Debounced so a drag-resize coalesces into a single clean repaint.
+    let resizeTimer: ReturnType<typeof setTimeout> | undefined;
+    const onPickerResize = () => {
+      if (resizeTimer) clearTimeout(resizeTimer);
+      resizeTimer = setTimeout(() => {
+        resizeTimer = undefined;
+        try { rendered = 0; out.write(clearVisible()); repaint(); } catch { /* resize render race */ }
+      }, 16);
+    };
+    process.stdout.on("resize", onPickerResize);
     try {
       await new Promise<void>(resolve => {
         const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean } | undefined) => {
@@ -2220,6 +2241,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         process.stdin.on("keypress", handler);
       });
     } finally {
+      process.stdout.off("resize", onPickerResize);
+      if (resizeTimer) clearTimeout(resizeTimer);
       if (process.stdin.setRawMode && !wasRaw) {
         process.stdin.setRawMode(false);
       }