jeo-code 0.7.25 → 0.7.27

package/CHANGELOG.md

@@ -6,6 +6,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.27] - 2026-07-02
+_Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks._
+
+### Fixed
+- **Esc and Ctrl+C went DEAD after 0.7.25's keyboard-protocol push — the reported "입력후 esc 키 (또 ctrl+c) 입력이 안되는 문제".** Root cause: `CSI >1u` (kitty disambiguate) makes the terminal re-encode Esc as `CSI 27u` and Ctrl+C as `CSI 99;5u` (xterm modifyOtherKeys=2: `CSI 27;5;99~`) — forms nothing in jeo decoded: readline saw an unknown sequence (key `name: undefined`), the raw-`\u0003` scans never matched, and the mid-turn harness classified both as "noise". New decode layer in `src/commands/launch/input.ts` — `matchExtendedKey`/`decodeExtendedKeys` (kitty CSI-u + xterm modifyOtherKeys → legacy bytes), `chunkHasCtrlC` (all three Ctrl+C encodings), `normalizeKeypress` (CSI-u keypress events → the `{name, ctrl, meta}` shape handlers match; includes the Bun quirk where an unknown CSI emits the literal STRING `"undefined"` as `key.name`) — wired into the prompt key filter, the footer/picker keypress handlers, the raw Ctrl+C byte scan, the pre-prompt typed-input drain, and the mid-turn ESC/Ctrl+C abort harness. Key-release reports (`:3`) and unknown functional codes are swallowed instead of leaking `[57376u`-style garbage into the draft. Cmd/Super+letter no longer types the bare letter.
+- **Copy/paste reliability ("복사붙여넣기가 잘 동작안하는 경우"):** (1) Ctrl+V arrived as `CSI 118;5u` under the kitty protocol — binding dead; now normalized. (2) Ctrl+V with a TEXT clipboard was a silent no-op (binding was image-only); it now falls back to `readClipboardText()` (`pbpaste` / PowerShell `Get-Clipboard -Raw` / `wl-paste`/`xclip`/`xsel`) and inserts at the caret with paste-grade sanitation (ANSI stripped, line breaks → box sentinel — a multi-line clipboard can never self-submit). (3) A trailing `\r\n` outside a paste (Windows CRLF tails) forwarded BOTH bytes — the `\r` submitted and the `\n` leaked into the next prompt as a phantom break/submit; now folds to ONE Enter, including when the CRLF is split across stdin chunk reads (`crTail` filter state). (4) `disableKittyKeyboard()` now POPS the kitty keyboard-mode stack (`CSI <u`) instead of pushing a zero-flags entry that leaked onto the outer shell.
+- **Shift+Enter coverage gaps.** `SHIFT_ENTER_SEQS` covered only 2 encodings (`CSI 27;2;13~`, `CSI 13;2u`); now every modified-Enter form breaks the line: kitty mods 2–6 (Shift/Alt/Ctrl combinations), the xterm modifyOtherKeys equivalents, and legacy alt-as-meta `ESC \r` (macOS Option+Enter, Windows Terminal Alt+Enter).
+- **Adaptive-thinking turns died with "output budget exhausted" because `max_tokens` was the THINKING-LEVEL table (4k–32k), not the model's real output capacity.** On Anthropic adaptive models (Opus 4.6+, Sonnet/Fable/Mythos 5) thinking tokens are spent INSIDE `max_tokens`, so a deep-thinking step competed with its own visible reply inside a 16k–32k budget and could stop at `stop_reason=max_tokens` with zero content. New `resolveMaxOutputTokens(model, level)` (`src/ai/model-manager.ts`) resolves the CATALOG max-output (fable-5: 128k) capped by `JEO_MAX_OUTPUT_TOKENS` (default 64k); the thinking level keeps steering DEPTH via `reasoningEffort`/`output_config` only. Wired through `resolveCall`, both `launch.ts` engine call sites, and `task-tool.ts` subagent spawns.
+- **Safety refusals were retried as "transient provider error" at the transport layer, burning 2 extra billed calls per recovery-ladder rung (observed: 392k input tokens for one refused turn).** A refusal is deterministic for identical conversation content. `isRefusalError` moved to `src/util/retry.ts` (re-exported from `provider-error.ts`) and `defaultRetryable` now fails fast on `stop_reason=refusal` / `finish_reason=content_filter` / Gemini `SAFETY`-family markers — the engine's bounded ladder (which MUTATES context between attempts) is the only retry layer. Same failing turn now costs 190k → recovers.
+- **The refusal ladder could never recover when replayed thinking blocks were the classifier trigger.** Stage 2 ("context reset") only elided tool-result bodies; assistant turns kept `reasoningArtifacts`/`toolUse`, and `buildAnthropicMessages` resent the flagged model-authored thinking blocks verbatim — so a fable-5 turn re-refused through the whole ladder (reproduced deterministically at both 32k and 64k budgets, and at minimal thinking). New `stripReasoningArtifactsInPlace` (`src/agent/compaction.ts`) drops the native replay channel (display `reasoning` text survives) at stage 2, so the next request falls back to plain-text history. Verified live: the exact turn that previously exhausted the ladder now recovers at stage 2 and completes.
+- **`LaunchTui.setLivePromptHighlight` test failed on hosts exporting `NO_COLOR`** (agent harnesses, some CI): `detectColorLevel` honors `NO_COLOR` before `FORCE_COLOR` (no-color.org contract), so the test's `FORCE_COLOR=3` never produced a colored theme. The test now pins `JEO_TUI_THEME=cosmic` and clears `NO_COLOR` for the constructor — deterministic on every host.
+
+### Added
+- **A line-break key on EVERY terminal — the Windows answer ("윈도우환경에 알맞는 단축키").** The lone-LF break rule (`\n` → line break) is now DEFAULT-ON (`JEO_MULTILINE=0` opts out): raw-mode Enter is always `\r`, so a bare `\n` can only be Ctrl+J (universal) or Ctrl+Enter (Windows Terminal/conhost) — both now insert a break with zero terminal configuration. Plus the Claude-Code `\`+Enter convention: Enter on a draft ending in `\` (caret at end) replaces the backslash with a line break — works even on terminals with no Shift+Enter protocol at all (conhost, Terminal.app).
+- **Whole-draft jumps: Ctrl+Home/Ctrl+End (Windows/Linux) and Cmd+↑/Cmd+↓ (macOS kitty-protocol) move the caret to the start/end of the entire draft (`DOC_HOME_SEQS`/`DOC_END_SEQS`), complementing the row-aware Cmd+←/→ and Home/End from 0.7.25.** Sequences are consumed even when no readline is attached, so modifier-arrow params can never leak into the draft as literal text.
+- `/hotkeys` documents the break keys, row/draft jumps, and the Ctrl+V text fallback (18 → 21 rows).
+
+### Verified
+- `bun run typecheck` clean; full suite green — 2104 pass / 0 fail across 240 files. New `test/extended-key-decode.test.ts`: 21 tests / 85 assertions across all six consumer layers (decoder, whole-string decode, Ctrl+C matcher, keypress normalizer, prompt filter, abort harness, clipboard paste command) — mutation-checked (flipping the ctrl-bit test reddens 6 tests).
+- Live probes through the REAL implementation (Bun eval, no PTY): kitty Esc keypress normalizes to `escape`; all 3 Ctrl+C encodings detected; 7 break encodings → sentinel; Cmd+←/→ land on row boundaries; Ctrl+Home/Cmd+↓ land on draft edges; trailing and split CRLF fold to one Enter; `\`+Enter emits backspace+break; mid-turn kitty Esc aborts with "ESC pressed…", kitty Ctrl+C hard-exits; Cmd+C is swallowed as input yet visible as `meta+c` to the clear-input binding.
+- Anthropic budget/refusal fixes: affected suites green (`model-manager`, `anthropic-stream`, `model-catalog`, `retry`, `provider-error`, `refusal-recovery`, `compaction`) with 6 new test cases; live E2E (fable-5, xhigh, OAuth) — the previously-blocked multi-step turn completes end-to-end, stage 2 logs "reset 2 tool result(s) and dropped thinking replay from 3 turn(s)".
+
+## [0.7.26] - 2026-07-02
+_Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits._
+
+### Fixed
+- **Esc (and meta-mapped Cmd+C) at the prompt intermittently did nothing.** A prior fix reordered the Esc check ahead of the `previewPending` reentrancy gate, but missed an earlier, more totalizing `!previewArmed || pickerActive` gate that Ctrl+C already bypassed (checked first) while Esc did not — so a fresh session's very first Esc after typing could be silently swallowed. The Esc/meta+C check now runs immediately after the Ctrl+C check, before that gate, mirroring Ctrl+C's existing precedent. Verified live in a real `jeo` TUI (tmux-driven keystrokes): 10/10 fresh-session repro attempts now clear the box; previously flaky.
+- **Un-bracketed multi-line paste shredded into separate premature submits.** Terminals/paths that deliver a multi-line paste as ONE stdin chunk WITHOUT bracketed-paste markers (DECSET 2004) — e.g. a raw X11 primary-selection middle-click paste, some SSH clients, or a tmux `paste-buffer` binding without `-p` — hit `filterPromptInputChunk`'s bare `\r`/`\n` pass-through and had each embedded line submitted as its own message mid-composition instead of landing as one multi-line draft. Reproduced live: pasting `"first line\nsecond line\nthird line"` via an un-bracketed tmux paste immediately submitted line 1 to the model, leaving the rest to leak in as orphaned lines. Fixed with a guard in `src/commands/launch/input.ts`: outside an active bracketed paste, a linebreak with MORE data after it in the SAME synchronous chunk (impossible for a genuine standalone Enter keypress, which always arrives as the last byte of its read) now folds to the multi-line sentinel instead of submitting — matching the bracketed-paste contract (review the whole block, then press Enter once). A trailing linebreak with nothing after it is unaffected and still submits normally.
+
+### Verified
+- `bun run typecheck` clean; full suite green — 2077 pass / 0 fail across 239 files (4 new cases in `test/prompt-key-filter.test.ts` covering the un-bracketed paste guard, including a no-false-positive check for ordinary single-line typing).
+- Both fixes reproduced and confirmed live in a real running `jeo --no-session` TUI inside tmux (not just unit tests): the exact 3-line un-bracketed paste that previously triggered a premature submit now stays as one multi-line draft, and Esc immediately clears it.
+
 ## [0.7.25] - 2026-07-02
 _Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts._
 

package/README.ja.md

@@ -205,11 +205,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
+- **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
 - **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 - **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
-- **[0.7.22]** (2026-06-30) — gajae-code 0.7.3–0.7.8 parity sweep: terminal-bell notifications, a gruvbox-dark TUI theme, a resilient `jeo update` runtime check, and an ultragoal artifact gate. Ports the user-facing improvements from upstream gajae-code that jeo did not yet have, re-implemented to fit jeo's config, command, theming, and skill surfaces.
-- **[0.7.21]** (2026-06-26) — Global llm-wiki vault integration, Gemini/Antigravity thinking indicators, generous file-reading windows, and autopilot flag validation. Adds a shared global wiki root configuration with a /wiki slash command, fires reasoning start signals up front for Gemini/Antigravity models, adjusts the large-file reading discipline to use generous windows, and validates autopilot goal and integer flags.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -205,11 +205,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
+- **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
 - **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 - **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
-- **[0.7.22]** (2026-06-30) — gajae-code 0.7.3–0.7.8 parity sweep: terminal-bell notifications, a gruvbox-dark TUI theme, a resilient `jeo update` runtime check, and an ultragoal artifact gate. Ports the user-facing improvements from upstream gajae-code that jeo did not yet have, re-implemented to fit jeo's config, command, theming, and skill surfaces.
-- **[0.7.21]** (2026-06-26) — Global llm-wiki vault integration, Gemini/Antigravity thinking indicators, generous file-reading windows, and autopilot flag validation. Adds a shared global wiki root configuration with a /wiki slash command, fires reasoning start signals up front for Gemini/Antigravity models, adjusts the large-file reading discipline to use generous windows, and validates autopilot goal and integer flags.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -232,11 +232,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
+- **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
 - **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 - **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
-- **[0.7.22]** (2026-06-30) — gajae-code 0.7.3–0.7.8 parity sweep: terminal-bell notifications, a gruvbox-dark TUI theme, a resilient `jeo update` runtime check, and an ultragoal artifact gate. Ports the user-facing improvements from upstream gajae-code that jeo did not yet have, re-implemented to fit jeo's config, command, theming, and skill surfaces.
-- **[0.7.21]** (2026-06-26) — Global llm-wiki vault integration, Gemini/Antigravity thinking indicators, generous file-reading windows, and autopilot flag validation. Adds a shared global wiki root configuration with a /wiki slash command, fires reasoning start signals up front for Gemini/Antigravity models, adjusts the large-file reading discipline to use generous windows, and validates autopilot goal and integer flags.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -205,11 +205,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
+- **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
 - **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 - **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
-- **[0.7.22]** (2026-06-30) — gajae-code 0.7.3–0.7.8 parity sweep: terminal-bell notifications, a gruvbox-dark TUI theme, a resilient `jeo update` runtime check, and an ultragoal artifact gate. Ports the user-facing improvements from upstream gajae-code that jeo did not yet have, re-implemented to fit jeo's config, command, theming, and skill surfaces.
-- **[0.7.21]** (2026-06-26) — Global llm-wiki vault integration, Gemini/Antigravity thinking indicators, generous file-reading windows, and autopilot flag validation. Adds a shared global wiki root configuration with a /wiki slash command, fires reasoning start signals up front for Gemini/Antigravity models, adjusts the large-file reading discipline to use generous windows, and validates autopilot goal and integer flags.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "jeo-code",
-  "version": "0.7.25",
+  "version": "0.7.27",
+
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/compaction.ts

@@ -147,6 +147,30 @@ export function trimToolResultsInPlace(
   return { trimmed, tokens };
 }
 
+/**
+ * Refusal-recovery companion to `trimToolResultsInPlace`: drop provider-native
+ * reasoning artifacts (and native tool-use replay records) from ASSISTANT turns
+ * so the next request replays plain text instead of native thinking blocks.
+ *
+ * Why: Anthropic's refusal classifier judges the WHOLE resent conversation, and
+ * replayed `thinking` blocks are model-authored content — the usual trip wire
+ * that tool-result eliding cannot clear (field case: a fable-5 turn re-refused
+ * through the entire ladder because every resend replayed the flagged thinking
+ * blocks verbatim). Messages are REPLACED, never mutated (identity caches).
+ * Display fields (`reasoning`) are kept — only the wire-replay channel is cut.
+ */
+export function stripReasoningArtifactsInPlace(history: Message[]): number {
+  let stripped = 0;
+  for (let i = 0; i < history.length; i++) {
+    const m = history[i]!;
+    if (m.role !== "assistant" || (!m.reasoningArtifacts?.length && !m.toolUse?.length)) continue;
+    const { reasoningArtifacts: _artifacts, toolUse: _toolUse, ...rest } = m;
+    history[i] = rest;
+    stripped++;
+  }
+  return stripped;
+}
+
 /**
  * Accurate BPE token total for a history, summing `countTokensAccurate` per
  * message (+1 per message for role/separator overhead, mirroring

package/src/agent/engine.ts

@@ -21,7 +21,7 @@ import { runPreToolHooks, runPostTurnHooksForBatch } from "./hooks";
 import { truncateToolOutput, formatToolResultBody } from "./tool-output";
 export { TOOL_OUTPUT_MAX, READ_OUTPUT_MAX, TOOL_SPILL_THRESHOLD, MAX_TOOL_ARTIFACTS, truncateToolOutput, spillToolResult } from "./tool-output";
 import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSignature, type StepBudgetConfig } from "./step-budget";
-import { historyTokens, trimToolResultsInPlace } from "./compaction";
+import { historyTokens, trimToolResultsInPlace, stripReasoningArtifactsInPlace } from "./compaction";
 import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, repeatHint, classifyDoneGate } from "./loop-guards";
 import { stripLeakedReasoningTags } from "../ai/think-tags";
@@ -611,9 +611,17 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
         }
         if (refusalRetries === 2) {
           const res = trimToolResultsInPlace(history, { budgetTokens: 0, keepRecent: 0 });
+          // Also cut the native thinking-block replay channel: refusals judge the WHOLE
+          // resent conversation, and replayed (model-authored) thinking blocks are the
+          // trip wire tool-result eliding can't clear — with artifacts stripped the next
+          // request falls back to plain-text history (same shape as the 400 fail-safe).
+          const strippedTurns = stripReasoningArtifactsInPlace(history);
+          const parts: string[] = [];
+          if (res.trimmed > 0) parts.push(`reset ${res.trimmed} tool result(s)`);
+          if (strippedTurns > 0) parts.push(`dropped thinking replay from ${strippedTurns} turn(s)`);
           ev.onNotice?.(
-            res.trimmed > 0
-              ? `provider refused again — reset ${res.trimmed} tool result(s) from the context and retrying (refusals require a context reset)`
+            parts.length
+              ? `provider refused again — ${parts.join(" and ")} and retrying (refusals require a context reset)`
               : "provider refused again — continuing with a fresh instruction",
           );
           history.push({

package/src/agent/task-tool.ts

@@ -27,7 +27,7 @@ import {
   subagentRoleIds,
   validateSubagentDoneReason,
 } from "./subagents";
-import { thinkingMaxTokens } from "../ai/model-manager";
+import { resolveMaxOutputTokens } from "../ai/model-manager";
 import type { SubagentRegistry } from "./subagent-registry";
 
 /** Lifecycle event emitted while a delegated subagent runs. */
@@ -219,7 +219,7 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       cwd,
       model,
       maxSteps,
-      maxTokens: thinking ? thinkingMaxTokens(thinking) : undefined,
+      maxTokens: resolveMaxOutputTokens(model, thinking),
       // Bounded delegation: a subagent's step contract stays exact — the parent
       // owns any retry/extension decision, so the gjc retry flow is disabled here.
       budget: { maxExtensions: 0 },

package/src/ai/model-manager.ts

@@ -6,7 +6,7 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, findCatalogModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { OPENAI_COMPAT_NAMES, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
 import { withRetry, defaultRetryable, type RetryOptions } from "../util/retry";
@@ -100,6 +100,32 @@ export function thinkingMaxTokens(level?: "minimal" | "low" | "medium" | "high"
   return 16000;
 }
 
+/** Default cap for the catalog-derived output budget. 64k covers every real coding
+ *  turn (large writes + deep adaptive thinking) while staying clear of the admission
+ *  429 risk that a blanket 128k `max_tokens` carries on low-tier API keys. */
+const DEFAULT_MAX_OUTPUT_CAP = 64_000;
+
+/** Output-token budget for a call (gjc/omp parity): the model's CATALOG max-output,
+ *  capped by JEO_MAX_OUTPUT_TOKENS (default 64k) — NOT the thinking-level table.
+ *
+ *  Rationale: on Anthropic adaptive-thinking models (Sonnet/Fable/Mythos 5, Opus 4.6+)
+ *  thinking tokens are spent INSIDE `max_tokens`. Deriving `max_tokens` from the
+ *  thinking level (4k–32k) makes thinking and the visible reply compete for the same
+ *  small budget, so a deep-thinking step dies with `stop_reason=max_tokens` and no
+ *  content ("output budget exhausted" dead turns). The thinking level keeps steering
+ *  DEPTH via reasoningEffort/output_config; it no longer constrains output size.
+ *  Uncatalogued models (local/live ids) keep the legacy thinking-table budget. */
+export function resolveMaxOutputTokens(
+  model?: string,
+  level?: "minimal" | "low" | "medium" | "high" | "xhigh",
+): number {
+  const meta = model ? findCatalogEntry(expandAlias(model, ALIAS_DEFAULTS)) : undefined;
+  if (!meta) return thinkingMaxTokens(level);
+  const envCap = Number(jeoEnv("MAX_OUTPUT_TOKENS"));
+  const cap = Number.isFinite(envCap) && envCap > 0 ? envCap : DEFAULT_MAX_OUTPUT_CAP;
+  return Math.min(findCatalogModel(meta.id)?.maxOutputTokens ?? cap, cap);
+}
+
 /** Map the thinking level to an OpenAI reasoning-effort tier. minimal/low/medium/high pass
  *  through unchanged and xhigh folds to high (the deepest tier the provider APIs accept), so
  *  reasoning works at EVERY thinking level (gajae parity: minimal is a real effort). Only an
@@ -339,7 +365,7 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
     model: providerModelFor(model),
     systemPrompt: options.systemPrompt,
     temperature: options.temperature ?? 0.2,
-    maxTokens: options.maxTokens ?? thinkingMaxTokens(config.thinkingLevel),
+    maxTokens: options.maxTokens ?? resolveMaxOutputTokens(model, config.thinkingLevel),
     jsonMode: options.jsonMode,
     baseUrl,
     numCtx: options.numCtx ?? (provider === "ollama" ? (config as { ollamaNumCtx?: number }).ollamaNumCtx : undefined),

package/src/ai/providers/anthropic.ts

@@ -225,7 +225,12 @@ export function anthropicPayload(
   const model = stripAnthropicPrefix(options.model);
   const systemPrompt = options.systemPrompt ?? messages.find(m => m.role === "system")?.content;
   // Image attachments + native tool/thinking-block reconstruction live in buildAnthropicMessages.
-  const maxTokens = options.maxTokens ?? 4000;
+  // Non-streaming requests must finish inside Anthropic's ~10-minute HTTP window; a
+  // 64k+ budget can exceed it on a slow generation. 32k (the proven xhigh ceiling)
+  // stays safe; the stream path carries the full catalog-derived budget.
+  const NON_STREAM_MAX_TOKENS = 32_000;
+  const requestedMax = options.maxTokens ?? 4000;
+  const maxTokens = stream ? requestedMax : Math.min(requestedMax, NON_STREAM_MAX_TOKENS);
   const effort = options.reasoningEffort;
   const thinkingEnabled = effort !== undefined;
   // gjc parity: pick the thinking transport per model. Adaptive (Opus/Sonnet 4.6+) carries NO

package/src/commands/launch/input.ts

@@ -349,7 +349,11 @@ export function queuePromptInputChunk(state: PromptInputQueue, chunk: string): b
       const plain = start === -1 ? rest : rest.slice(0, start);
       if (start !== -1) state.inPaste = true;
       rest = start === -1 ? "" : rest.slice(start + PASTE_START.length);
-      if (feedTypedSegment(state, stripMouseReports(plain))) accepted = true;
+      // Decode kitty/MOK re-encodings first so a typed segment behaves identically
+      // whichever keyboard protocol the terminal negotiated. (Preserved Shift+Enter
+      // forms still carry ESC, so feedTypedSegment rejects such segments — exactly
+      // what the legacy byte path did.)
+      if (feedTypedSegment(state, decodeExtendedKeys(stripMouseReports(plain)))) accepted = true;
     }
   }
   return accepted;
@@ -449,11 +453,15 @@ export function createInFlightAbortHarness(opts: AbortHarnessOptions = {}): InFl
 
   const handleData = (chunk: string | Uint8Array) => {
     if (!captureEsc || controller.signal.aborted) return;
-    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
-    if (text.includes(PASTE_START) || opts.pasteActive?.()) {
-      opts.onBufferedInput?.(text);
+    const raw = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    if (raw.includes(PASTE_START) || opts.pasteActive?.()) {
+      opts.onBufferedInput?.(raw);
       return;
     }
+    // Kitty/modifyOtherKeys re-encodings → legacy bytes FIRST, so Esc (`CSI 27u`) and
+    // Ctrl+C (`CSI 99;5u` / `CSI 27;5;99~`) cancel a live turn on every terminal —
+    // previously they fell into the "noise" branch and did NOTHING mid-turn.
+    const text = decodeExtendedKeys(raw);
     if (text === "\u000f") {
       opts.onDetailKey?.();
       return;
@@ -553,10 +561,19 @@ export function decideCtrlC(
   return hasInput ? "clear" : "exit";
 }
 
-/** Shift+Enter encodings the box rewrites to a hard-break SENTINEL: the xterm
- *  `modifyOtherKeys` form (`CSI 27;2;13~`) and the kitty keyboard-protocol form
- *  (`CSI 13;2u`). Shared by the live input filter and its tests so they can't drift. */
-export const SHIFT_ENTER_SEQS: readonly string[] = ["\u001b[27;2;13~", "\u001b[13;2u"];
+/** Shift+Enter encodings the box rewrites to a hard-break SENTINEL. Covers every
+ *  encoding a real terminal produces for a modified Enter:
+ *   - xterm `modifyOtherKeys` (`CSI 27;<mod>;13~`): Shift=2, Alt=3, Ctrl=5, …
+ *   - kitty keyboard protocol (`CSI 13;<mod>u`), same modifier digits
+ *   - `ESC \r` — alt-as-meta Alt+Enter (macOS Option+Enter, Windows Terminal Alt+Enter)
+ *  Shift/Alt/Ctrl+Enter all mean "insert a line break" (no terminal distinguishes them
+ *  usefully for a prompt), so every modified-Enter form maps to the SAME sentinel.
+ *  Shared by the live input filter and its tests so they can't drift. */
+export const SHIFT_ENTER_SEQS: readonly string[] = [
+  "\u001b[27;2;13~", "\u001b[27;3;13~", "\u001b[27;5;13~", "\u001b[27;4;13~", "\u001b[27;6;13~",
+  "\u001b[13;2u", "\u001b[13;3u", "\u001b[13;5u", "\u001b[13;4u", "\u001b[13;6u",
+  "\u001b\r",
+];
 /** Sequences that should jump the caret to the START of the current VISUAL ROW: macOS
  *  Cmd+Left (`CSI 1;9D`) and the platform-neutral Home key in both its xterm (`CSI H`)
  *  and vt220 (`CSI 1~`) forms, plus the SS3 variant (`ESC O H`) some terminals send in
@@ -567,6 +584,173 @@ export const ROW_HOME_SEQS: readonly string[] = ["\u001b[1;9D", "\u001b[H", "\u0
 /** Mirror of {@link ROW_HOME_SEQS} for the END of the current visual row: macOS
  *  Cmd+Right (`CSI 1;9C`) and the xterm/vt220/SS3 End key forms. */
 export const ROW_END_SEQS: readonly string[] = ["\u001b[1;9C", "\u001b[F", "\u001b[4~", "\u001bOF"];
+/** Sequences that jump to the START of the WHOLE draft: Ctrl+Home (the Windows/Linux
+ *  document-start convention, xterm `CSI 1;5H`) and macOS Cmd+Up (`CSI 1;9A`). */
+export const DOC_HOME_SEQS: readonly string[] = ["\u001b[1;5H", "\u001b[1;9A"];
+/** Mirror of {@link DOC_HOME_SEQS} for the END of the draft: Ctrl+End / Cmd+Down. */
+export const DOC_END_SEQS: readonly string[] = ["\u001b[1;5F", "\u001b[1;9B"];
+
+/** Matches ONE extended-keyboard escape at `s[i]` — the kitty CSI-u form
+ *  (`CSI <code>;<mods>[:<event>]u`) or the xterm modifyOtherKeys form
+ *  (`CSI 27;<mods>;<code>~`) — and returns its decoded LEGACY bytes plus length.
+ *
+ *  jeo asks the terminal for BOTH protocols at the prompt (they make Shift+Enter
+ *  distinguishable), but that also re-encodes keys the rest of the REPL matches by
+ *  their classic bytes: under kitty flag 1, Esc arrives as `CSI 27u` (readline sees
+ *  an unknown sequence — the "esc가 안 먹힘" bug) and Ctrl+C as `CSI 99;5u` (no
+ *  `\u0003` byte anywhere — Ctrl+C dead); xterm modifyOtherKeys=2 re-encodes them as
+ *  `CSI 27;<m>;27~`/`CSI 27;5;99~`. This decoder maps every such form BACK to the
+ *  legacy byte(s) so readline, the SIGINT paths, and the mid-turn ESC/abort harness
+ *  keep working identically whichever protocol the terminal negotiated.
+ *
+ *  Modified-Enter forms are NOT decoded here — they are matched (earlier) against
+ *  {@link SHIFT_ENTER_SEQS} and become the hard-break sentinel; if one reaches this
+ *  decoder (a non-filter consumer), it decodes to "" (swallowed) rather than \r so a
+ *  Shift+Enter can never SUBMIT a draft. Key-RELEASE events (kitty `:3` suffix, only
+ *  sent when a flag-2 terminal leaked them) and unknown codes (F-keys, media keys)
+ *  decode to "" — swallowed, never leaked as literal text. */
+export function matchExtendedKey(s: string, i: number): { out: string; len: number } | null {
+  if (!s.startsWith("\u001b[", i)) return null;
+  const win = s.slice(i, i + 24);
+  // xterm modifyOtherKeys: CSI 27 ; <mods> ; <code> ~
+  const mok = /^\u001b\[27;(\d+);(\d+)~/.exec(win);
+  if (mok) return { out: decodeExtendedCode(Number(mok[2]), Number(mok[1])), len: mok[0].length };
+  // kitty CSI-u: CSI <code> [; <mods> [: <event>]] u
+  const u = /^\u001b\[(\d+)(?:;(\d+)(?::(\d+))?)?u/.exec(win);
+  if (!u) return null;
+  const event = u[3] ? Number(u[3]) : 1;
+  if (event === 3) return { out: "", len: u[0].length }; // key release — never input
+  return { out: decodeExtendedCode(Number(u[1]), u[2] ? Number(u[2]) : 1), len: u[0].length };
+}
+
+/** Legacy bytes for one extended-key (code, modifier) pair. Unknown codes (the kitty
+ *  functional-key range — F-keys, media keys, non-ASCII code points with modifiers)
+ *  decode to "" — the report is SWALLOWED, never leaked into the draft as literal
+ *  `[57376u`-style text. `mods` is the CSI modifier value: 1 + bitmask, where
+ *  Shift=1, Alt=2, Ctrl=4, Super=8 (so 1 = unmodified, 2 = Shift, 5 = Ctrl, …). */
+function decodeExtendedCode(code: number, mods: number): string {
+  const bits = Math.max(0, mods - 1);
+  const ctrl = (bits & 4) !== 0;
+  const alt = (bits & 2) !== 0;
+  const superMod = (bits & 8) !== 0;
+  // Esc — any modifier still means "escape" to the prompt.
+  if (code === 27) return "\u001b";
+  // Enter/Tab/Backspace/Space in their MODIFIED forms; unmodified ones arrive as
+  // legacy bytes already. Modified Enter is handled by SHIFT_ENTER_SEQS before this
+  // decoder runs in the filter; anywhere else it must not fabricate a submit → "".
+  if (code === 13) return mods <= 1 ? "\r" : "";
+  if (code === 9) {
+    if (bits === 1) return "\u001b[Z"; // Shift+Tab — readline's back-complete form
+    return "\t";
+  }
+  if (code === 127 || code === 8) {
+    if (alt) return "\u001b\u007f";  // Alt/Option+Backspace → backward-kill-word
+    if (ctrl) return "\u0017";       // Ctrl+Backspace (Windows word-delete) → Ctrl+W
+    return "\u007f";
+  }
+  if (code === 32) return ctrl ? "\u0000" : " ";
+  // Printable ASCII. Ctrl+letter → C0 control byte (Ctrl+C → \u0003); Alt+key →
+  // ESC-prefixed meta form readline understands (Alt+b/f word motion, …).
+  if (code >= 33 && code <= 126) {
+    // Cmd/Super+key has NO legacy byte encoding — swallow it rather than insert the
+    // bare letter into the draft (Cmd+C reaching the app must not type a "c";
+    // normalizeKeypress still reports it as meta+c for the clear-input binding).
+    if (superMod && !ctrl && !alt) return "";
+    const ch = String.fromCharCode(code);
+    if (ctrl && code >= 97 && code <= 122) {
+      const ctl = String.fromCharCode(code - 96);
+      return alt ? `\u001b${ctl}` : ctl;
+    }
+    if (ctrl && "@[\\]^_".includes(ch)) {
+      return String.fromCharCode(ch.charCodeAt(0) & 0x1f);
+    }
+    if (alt) return `\u001b${ch}`;
+    return ch; // Shift-only / unmodified: the terminal already applied the shift
+  }
+  return "";
+}
+
+/** Decode every extended-keyboard escape (kitty CSI-u / xterm modifyOtherKeys) in `s`
+ *  to its legacy bytes, leaving all other bytes untouched. Modified-Enter forms in
+ *  {@link SHIFT_ENTER_SEQS} are preserved verbatim (the caller decides their meaning).
+ *  Used by every RAW-stdin consumer that matches classic control bytes — the mid-turn
+ *  ESC/Ctrl+C harness and the live-turn input capture — so keys keep working when the
+ *  terminal negotiated an extended keyboard protocol. */
+export function decodeExtendedKeys(s: string): string {
+  if (!s.includes("\u001b")) return s; // fast path: plain text / large pastes
+  let out = "";
+  let i = 0;
+  while (i < s.length) {
+    const breakSeq = SHIFT_ENTER_SEQS.find(seq => s.startsWith(seq, i));
+    if (breakSeq) { out += breakSeq; i += breakSeq.length; continue; }
+    const ext = matchExtendedKey(s, i);
+    if (ext) { out += ext.out; i += ext.len; continue; }
+    out += s[i];
+    i += 1;
+  }
+  return out;
+}
+
+/** True when a RAW stdin chunk contains a Ctrl+C in ANY encoding — the legacy
+ *  `\u0003` byte, kitty CSI-u (`CSI 99;5u`), or xterm modifyOtherKeys
+ *  (`CSI 27;5;99~`). The single test every "did the user press Ctrl+C?" byte
+ *  scan must use once an extended keyboard protocol may be active. */
+export function chunkHasCtrlC(chunk: string): boolean {
+  if (chunk.includes("\u0003")) return true;
+  return chunk.includes("\u001b") && decodeExtendedKeys(chunk).includes("\u0003");
+}
+
+/** The subset of readline's keypress event the prompt handlers switch on. */
+export interface NormalizedKey {
+  name?: string;
+  ctrl?: boolean;
+  meta?: boolean;
+  shift?: boolean;
+  sequence?: string;
+}
+
+/** Normalize a readline `keypress` event for the prompt's stdin listeners.
+ *
+ *  Node/Bun's keypress decoder does not know the kitty CSI-u or xterm
+ *  modifyOtherKeys encodings: Esc arrives as `{ sequence: "\u001b[27u", name:
+ *  undefined }`, Ctrl+C as `{ sequence: "\u001b[99;5u" }`, and every `key?.name`
+ *  check in the footer/picker handlers falls through — the idle-prompt half of the
+ *  "esc/ctrl+c가 안 먹힘" bug. This maps such events back to the `{ name, ctrl,
+ *  meta, shift }` shape those handlers already match on; every other event is
+ *  returned unchanged. */
+export function normalizeKeypress(key: NormalizedKey | undefined): NormalizedKey | undefined {
+  const seq = key?.sequence;
+  // Bun quirk (verified live): an unrecognized CSI emits `name: "undefined"` — the
+  // literal STRING — where Node emits `name: undefined`. Treat both as unnamed.
+  const unnamed = key?.name === undefined || key?.name === "undefined";
+  if (!key || !seq || !unnamed) return key;
+  // Parse the raw sequence directly (kitty CSI-u first, then xterm modifyOtherKeys)
+  // instead of round-tripping through the byte decoder: Cmd/Super-modified keys
+  // decode to "" (swallowed as INPUT) yet must still normalize to a named EVENT so
+  // bindings like "meta+c clears the box" can see them.
+  const u = /^\u001b\[(\d+)(?:;(\d+)(?::(\d+))?)?u$/.exec(seq);
+  const mok = u ? null : /^\u001b\[27;(\d+);(\d+)~$/.exec(seq);
+  if (!u && !mok) return key;
+  const code = u ? Number(u[1]) : Number(mok![2]);
+  const mods = u ? (u[2] ? Number(u[2]) : 1) : Number(mok![1]);
+  const event = u?.[3] ? Number(u[3]) : 1;
+  if (event === 3) return key; // key release — leave unnamed (inert)
+  const bits = Math.max(0, mods - 1);
+  const flags = {
+    ctrl: (bits & 4) !== 0,
+    meta: (bits & 2) !== 0 || (bits & 8) !== 0, // Alt or Super both read as "meta"
+    shift: (bits & 1) !== 0,
+  };
+  if (code === 27) return { ...key, ...flags, name: "escape", ctrl: false };
+  if (code === 13) return { ...key, ...flags, name: "return" };
+  if (code === 9) return { ...key, ...flags, name: "tab" };
+  if (code === 127 || code === 8) return { ...key, ...flags, name: "backspace" };
+  if (code === 32) return { ...key, ...flags, name: "space" };
+  if (code >= 33 && code <= 126) {
+    return { ...key, ...flags, name: String.fromCharCode(code).toLowerCase() };
+  }
+  return key;
+}
 
 
 /** Minimal readline view the prompt key-filter reads (and mutates `cursor` on a
@@ -600,6 +784,11 @@ export interface PromptKeyFilterEnv {
 export interface PromptKeyFilterState {
   inPaste: boolean;
   carry?: string;
+  /** The previous chunk's forwarded output ended in a bare `\r` (Enter). A `\n` at the
+   *  START of the next chunk is then the second half of a split CRLF — swallow it, or
+   *  (with the default-on lone-LF rule) it would insert a phantom break at the fresh
+   *  prompt. */
+  crTail?: boolean;
 }
 
 /** Length of the longest trailing run of `data` that is a PROPER prefix of a
@@ -674,6 +863,11 @@ export function filterPromptInputChunk(
     state.carry = "\r";
     data = data.slice(0, data.length - 1);
   }
+  // Second half of a CRLF split across chunk reads (previous chunk's output ended in
+  // `\r` = Enter): the leading `\n` here is the SAME keystroke/paste tail, not a new
+  // break — swallow it before the lone-LF rule can see it.
+  if (state.crTail && !state.inPaste && data.startsWith("\n")) data = data.slice(1);
+  state.crTail = false;
   // Empty-line Backspace guard: a standalone Backspace with an empty buffer is a no-op
   // that some Bun readline builds turn into a spurious `close` (hard exit) — drop it
   // before it reaches readline. Forwarded normally inside a paste or with text present.
@@ -732,9 +926,29 @@ export function filterPromptInputChunk(
       i += seq.length;
       continue;
     }
+    // Whole-draft jumps: Ctrl+Home/Ctrl+End (Windows/Linux document-start/end) and
+    // macOS Cmd+Up/Cmd+Down. Same consume-and-move contract as the row-edge branch.
+    const docEdge = DOC_HOME_SEQS.find(seq => data.startsWith(seq, i)) !== undefined ? "start"
+      : DOC_END_SEQS.find(seq => data.startsWith(seq, i)) !== undefined ? "end"
+      : undefined;
+    if (docEdge) {
+      const seq = (docEdge === "start" ? DOC_HOME_SEQS : DOC_END_SEQS).find(s => data.startsWith(s, i))!;
+      // Without an rl handle there is nothing to move — still CONSUME the sequence
+      // so `1;9A`-style params can never leak into the draft as literal text.
+      if (rl) rl.cursor = docEdge === "start" ? 0 : (rl.line ?? "").length;
+      i += seq.length;
+      continue;
+    }
 
     const combo = matchCursorCombo(data, i);
     if (combo) { out += combo[1]; i += combo[0].length; continue; }
+    // Extended-keyboard re-encodings (kitty CSI-u / xterm modifyOtherKeys): decode back
+    // to the legacy byte(s) so Esc (`CSI 27u`), Ctrl+C (`CSI 99;5u` / `CSI 27;5;99~`),
+    // Ctrl+V and friends keep working after jeo enables those protocols for Shift+Enter.
+    // Without this, readline receives an unknown sequence and the key is simply DEAD —
+    // the reported "esc 키 (또 ctrl+c) 입력이 안되는 문제".
+    const ext = matchExtendedKey(data, i);
+    if (ext) { out += ext.out; i += ext.len; continue; }
     // Up/Down between the box's visual rows (textarea feel) for any MULTI-ROW draft;
     // at the top/bottom edge a soft-wrapped one-liner falls through to history recall,
     // but a genuine multi-line draft swallows the key (the "↓ cuts text" fix).
@@ -751,12 +965,51 @@ export function filterPromptInputChunk(
       }
       out += data.slice(i, i + 3); i += 3; continue;
     }
-    if (env.loneLfShiftEnter && data[i] === "\n") { out += MULTILINE_SENTINEL; i += 1; continue; } // lone LF = Shift+Enter (opt-in)
+    // Un-bracketed multi-line paste guard: some terminals/multiplexers (a raw X11
+    // primary-selection middle-click paste, certain SSH clients, or a tmux binding
+    // that omits `-p`) deliver a multi-line paste as ONE stdin chunk WITHOUT the
+    // bracketed-paste markers this filter otherwise relies on (PASTE_START/PASTE_END
+    // above). Outside an active bracketed paste, readline treats every bare `\r`/`\n`
+    // as Enter — so an un-bracketed 3-line paste submitted line 1 immediately, mid-
+    // composition, and left the rest to leak in as separate prompts (the "붙여넣기가
+    // 잘 안됨" bug: works for single-line/bracketed paste, corrupts multi-line paste
+    // when the terminal doesn't negotiate DECSET 2004). A genuine Enter keypress is
+    // always the LAST byte of its chunk — raw mode delivers one keystroke per read —
+    // so a linebreak with MORE data after it in the SAME synchronous chunk can only be
+    // a paste (or a scripted multi-line feed); fold it to the sentinel instead of
+    // submitting, matching the bracketed-paste contract (review the whole block, then
+    // press Enter once to submit). A trailing linebreak (nothing after it) keeps the
+    // existing behavior below — including the opt-in lone-LF Shift+Enter rule.
+    const bareBreakLen = data.startsWith("\r\n", i) ? 2 : (data[i] === "\r" || data[i] === "\n") ? 1 : 0;
+    if (bareBreakLen > 0 && i + bareBreakLen < data.length) { out += MULTILINE_SENTINEL; i += bareBreakLen; continue; }
+    // A TRAILING `\r\n` outside a paste is ONE Enter (Windows CRLF clipboard tails,
+    // terminals that transmit CRLF): forward a single `\r`. Previously the `\r`
+    // submitted and the `\n` leaked into the NEXT prompt as a phantom extra submit
+    // (or, with the lone-LF rule, a phantom break) — one of the "붙여넣기가 잘
+    // 동작안하는 경우".
+    if (data.startsWith("\r\n", i) && i + 2 === data.length) { out += "\r"; i += 2; continue; }
+    // Backslash continuation (Claude-Code convention, works on EVERY terminal even
+    // without a Shift+Enter protocol — the Windows-safe fallback): Enter on a draft
+    // ending in `\` (caret at the end) replaces the backslash with a line break
+    // instead of submitting. Emitted as backspace + sentinel so readline's buffer
+    // stays the single source of truth.
+    if (
+      data[i] === "\r" && i + 1 === data.length && i === 0 && rl &&
+      (rl.line ?? "").endsWith("\\") &&
+      (typeof rl.cursor !== "number" || rl.cursor === (rl.line ?? "").length)
+    ) {
+      out += `\u007f${MULTILINE_SENTINEL}`;
+      i += 1;
+      continue;
+    }
+    if (env.loneLfShiftEnter && data[i] === "\n") { out += MULTILINE_SENTINEL; i += 1; continue; } // lone LF = Shift+Enter (default-on; JEO_MULTILINE=0 opts out)
+
     // Ctrl+L (form feed): the prompt redraw hotkey, handled on the process.stdin keypress
     // listener — never forward it to readline as a literal char.
     if (data[i] === "\u000c") { i += 1; continue; }
     out += data[i]; i += 1;
   }
+  state.crTail = !state.inPaste && out.endsWith("\r");
   return { out, drop: false };
 }
 

package/src/commands/launch/slash-views.ts

@@ -13,7 +13,8 @@ export function hotkeysLines(): string[] {
     "  Tab        complete slash commands, models, roles, @paths",
     "  ↑ / ↓      navigate the slash-command preview (Enter runs the highlighted one)",
     "  Enter      submit input / confirm picker selection",
-    "  Esc        cancel an open picker",
+    "  Shift-Enter / Ctrl-J / \\+Enter   insert a line break instead of submitting (Alt/Option-Enter and Ctrl-Enter work too)",
+    "  Esc        clear typed input / cancel an open picker",
     "  Ctrl-C     cancel the in-flight turn (press again at the prompt to exit)",
     "  Ctrl-D     exit the REPL",
     "  Ctrl-O     dump the full last response (untruncated, tables rendered) into scrollback",
@@ -21,9 +22,11 @@ export function hotkeysLines(): string[] {
     "  Ctrl-K / Ctrl-U / Ctrl-W   kill to end / start of line / previous word (emacs kill-ring)",
     "  Ctrl-Y / Alt-Y             yank / yank-pop the killed text",
     "  Ctrl-A / Ctrl-E            move to start / end of line",
+    "  Cmd-← / Cmd-→ (Home/End)   jump to start / end of the current row of a multi-line draft",
+    "  Cmd-↑ / Cmd-↓ (Ctrl-Home/Ctrl-End)   jump to start / end of the whole draft",
     "  /          open the slash-command palette",
     "  @path      mention a file (Tab completes relative paths)",
-    "  Ctrl-V     paste a copied image from the clipboard into the next message",
+    "  Ctrl-V     paste from the clipboard: an image attaches as [image #N], text inserts at the caret",
     "  drag-drop  drop an image file onto the box to attach it (its path becomes [image #N])",
     "  drag       select on-screen text to copy — copies on cmd/ctrl+c; under --tmux a drag auto-copies to the system clipboard",
     "  Shift-drag force the terminal's own selection when tmux owns the mouse (iTerm/macOS: Option-drag)",

package/src/commands/launch.ts

@@ -37,7 +37,7 @@ import { callLlm, type Message } from "../agent/loop";
 import { friendlyProviderError } from "../util/provider-error";
 import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/state";
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
-import { describeModel, describeAllProviders, thinkingMaxTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId } from "../ai";
+import { describeModel, describeAllProviders, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal } from "../agent/goal-verifier";
 
@@ -71,7 +71,7 @@ import { detectColorLevel, ColorLevel, visibleWidth } from "../tui/components/co
 import { readClipboardImage } from "../util/clipboard-image";
 import { attachImagePaths, insertImageTag } from "../util/file-attachment";
 import { formatTranscript } from "../tui/components/transcript";
-import { copyTextToClipboard } from "../tui/clipboard";
+import { copyTextToClipboard, readClipboardText } from "../tui/clipboard";
 import { loadInputHistory, appendInputHistory } from "../agent/input-history";
 import type { ImageAttachment } from "../ai/types";
 import { renderMarkdownTables } from "../tui/components/markdown-table";
@@ -141,6 +141,7 @@ import {
   matchTerminalReport,
   stripMouseReports,
   rewriteCursorCombos,
+  stripPasteEscapes,
   MULTILINE_SENTINEL,
   isGenuineMultilineDraft,
   shouldBoxVerticalNav,
@@ -154,6 +155,8 @@ import {
   filterPromptInputChunk,
   pasteIdleDecision,
   PASTE_MERGE_IDLE_MS,
+  chunkHasCtrlC,
+  normalizeKeypress,
 } from "./launch/input";
 import {
   gatedStdout,
@@ -1021,7 +1024,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           tools,
           maxSteps: flags.maxSteps,
           model: activeModel,
-          maxTokens: sessionThinking ? thinkingMaxTokens(sessionThinking) : undefined,
+          maxTokens: resolveMaxOutputTokens(activeModel, sessionThinking),
           reasoningEffort: sessionThinking ? thinkingToReasoningEffort(sessionThinking) : undefined,
           signal: ac.signal,
           steer: drainSteer,
@@ -1040,7 +1043,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             maxSteps: Math.min(6, flags.maxSteps > 0 ? flags.maxSteps : 6),
             budget: { maxExtensions: 0 },
             model: activeModel,
-            maxTokens: sessionThinking ? thinkingMaxTokens(sessionThinking) : undefined,
+            maxTokens: resolveMaxOutputTokens(activeModel, sessionThinking),
             reasoningEffort: sessionThinking ? thinkingToReasoningEffort(sessionThinking) : undefined,
             signal: ac.signal,
             steer: drainSteer,
@@ -1499,11 +1502,15 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const SENTINEL = MULTILINE_SENTINEL;
   // Multi-line input filter is ON for any interactive TTY: reliable multi-line paste
   // (fills the box, submits intact into the user card) is the default. The lone-"\n"
-  // Shift+Enter rule stays opt-in (JEO_MULTILINE=1) — it needs ghostty's
-  // `keybind = shift+enter=text:\n` and could misfire on the rare terminal that sends
-  // LF for Enter. JEO_NO_MULTILINE=1 fully disables the filter (reads stdin directly).
+  // break rule is ALSO default-on (JEO_MULTILINE=0 opts out): every real terminal
+  // sends `\r` for Enter in raw mode, so a bare `\n` can only come from Ctrl+J,
+  // Ctrl+Enter (Windows Terminal / conhost), or a ghostty `shift+enter=text:\n`
+  // keybind — all of which MEAN "insert a line break". This is what makes a break
+  // key available on Windows terminals that support neither the kitty keyboard
+  // protocol nor xterm modifyOtherKeys. JEO_NO_MULTILINE=1 fully disables the
+  // filter (reads stdin directly).
   const multilineInput = !!process.stdin.isTTY && jeoEnv("NO_MULTILINE") !== "1";
-  const loneLfShiftEnter = jeoEnv("MULTILINE") === "1";
+  const loneLfShiftEnter = jeoEnv("MULTILINE") !== "0";
   const expandSentinel = (s: string): string => (multilineInput ? s.split(SENTINEL).join("\n") : s);
   // Prompt-scoped process listeners (stdin data/keypress, stdout resize). Registered
   // once per launch but previously anonymous and never removed — benign for a single
@@ -1902,12 +1909,16 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // the prompt never carries a trailing/floating blank block.
   const setFooterRows = (n: number) => {
     n = Math.max(1, Math.min(n, footerRows));
+
     if (!previewArmed || n === footerRendered) return;
+
     let s = footerParkedRow > 0 ? cursorUp(footerParkedRow) : "";
     s += toColumn(1) + clearToEnd(); // wipe old region; cursor now at its top (after output)
     if (n > 1) s += "\n".repeat(n - 1) + cursorUp(n - 1);
     s += toColumn(1);
+
     out.write(s);
+
     footerRendered = n;
     footerParkedRow = 0;
     lastFooterKey = ""; // force a full repaint into the resized region
@@ -2112,6 +2123,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // Re-pin the reservation to the height the latest preview/panel wants (compact at
     // idle, grown for a dropdown) BEFORE painting, so no reserved blank trails the prompt.
     setFooterRows(footerWantRows);
+
     // ALWAYS paint exactly footerRendered rows so the reservation is fully covered
     // and no row can spill past it — the bug fix that kept `@folder<more text>`
     // typing from scrolling the input box (and prior output) off the top.
@@ -2186,7 +2198,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const clearTypedInput = (): boolean => {
     const rli = rl as unknown as { line: string; cursor: number; _refreshLine?: () => void };
     const hadPastedQueue = queuedPromptInput.pastedLines.length > 0;
+
     if (!promptHasContent()) return false;
+
     // ESC is the escape hatch for an accidental giant paste: drop the queued batch.
     if (hadPastedQueue) {
       const dropped = queuedPromptInput.pastedLines.splice(0).length;
@@ -2231,7 +2245,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   };
   const handleCtrlCByte = (chunk: string | Uint8Array) => {
     const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
-    if (text.includes("\u0003")) handleCtrlC();
+    // chunkHasCtrlC also matches the kitty CSI-u (`CSI 99;5u`) and xterm
+    // modifyOtherKeys (`CSI 27;5;99~`) encodings jeo's protocol push provokes.
+    if (chunkHasCtrlC(text)) handleCtrlC();
   };
   // Bun/readline can deliver Ctrl+C as readline SIGINT, process SIGINT, or (tmux)
   // a raw \u0003 byte before readline resolves the question; funnel all three through
@@ -2311,8 +2327,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     process.stdout.on("resize", onPickerResize);
     try {
       await new Promise<void>(resolve => {
-        const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean; shift?: boolean } | undefined) => {
-          const done = onKey(ch, key);
+        const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean; shift?: boolean; sequence?: string } | undefined) => {
+          // Same normalization as the footer handler: kitty CSI-u Esc/Ctrl+C must
+          // close a picker exactly like their legacy encodings.
+          const done = onKey(ch, normalizeKeypress(key));
           if (done) {
             process.stdin.off("keypress", handler);
             clear();
@@ -2727,11 +2745,30 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
   if (previewEnabled) {
     process.once("exit", () => out.write("\x1b[?25h")); // safety net: never leave the cursor hidden
-    const footerKeypressHandler = (_ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean } | undefined) => {
+    const footerKeypressHandler = (_ch: string, rawKey: { name?: string; ctrl?: boolean; meta?: boolean; shift?: boolean; sequence?: string } | undefined) => {
+      // Kitty CSI-u / xterm modifyOtherKeys events arrive with `name: undefined`
+      // (Node's keypress table predates those protocols) — normalize them back to
+      // the `{ name, ctrl, meta }` shape every check below matches on. Without this
+      // Esc and Ctrl+C are DEAD at the idle prompt on kitty-protocol terminals.
+      const key = normalizeKeypress(rawKey);
       if (key?.ctrl && key.name === "c") {
         handleCtrlC();
         return;
       }
+      // ESC (or a meta-mapped Cmd+C) at the prompt: wipe the typed text. Checked HERE,
+      // before the `!previewArmed || pickerActive` gate below — mirroring Ctrl+C right
+      // above, which already bypasses that gate. Without this, a transient window where
+      // `previewArmed` is momentarily false (the same class of race Ctrl+C was already
+      // immune to) silently swallowed the ESC keypress: the box stayed unaffected and
+      // `clearTypedInput()` never ran (the "esc 입력 후 안 먹힘" bug — Esc after typing
+      // intermittently did nothing). `clearTypedInput()` itself already no-ops safely
+      // when there is nothing to clear or no armed box to redraw into, so running it
+      // unconditionally here is safe even mid-picker or pre-arm.
+      if (key && ((key.name === "escape" && !key.ctrl) || (key.meta && key.name === "c"))) {
+        clearTypedInput();
+        return;
+      }
+
       if (!previewArmed || pickerActive) return;
       // Drag-and-drop file attach: a terminal delivers a dropped file as its PATH typed
       // into the box, wrapped in a bracketed paste. On paste-end, swap any readable image
@@ -2806,27 +2843,43 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         promptHistoryLines = null;
         drawFooter(previewLines(typedLine, navIdx));
       }
-      // Ctrl+V: attach a clipboard IMAGE to the next message. Terminal text paste
-      // never arrives as a ctrl+v keypress (it streams as plain stdin data), so this
-      // binding is image-only; when the clipboard holds no image it's a silent no-op.
+      // Ctrl+V: attach a clipboard IMAGE to the next message; when the clipboard
+      // holds no image, fall back to pasting its TEXT at the caret. Terminal-level
+      // paste (Cmd+V / Ctrl+Shift+V) still streams through stdin as before — this
+      // binding covers the terminals/users where that path doesn't fire (the
+      // "복사붙여넣기가 잘 동작안하는 경우"): previously a text-only clipboard made
+      // Ctrl+V a SILENT no-op.
       if (key?.ctrl && key.name === "v") {
         if (pasteInFlight) return;
         pasteInFlight = true;
         void (async () => {
           try {
-            const img = await readClipboardImage();
-            if (!img) return;
-            pendingImages.push(img);
             const rli = rl as unknown as { line: string; cursor: number; _refreshLine?: () => void };
-            const at = typeof rli.cursor === "number" ? rli.cursor : rli.line.length;
-            // Insert the [image #N] tag at the caret with normalized single-space
-            // padding (shared with the drag-drop path) so the caret lands right after
-            // the tag instead of being pushed several columns by stray spaces.
-            const ins = insertImageTag(rli.line, at, pendingImages.length);
-            rli.line = ins.text;
-            rli.cursor = ins.cursor;
+            const img = await readClipboardImage();
+            if (img) {
+              pendingImages.push(img);
+              const at = typeof rli.cursor === "number" ? rli.cursor : rli.line.length;
+              // Insert the [image #N] tag at the caret with normalized single-space
+              // padding (shared with the drag-drop path) so the caret lands right after
+              // the tag instead of being pushed several columns by stray spaces.
+              const ins = insertImageTag(rli.line, at, pendingImages.length);
+              rli.line = ins.text;
+              rli.cursor = ins.cursor;
+            } else {
+              const clip = await readClipboardText();
+              if (!clip) return;
+              // Same sanitation as a bracketed paste: strip ANSI escapes/C0 noise,
+              // fold line breaks to the multi-line sentinel (or spaces when the
+              // filter is off) so a multi-line clipboard cannot self-submit.
+              const cleaned = stripPasteEscapes(clip.replace(/\r\n/g, "\n").replace(/\r/g, "\n"))
+                .split("\n").join(multilineInput ? SENTINEL : " ");
+              if (!cleaned) return;
+              const at = typeof rli.cursor === "number" ? rli.cursor : rli.line.length;
+              rli.line = rli.line.slice(0, at) + cleaned + rli.line.slice(at);
+              rli.cursor = at + cleaned.length;
+            }
             typedLine = rli.line;
-            // Sync readline's internal screen model to the injected tag (same as the
+            // Sync readline's internal screen model to the injected text (same as the
             // slash/tab completion accept paths): without it readline's stale row/cursor
             // model offsets the real caret several columns on the next keystroke — the
             // "caret pushed past the tag after attaching an image" shift.
@@ -2838,20 +2891,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         })();
         return;
       }
-      // ESC (or a meta-mapped Cmd+C) at the prompt: wipe the typed text. A bare
-      // ESC decodes as `escape` (meta is set for a lone ESC byte — accept both)
-      // only after readline's escape-sequence timeout, so arrow/wheel sequences
-      // never trigger this. Checked BEFORE the `previewPending` reentrancy gate
-      // (like Ctrl+C above) — a fast typist/paste can deliver several keypress
-      // events in ONE synchronous stdin read, all before the first keystroke's
-      // setImmediate fires; gating this after `previewPending` silently dropped
-      // an ESC that lands in the same burst as preceding keystrokes (the
-      // "esc 입력 후 안 먹힘" bug — Esc right after typing intermittently did nothing).
-      if (key && ((key.name === "escape" && !key.ctrl) || (key.meta && key.name === "c"))) {
-        clearTypedInput();
-        return;
-      }
       if (previewPending) return;
+
       // Ctrl+C is handled above (clear-or-exit); keep this guard for defensive ordering only.
       if (key?.ctrl && key.name === "c") return;
 

package/src/tui/clipboard.ts

@@ -62,6 +62,55 @@ export function systemClipboardCopyCommand(
   return null;
 }
 
+/**
+ * Resolve the local system-clipboard READ command for a platform, or null when no
+ * tool is available — the mirror of {@link systemClipboardCopyCommand} for the
+ * Ctrl+V text-paste fallback. Pure (the `which` probe is injected) for testability.
+ *  - macOS: `pbpaste`.
+ *  - Windows: PowerShell `Get-Clipboard` (`-Raw` keeps embedded newlines intact).
+ *  - Linux/BSD: Wayland `wl-paste` first, then X11 `xclip -o`, then `xsel`.
+ */
+export function systemClipboardPasteCommand(
+  platform: NodeJS.Platform,
+  which: (bin: string) => string | null,
+): string[] | null {
+  if (platform === "darwin") return which("pbpaste") ? ["pbpaste"] : null;
+  if (platform === "win32") {
+    return ["powershell", "-NoProfile", "-Command", "Get-Clipboard -Raw"];
+  }
+  if (which("wl-paste")) return ["wl-paste", "--no-newline"];
+  if (which("xclip")) return ["xclip", "-selection", "clipboard", "-o"];
+  if (which("xsel")) return ["xsel", "--clipboard", "--output"];
+  return null;
+}
+
+/**
+ * Read TEXT from the system clipboard, or null when empty / no tool / the read
+ * failed. Never throws; capped at `timeoutMs` so a hung clipboard tool (remote
+ * X11, sandboxed PowerShell) cannot freeze the prompt. Used as the Ctrl+V
+ * fallback when the clipboard holds no image — previously that combination was
+ * a SILENT no-op (one of the "복사붙여넣기가 잘 동작안하는 경우").
+ */
+export async function readClipboardText(
+  deps: { which?: (bin: string) => string | null; platform?: NodeJS.Platform } = {},
+  timeoutMs = 4000,
+): Promise<string | null> {
+  const platform = deps.platform ?? process.platform;
+  const which = deps.which ?? ((bin: string) => Bun.which(bin));
+  const cmd = systemClipboardPasteCommand(platform, which);
+  if (!cmd) return null;
+  try {
+    const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "ignore" });
+    const timer = setTimeout(() => { try { proc.kill(); } catch { /* already gone */ } }, timeoutMs);
+    const text = await new Response(proc.stdout).text();
+    clearTimeout(timer);
+    if ((await proc.exited) !== 0) return null;
+    return text.length > 0 ? text : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The single shell command string tmux's `copy-command` option runs to push a
  * copy-mode selection onto the system clipboard, or null when no tool exists.

package/src/tui/terminal.ts

@@ -130,8 +130,10 @@ export function enableKittyKeyboard(): string {
   return `${ESC}>1u`;
 }
 
-/** Reset the kitty keyboard protocol flags to 0 (disabled) on exit, the counterpart to
- *  {@link enableKittyKeyboard}. */
+/** Undo {@link enableKittyKeyboard} on exit. `CSI > 1 u` PUSHES an entry onto the
+ *  terminal's keyboard-mode stack, so the counterpart is a POP (`CSI < u`) — pushing
+ *  `>0u` instead would leak our entry and leave flags-0 stacked on top of whatever
+ *  the shell/tmux had. Terminals without kitty-protocol support ignore both. */
 export function disableKittyKeyboard(): string {
-  return `${ESC}>0u`;
+  return `${ESC}<u`;
 }

package/src/util/provider-error.ts

@@ -4,7 +4,10 @@
  * (carrying `.status` and a body), and the agent loop surfaces failures both as a
  * thrown error and as a `doneReason`, so this lives in a shared util used by both.
  */
-import { isUsageLimitError } from "./retry";
+import { isUsageLimitError, isRefusalError } from "./retry";
+// Re-export: engine.ts and callers import the refusal predicate from here; the
+// definition lives in retry.ts so defaultRetryable can fail fast without a cycle.
+export { isRefusalError } from "./retry";
 
 /** Provider-authoritative context-overflow signal (HTTP 400/413 family). The
  *  local token estimate can drift under the real count (images, tokenizer
@@ -18,17 +21,6 @@ export function isContextOverflowError(err: unknown): boolean {
   return status === 413; // payload-too-large is always an overflow signal
 }
 
-/** Provider safety-refusal signal: an HTTP-200 completion that returned NO
- *  content because the model/provider declined (Anthropic `stop_reason=refusal`,
- *  OpenAI `finish_reason=content_filter`, Gemini `SAFETY`/`PROHIBITED_CONTENT`
- *  block reasons). On routine coding work these are usually transient
- *  false-positives — the engine retries the step (bounded) instead of killing
- *  the turn with a dead "Error: … returned no content". */
-export function isRefusalError(err: unknown): boolean {
-  const msg = (err as Error)?.message ?? String(err);
-  return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)/i.test(msg);
-}
-
 function formatDuration(ms: number): string {
   const totalSeconds = Math.ceil(ms / 1000);
   if (totalSeconds < 60) return `${totalSeconds}s`;

package/src/util/retry.ts

@@ -38,6 +38,14 @@ export function defaultRetryable(err: unknown): boolean {
   if (isUsageLimitError(err)) {
     return false;
   }
+  // Safety refusals are DETERMINISTIC for identical conversation content: the
+  // classifier trips on what's IN the context, so a transport-level resend of the
+  // same payload re-refuses every time (observed: each engine ladder rung burned
+  // 2 extra billed calls before this check). Fail fast — the engine's refusal
+  // ladder owns recovery because it mutates the context between attempts.
+  if (isRefusalError(err)) {
+    return false;
+  }
 
   let message = "";
   if (err instanceof Error) {
@@ -206,3 +214,15 @@ const USAGE_LIMIT_PATTERN = /usage.?limit|usage_limit_reached|usage_not_included
 export function isUsageLimitError(err: unknown): boolean {
   return USAGE_LIMIT_PATTERN.test(errorMessageOf(err));
 }
+
+/** Provider safety-refusal signal: an HTTP-200 completion that returned NO
+ *  content because the model/provider declined (Anthropic `stop_reason=refusal`,
+ *  OpenAI `finish_reason=content_filter`, Gemini `SAFETY`/`PROHIBITED_CONTENT`
+ *  block reasons). Lives here (not provider-error.ts) so `defaultRetryable` can
+ *  fail fast on it: a refusal is DETERMINISTIC for the same conversation content —
+ *  transport-level resends of an identical payload just burn billed calls. The
+ *  engine's bounded refusal ladder (resend → context reset → guidance strip) is
+ *  the correct recovery layer because it MUTATES the context between attempts. */
+export function isRefusalError(err: unknown): boolean {
+  return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)/i.test(errorMessageOf(err));
+}