jeo-code 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -6,6 +6,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.1] - 2026-06-22
+_TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6)._
+
+### Added
+- **Theme-derived forge flow palette.** `themeFlowPalette(theme)` builds a 3-stop neon palette (`accentShadow → accent → brightest stage-gradient end`) from the active TUI theme; the animated forge-card border and the forge mark now sweep the theme's own glow instead of the fixed brand `FORGE_FLOW_PALETTE`. Colorless/`mono` themes collapse to a single accent stop (the animation is already gated on color/TrueColor).
+- **Expanded Tencent Cloud MaaS catalog.** Added live-verified model ids across DeepSeek (`deepseek-v4-pro`/`-202606`, `deepseek-v4-flash`/`-202605`, `deepseek-v3.2`), MiniMax (`minimax-m3`/`-m2.7`/`-m2.5`), and Zhipu GLM (`glm-5.2`/`5.1`/`5`). Ids were confirmed against live `/v1/messages` probes (the host exposes no `/v1/models` route).
+
+### Fixed
+- **The boxed prompt's Up/Down keys no longer wipe a multi-line draft at its edges.** A new `boxVerticalNavAction` classifier returns `move` (a visual row exists → reposition the caret), `swallow` (no row AND a genuine multi-line draft → keep the keystroke inside the box, since falling through to readline would recall input history and erase the draft — the "↓ cuts the lower text" bug), or `history` (no row on a soft-wrapped single line → fall through so ↑/↓ recall history at the edges).
+- **Model-picker no longer pins API-key providers to a bare default when the models-list endpoint is absent.** `catalogOr` now backfills the static capability catalog for OAuth sources *and* for API-key providers whose models endpoint returns HTTP 404 (e.g. Tencent MaaS), so the picker shows the full known model set instead of a single default.
+- **`scripts/tmux-verify.sh smoke` no longer false-fails on the benign non-TTY attach.** The launcher-log grep was pure false-positive surface (it re-flagged the harmless `not a terminal` attach message); a real pre-handoff crash already fails via the session-start timeout and a post-handoff crash shows in the captured frame, so the rendered frame is the authoritative signal.
+
+### Verified
+- `bun run typecheck` clean; full suite **1806 pass / 0 fail** (221 files).
+- `scripts/mem-probe.ts` (2000 turns × 40 tools): no long-term leak (exit 0; settled heap floor flat at ~4.3 MB, exit-listeners flat at 1).
+- `scripts/tmux-verify.sh battery`: **6/6 PASSED** on a fresh `jeo --tmux` boot (boot, `/help`, unknown `$skill`, `/agents`, `$ultragoal`, unresolved `/command`).
+
 ## [0.7.0] - 2026-06-22
 _Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6)._
 

package/README.ja.md

@@ -193,11 +193,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -193,11 +193,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -195,11 +195,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -193,11 +193,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.6.40]** (2026-06-21) — Wire-level stream heartbeat: ANY bytes from the provider (SSE keepalive/ping, filtered events) now re-arm the idle watchdog — a connected-but-quiet stream can no longer trip a false `stream idle` retry. Default idle window raised to 300s so Ollama/llama.cpp model-load silence no longer exhausts retries and stops the turn.
 - **[0.6.39]** (2026-06-21) — A long "thinking" phase no longer trips a false stream-idle retry: reasoning/thinking deltas now act as a stream heartbeat, so a model that streams thought tokens past the idle window before any visible text is no longer mistaken for a stalled stream and retried (which discarded the in-progress reasoning). Re-verified leak-free (`mem-probe`, 2000 turns, −525 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.38]** (2026-06-21) — The OKF concept-bundle memory no longer silently drops what it learns: a legacy single-doc `MEMORY.md` (or a text-only distill fallback) can no longer shadow the concept bundle, break OKF conformance, or lose a turn's learnings — its content is folded into the concept merge and the stale blob is archived. Re-verified leak-free (`mem-probe`, 2000 turns, −570 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-catalog.ts

@@ -109,9 +109,27 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
     company: id.includes("claude") ? "Anthropic via Antigravity" : id.includes("gpt") ? "OpenAI via Antigravity" : "Google Antigravity",
   })),
   // Tencent
+  // Tencent — DeepSeek
   { canonical: "deepseek-v4-pro", provider: "tencent", providerModel: "deepseek-v4-pro", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "deepseek-v4-pro-202606", provider: "tencent", providerModel: "deepseek-v4-pro-202606", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
   { canonical: "deepseek-v4-flash", provider: "tencent", providerModel: "deepseek-v4-flash", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "deepseek-v4-flash-202605", provider: "tencent", providerModel: "deepseek-v4-flash-202605", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "deepseek-v3.2", provider: "tencent", providerModel: "deepseek-v3.2", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  // Tencent — MiniMax
   { canonical: "minimax-m3", provider: "tencent", providerModel: "minimax-m3", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "minimax-m2.7", provider: "tencent", providerModel: "minimax-m2.7", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "minimax-m2.5", provider: "tencent", providerModel: "minimax-m2.5", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  // Tencent — Zhipu GLM
+  { canonical: "glm-5.2", provider: "tencent", providerModel: "glm-5.2", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "glm-5.1", provider: "tencent", providerModel: "glm-5.1", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "glm-5", provider: "tencent", providerModel: "glm-5", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "glm-5-turbo", provider: "tencent", providerModel: "glm-5-turbo", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "glm-5v-turbo", provider: "tencent", providerModel: "glm-5v-turbo", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: true, company: "Tencent" },
+  // Tencent — Moonshot Kimi
+  { canonical: "kimi-k2.6", provider: "tencent", providerModel: "kimi-k2.6", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  { canonical: "kimi-k2.5", provider: "tencent", providerModel: "kimi-k2.5", contextTokens: 128_000, maxOutputTokens: 8192, thinking: FULL, images: false, company: "Tencent" },
+  // Tencent — Hunyuan MT
+  { canonical: "hy-mt2-plus", provider: "tencent", providerModel: "hy-mt2-plus", contextTokens: 128_000, maxOutputTokens: 8192, thinking: STD, images: false, company: "Tencent" },
   // Ollama (local)
   { canonical: "qwen2.5", provider: "ollama", providerModel: "ollama/qwen2.5:0.5b", contextTokens: 32_768, maxOutputTokens: 8_192, thinking: [], images: false },
 ];

package/src/ai/model-discovery.ts

@@ -270,23 +270,41 @@ export function parseModelsBody(provider: ProviderName, body: unknown): string[]
 
 /**
  * When a provider is authenticated (oauth/api_key) but the live `models` endpoint
- * is unusable — e.g. ChatGPT/Codex OAuth tokens are rejected by `api.openai.com/v1/models`
- * — surface the static catalog ids so the provider's models still appear in pickers.
- * Keyless/not-logged-in results are returned unchanged.
+ * is unusable — e.g. ChatGPT/Codex OAuth tokens are rejected by `api.openai.com/v1/models`,
+ * or a provider (Tencent MaaS) simply has no `/v1/models` route — surface the static
+ * catalog ids so the provider's models still appear in pickers.
+ * Keyless/not-logged-in results, and api_key *auth rejections* (a bad key), are
+ * returned unchanged so they stay honest failures.
  */
 export function catalogOr(result: ProviderModelsResult): ProviderModelsResult {
   if (result.ok && result.models.length > 0) return result;
-  // OpenAI/Codex OAuth legitimately rejects the standard /models endpoint while
-  // the fixed Codex ids still work for calls. Other OAuth providers may fall
-  // back to their static catalog too — EXCEPT Antigravity, whose available
-  // models depend on the Cloud Code Assist agent backend and must not be faked.
-  if (result.source !== "oauth") return result;
+  // Antigravity's available models depend on the Cloud Code Assist agent backend
+  // and must never be faked from a hard-coded catalog.
   if (result.provider === "antigravity") return result;
-  const ids = result.provider === "openai" ? [...CODEX_MODELS] : catalogByProvider(result.provider).map(m => m.providerModel);
+  // OAuth: OpenAI/Codex legitimately rejects the standard /models endpoint while
+  // the fixed Codex ids still work; other OAuth providers fall back to their full
+  // static catalog too. API-key providers only fall back when the provider has NO
+  // models-list endpoint at all (HTTP 404 / not found) — never for an auth
+  // rejection, so a wrong key stays a failure instead of fabricating catalog rows.
+  const eligible = result.source === "oauth"
+    || (result.source === "api_key" && isMissingModelsEndpoint(result.error));
+  if (!eligible) return result;
+  const ids = result.provider === "openai" && result.source === "oauth"
+    ? [...CODEX_MODELS]
+    : catalogByProvider(result.provider).map(m => m.providerModel);
   if (ids.length === 0) return result;
   return { ...result, models: ids, ok: true, fallback: true };
 }
 
+/**
+ * True when a discovery error means the models-list endpoint itself is absent
+ * (HTTP 404 / "not found") rather than an auth/key or transient network problem.
+ */
+function isMissingModelsEndpoint(error: string | undefined): boolean {
+  if (!error) return false;
+  return /(^|\D)404(\D|$)/.test(error) || /not found/i.test(error);
+}
+
 /** Discover the live model list for one provider. Never throws. */
 export async function listProviderModels(
   provider: ProviderName,

package/src/ai/providers/openai-compatible-catalog.ts

@@ -67,8 +67,8 @@ export const OPENAI_COMPAT_PROVIDERS: readonly OpenAICompatProviderDef[] = [
   // Anthropic-Messages-protocol providers (served via makeAnthropicCompatibleAdapter).
   { name: "zai", label: "z.ai", baseUrl: "https://api.z.ai/api/anthropic", apiKeyEnv: "ZAI_API_KEY", defaultModel: "zai/glm-5.2", protocol: "anthropic" },
   { name: "minimax", label: "MiniMax", baseUrl: "https://api.minimax.io/anthropic", apiKeyEnv: "MINIMAX_API_KEY", defaultModel: "minimax/minimax-m3", protocol: "anthropic" },
-  // Tencent Cloud MaaS (international) serves deepseek-v4 / minimax-m3 over the Anthropic Messages wire format at tokenhub-intl; `${base}/v1/messages` is pinned by the adapter.
-  { name: "tencent", label: "Tencent", baseUrl: "https://tokenhub-intl.tencentcloudmaas.com", apiKeyEnv: "TENCENT_API_KEY", defaultModel: "tencent/deepseek-v4-pro", knownModels: ["deepseek-v4-pro", "deepseek-v4-flash", "minimax-m3"], protocol: "anthropic" },
+  // Tencent Cloud MaaS (international) serves deepseek-v4 / deepseek-v3.2 / minimax-m3 over the Anthropic Messages wire format at tokenhub-intl; `${base}/v1/messages` is pinned by the adapter. Model ids verified live (2026-06) via /v1/messages probes — the host has no /v1/models route.
+  { name: "tencent", label: "Tencent", baseUrl: "https://tokenhub-intl.tencentcloudmaas.com", apiKeyEnv: "TENCENT_API_KEY", defaultModel: "tencent/deepseek-v4-pro", knownModels: ["deepseek-v4-pro", "deepseek-v4-flash", "minimax-m3", "deepseek-v3.2"], protocol: "anthropic" },
 ];
 
 const BY_NAME = new Map<string, OpenAICompatProviderDef>(OPENAI_COMPAT_PROVIDERS.map(p => [p.name, p]));

package/src/commands/launch/input.ts

@@ -1,3 +1,5 @@
+import { verticalCursorOffset } from "../../tui/components/input-box";
+
 export interface InFlightAbortHarness {
   controller: AbortController;
   handleSigint(): void;
@@ -86,6 +88,34 @@ export function shouldBoxVerticalNav(
   return line.length > 0 && opts.slashMatchCount === 0 && !opts.historyPanelOpen;
 }
 
+/** The action an Up/Down keystroke should take on the boxed prompt, given the draft and
+ *  caret. `expandedLine` has explicit breaks expanded to "\n" (the wrapped row model the
+ *  box renders); `rawLine` keeps the sentinels so a genuine multi-line draft is detectable.
+ *
+ *  - "move":    a visual row exists in `dir` → reposition the caret to `cursor` (textarea feel).
+ *  - "swallow": no row to move to AND the draft is a GENUINE multi-line message → keep the
+ *               keystroke INSIDE the box. Falling through to readline at the top/bottom edge
+ *               would recall input history and WIPE the multi-line draft the user is composing
+ *               (the "↓ cuts the lower text" bug) — so the boundary key is a deliberate no-op.
+ *  - "history": no row to move to on a SOFT-WRAPPED single line → fall through to readline so
+ *               ↑/↓ recall input history at the edges (the dominant one-liner REPL expectation). */
+export type BoxVerticalNavAction =
+  | { kind: "move"; cursor: number }
+  | { kind: "swallow" }
+  | { kind: "history" };
+
+export function boxVerticalNavAction(
+  expandedLine: string,
+  rawLine: string,
+  cursor: number,
+  width: number,
+  dir: "up" | "down",
+): BoxVerticalNavAction {
+  const next = verticalCursorOffset(expandedLine, cursor, width, dir);
+  if (next != null) return { kind: "move", cursor: next };
+  return isGenuineMultilineDraft(rawLine) ? { kind: "swallow" } : { kind: "history" };
+}
+
 
 /**
  * macOS / fixterms combo-key normalization for the boxed prompt's line editor.

package/src/commands/launch.ts

@@ -62,7 +62,7 @@ import { liveModelPicker, renderLiveModelPicker, type ModelAssignmentBadge } fro
 import { loginPicker, renderLoginPicker, onboardingPicker, renderOnboardingPicker, apiKeyPicker, renderApiKeyPicker, subscriptionLoginPicker, type OnboardingAction } from "../tui/components/provider-picker";
 import { detectLanguage, languageLabel, parseLineRange, sliceLines, formatCodeBlock, formatDiff, sanitizeForTerminal } from "../tui/components/code-view";
 import { categoryBadge } from "../tui/components/category-index";
-import { renderInputFrame, verticalCursorOffset, type HighlightRange } from "../tui/components/input-box";
+import { renderInputFrame, type HighlightRange } from "../tui/components/input-box";
 
 import { renderStatusBar } from "../tui/components/status";
 import { detectColorLevel, ColorLevel, visibleWidth } from "../tui/components/color";
@@ -139,6 +139,7 @@ import {
   MULTILINE_SENTINEL,
   isGenuineMultilineDraft,
   shouldBoxVerticalNav,
+  boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
   restoreQueuedLinesToPrefill,
@@ -209,6 +210,7 @@ export {
   MULTILINE_SENTINEL,
   isGenuineMultilineDraft,
   shouldBoxVerticalNav,
+  boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
   restoreQueuedLinesToPrefill,
@@ -250,11 +252,11 @@ function providerDefaultModel(p: ProviderName): string {
  * empty.
  *
  * Live discovery yields ids only for a logged-in, reachable provider, and
- * `catalogOr` backfills the static catalog ONLY for OAuth sources — so an
- * API-key/keyless provider that isn't configured yet had an empty list and was
- * silently pinned to a bare default. Prefer live ids; else the provider's
- * capability catalog; else its single known default model (all 24 OpenAI-compat
- * providers carry one) so the user always sees at least one pickable id.
+ * `catalogOr` backfills the static catalog for OAuth sources and for API-key
+ * providers whose models-list endpoint is absent (HTTP 404, e.g. Tencent MaaS).
+ * A not-yet-configured provider still has an empty live list, so prefer live ids;
+ * else the provider's capability catalog; else its single known default model (all
+ * 24 OpenAI-compat providers carry one) so the user always sees at least one id.
  */
 export function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
@@ -1471,11 +1473,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         if (combo) { out += combo[1]; i += combo[0].length; continue; }
         // Up/Down move the caret BETWEEN the box's visual rows (textarea feel) for any
         // MULTI-ROW draft — explicit Shift+Enter breaks (→ SENTINEL) OR a long line the
-        // box soft-wraps. The decision is boundary-aware: verticalCursorOffset returns a
-        // target only when a visual row exists to move to, so ↑ on the TOP row, ↓ on the
-        // BOTTOM row, and any single-visual-row draft fall through to readline and recall
-        // input history — the dominant REPL expectation once the caret can climb no
-        // higher. Skipped when a slash list or Ctrl+O history panel owns ↑/↓.
+        // box soft-wraps. The decision is boundary-aware: an in-box visual row exists →
+        // move the caret there. With NO row to move to (↑ on the TOP row, ↓ on the BOTTOM
+        // row), a SOFT-WRAPPED one-liner falls through to readline to recall input history
+        // (the dominant REPL expectation), but a GENUINE multi-line draft SWALLOWS the key
+        // instead — falling through there would let readline's history nav WIPE the
+        // multi-line message being composed (the "↓ cuts the lower text" bug). Skipped
+        // entirely when a slash list or Ctrl+O history panel owns ↑/↓.
 
         if ((data.startsWith("\u001b[", i) || data.startsWith("\u001bO", i)) && (data[i + 2] === "A" || data[i + 2] === "B")) {
           const dir = data[i + 2] === "A" ? "up" : "down";
@@ -1484,8 +1488,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             const winCols = Math.max(24, (process.stdout.columns ?? 80) - 1);
             const textWidth = Math.max(1, Math.max(24, winCols) - 6);
             const cur = typeof activeRl.cursor === "number" ? activeRl.cursor : line.length;
-            const next = verticalCursorOffset(expandSentinel(line), cur, textWidth, dir);
-            if (next != null) { activeRl.cursor = next; i += 3; continue; }
+            const action = boxVerticalNavAction(expandSentinel(line), line, cur, textWidth, dir);
+            if (action.kind === "move") { activeRl.cursor = action.cursor; i += 3; continue; }
+            if (action.kind === "swallow") { i += 3; continue; } // keep the multi-line draft intact
           }
           out += data.slice(i, i + 3); i += 3; continue;
         }
@@ -2167,10 +2172,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       process.stdin.setRawMode(true);
     }
     process.stdin.resume();
-    const cols = Math.max(40, terminalSize().cols - 2);
-    const rows = Math.max(6, terminalSize().rows - 6);
     let rendered = 0;
     const repaint = () => {
+      // Re-measure on EVERY paint so the picker tracks live terminal resizes. The old code
+      // captured cols/rows ONCE at open, so a picker left open across a resize never reflowed
+      // and stayed pinned to its opening geometry — it never recovered after a shrink→grow.
+      const cols = Math.max(40, terminalSize().cols - 2);
+      const rows = Math.max(6, terminalSize().rows - 6);
       const lines = render(cols, rows).map(line => truncateAnsi(line, cols));
       const total = Math.max(rendered, lines.length);
       // First paint: drop down ONCE to start on a fresh row; subsequent paints:
@@ -2205,6 +2213,19 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       rendered = 0;
     };
     repaint();
+    // Reflow the picker on terminal resize. The terminal has already reflowed the old
+    // block's rows, so `rendered` no longer maps 1:1 to physical rows: drop the stale
+    // accounting, wipe the visible screen (scrollback kept), and repaint at the freshly
+    // measured geometry. Debounced so a drag-resize coalesces into a single clean repaint.
+    let resizeTimer: ReturnType<typeof setTimeout> | undefined;
+    const onPickerResize = () => {
+      if (resizeTimer) clearTimeout(resizeTimer);
+      resizeTimer = setTimeout(() => {
+        resizeTimer = undefined;
+        try { rendered = 0; out.write(clearVisible()); repaint(); } catch { /* resize render race */ }
+      }, 16);
+    };
+    process.stdout.on("resize", onPickerResize);
     try {
       await new Promise<void>(resolve => {
         const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean } | undefined) => {
@@ -2220,6 +2241,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         process.stdin.on("keypress", handler);
       });
     } finally {
+      process.stdout.off("resize", onPickerResize);
+      if (resizeTimer) clearTimeout(resizeTimer);
       if (process.stdin.setRawMode && !wasRaw) {
         process.stdin.setRawMode(false);
       }

package/src/tui/app.ts

@@ -16,13 +16,13 @@ import { Spinner } from "./components/spinner";
 import { ToolList } from "./components/tool-list";
 import { StreamRegion } from "./components/stream";
 import { renderFooter, type FooterData } from "./components/footer";
-import { renderForgeMark, forgeMarkHeight, forgeMarkFrameCount, forgeBeat, FORGE_FLOW_PALETTE } from "./components/ascii-art";
+import { renderForgeMark, forgeMarkHeight, forgeMarkFrameCount, forgeBeat } from "./components/ascii-art";
 import { evolutionTrack, createStageProgress, type StageProgress, transitionMessage } from "./components/evolution";
 import type { TaskSubEvent } from "../agent/task-tool";
 import { supportsUnicode } from "./components/capability";
 import { centerBlock, padLineTo, boxBlock, BOX_ASCII, BOX_UNICODE } from "./components/layout";
 import { SECTION_GAP, sectionLabel, stackSections } from "./components/section";
-import { resolveTheme, themeGradient, accentPaint, accentShadowPaint, diffPaint, mutedPaint, cardFillPaint } from "./components/themes";
+import { resolveTheme, themeGradient, accentPaint, accentShadowPaint, diffPaint, mutedPaint, cardFillPaint, themeFlowPalette } from "./components/themes";
 import { detectColorLevel, animatedGradientText, ColorLevel } from "./components/color";
 import { formatForgeBox, summarizeForgeInvocation, summarizeForgeResult, fitForgeBoxes, webSearchCardLines, scaleForgeWidth, type ForgeSummary } from "./components/forge";
 import { renderStatusBar, renderStatusBox, type StatusBoxData } from "./components/status";
@@ -314,6 +314,9 @@ export class LaunchTui {
   private readonly unicode: boolean = supportsUnicode();
   // Active color theme (JEO_TUI_THEME), default cosmic; `mono` disables color.
   private readonly theme = resolveTheme(process.env);
+  // Neon flow palette derived from the active theme (forge-card border + forge mark
+  // animation), so the live glow tracks the theme instead of a fixed brand palette.
+  private readonly themeFlow = themeFlowPalette(this.theme);
   // Whether the live turn may use the alternate screen buffer (real TTY only).
   private readonly tty: boolean;
   // gjc-style inline rendering (default on a TTY): the live frame repaints in place in
@@ -968,7 +971,6 @@ export class LaunchTui {
     this.subagentLive = null; // fresh turn: no nested subagent in flight
     this.activityLog.length = 0; // per-turn ring: timestamps are turn-relative
     this.spinner.updateStep(0, this.footer.maxSteps);
-    // On a real TTY the live turn renders gjc-style in the MAIN buffer by default:
     // completed ledger lines are flushed into normal scrollback as they happen, so a
     // tmux / terminal mouse-wheel scroll can review earlier progress mid-turn. The
     // differential renderer reserves frame rows with real newlines, keeping the
@@ -1278,7 +1280,7 @@ export class LaunchTui {
         // the card border and the prompt beat marks the title. Flushed/final cards
         // stay static. Suppressed while `dim` (in-flight shading takes precedence).
         ...(anim && !dim
-          ? { flow: { palette: FORGE_FLOW_PALETTE, phase: anim.phase, colorLevel: anim.colorLevel }, titleMark: anim.beat }
+          ? { flow: { palette: this.themeFlow, phase: anim.phase, colorLevel: anim.colorLevel }, titleMark: anim.beat }
           : {}),
       }));
     }
@@ -1570,6 +1572,7 @@ export class LaunchTui {
         unicode: this.unicode,
         color: this.theme.color,
         colorLevel: detectColorLevel(process.env, isTTY()),
+        palette: this.themeFlow,
       });
       this.cachedArt = fit ? centerBlock(art, innerWidth) : art;
       const track = evolutionTrack(idx, { unicode: this.unicode, color: this.theme.color });

package/src/tui/components/ascii-art.ts

@@ -528,8 +528,12 @@ export function renderForgeMark(opts: {
    *  flowing gradient `phase` this animates the forge identity without any
    *  frame-count growth. */
   frame?: number;
+  /** Gradient palette for the flowing glow. Defaults to the brand `FORGE_FLOW_PALETTE`;
+   *  pass a theme-derived palette (see `themeFlowPalette`) so the mark tracks the theme. */
+  palette?: readonly string[];
 }): string[] {
-  const memoKey = `${opts.grand ? "g" : "c"}|${opts.unicode !== false ? 1 : 0}|${opts.cols ?? -1}|${opts.color !== false ? 1 : 0}|${opts.colorLevel ?? ColorLevel.TrueColor}|${opts.phase ?? 0}|${opts.frame ?? 0}`;
+  const palette = opts.palette ?? FORGE_FLOW_PALETTE;
+  const memoKey = `${opts.grand ? "g" : "c"}|${opts.unicode !== false ? 1 : 0}|${opts.cols ?? -1}|${opts.color !== false ? 1 : 0}|${opts.colorLevel ?? ColorLevel.TrueColor}|${opts.phase ?? 0}|${opts.frame ?? 0}|${palette.join(",")}`;
   const memoHit = forgeMarkMemo.get(memoKey);
   if (memoHit) return memoHit;
   const useUnicode = opts.unicode !== false;
@@ -551,7 +555,7 @@ export function renderForgeMark(opts: {
   const phase = opts.phase ?? 0;
   const useColor = opts.color !== false;
   const colorLevel = opts.colorLevel ?? ColorLevel.TrueColor;
-  const palette = FORGE_FLOW_PALETTE;
+
 
   const result = source.map((line, idx) => {
     const padded = line.length < width ? line + " ".repeat(width - line.length) : line;

package/src/tui/components/themes.ts

@@ -285,6 +285,20 @@ export function accentShadowPaint(theme: EvolutionTheme): (s: string) => string
   return (s: string) => chalk.dim(chalk.hex(hex)(s));
 }
 
+
+/** A 3-stop neon "flow" palette derived from the active theme, for the animated
+ *  forge-card border and the forge mark so the live flow matches the THEME instead
+ *  of a fixed brand palette. Sweeps `accentShadow` → `accent` → the brightest stage
+ *  gradient end (a dark → accent → light shimmer that reads as the theme's own glow).
+ *  Colorless themes collapse to a single accent stop — callers gate the animation on
+ *  color/TrueColor, so the value is only a harmless fallback there. */
+export function themeFlowPalette(theme: EvolutionTheme): readonly string[] {
+  if (!theme.color) return [theme.accent];
+  const bright = theme.gradients[theme.gradients.length - 1]?.to ?? theme.accent;
+  const dark = theme.accentShadow ?? theme.accent;
+  return [dark, theme.accent, bright];
+}
+
 /** Default muted foreground when a theme defines no `muted` — a readable mid-gray
  *  that holds up on dark terminals (unlike ANSI `dim`, which collapses toward the
  *  background). */