jeo-code 0.7.26 → 0.7.28

package/src/tui/components/welcome.ts

@@ -1,7 +1,9 @@
 import chalk from "chalk";
+import * as path from "node:path";
+import * as os from "node:os";
 import { renderForgeMark, FORGE_MARK_ART_GRAND } from "./ascii-art";
 import { truncate, isTTY } from "../terminal";
-import { detectColorLevel, ColorLevel } from "./color";
+import { detectColorLevel, ColorLevel, visibleWidth } from "./color";
 
 export interface WelcomeData {
   version: string;
@@ -23,12 +25,8 @@ export interface WelcomeData {
   color?: boolean;         // default true
 }
 
-function getVisibleWidth(s: string): number {
-  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
-}
-
 function padLine(line: string, width: number, align: "left" | "center" | "right" = "left"): string {
-  const vis = getVisibleWidth(line);
+  const vis = visibleWidth(line);
   if (width <= 0 || vis >= width) return line;
   const total = width - vis;
   if (align === "right") return " ".repeat(total) + line;
@@ -39,12 +37,60 @@ function padLine(line: string, width: number, align: "left" | "center" | "right"
   return line + " ".repeat(total);
 }
 
+function shortenPath(p: string | undefined, maxWidth: number, unicode: boolean): string {
+  if (!p) return "-";
+  let s = p;
+  const home = os.homedir();
+  if (home && (s === home || s.startsWith(home + path.sep))) s = "~" + s.slice(home.length);
+  if (visibleWidth(s) <= maxWidth) return s;
+  const ell = unicode ? "…" : "...";
+  return truncate(`${ell}${s.slice(-Math.max(1, maxWidth - visibleWidth(ell)))}`, maxWidth);
+}
+
+function metaRows(d: WelcomeData, width: number, unicode: boolean, useColor: boolean): string[] {
+  const labelWidth = 8;
+  const valueWidth = Math.max(1, width - labelWidth - 3);
+  const key = useColor ? chalk.dim : (s: string) => s;
+  const rows: string[] = [];
+  const push = (label: string, value: string): void => {
+    const lhs = key(padLine(label, labelWidth, "right"));
+    const rhs = truncate(value || "-", valueWidth);
+    rows.push(padLine(`${lhs} │ ${rhs}`, width));
+  };
+  push("version", `v${d.version}`);
+  push("folder", shortenPath(d.cwd, valueWidth, unicode));
+  push("model", d.model);
+  if (d.provider) push("provider", d.provider);
+  if (d.thinking) push("thinking", d.thinking);
+  if (d.sessionId) push("session", d.sessionId.slice(0, 8));
+
+  const files = d.contextFiles ?? [];
+  if (files.length > 0 && width >= 28) {
+    const shown = files.slice(0, width >= 34 ? 3 : 2).map(f => path.basename(f));
+    push("files", shown.join(", ") + (files.length > shown.length ? ` +${files.length - shown.length}` : ""));
+  }
+  return rows;
+}
+
+function centerColumn(lines: string[], width: number): string[] {
+  return lines.map(raw => padLine(truncate(raw, width), width, "center"));
+}
+
+function zipColumns(left: string[], right: string[], leftWidth: number, gap: string, rightWidth: number): string[] {
+  const n = Math.max(left.length, right.length);
+  const out: string[] = [];
+  for (let i = 0; i < n; i++) {
+    out.push(`${padLine(left[i] ?? "", leftWidth)}${gap}${padLine(right[i] ?? "", rightWidth)}`);
+  }
+  return out;
+}
+
 /**
  * The gjc-style hero welcome box ("JEO forge"): one outer box with the version
- * embedded in the top border and a SINGLE CENTERED column inside — brand line,
- * tagline, the grand jeo forge mark (flowing gradient on capable terminals),
- * and the model/provider pills. Workspace details and key hints intentionally
- * live elsewhere (footer/status bar), matching the gjc forge banner.
+ * embedded in the top border. Narrow terminals keep a single centered forge
+ * column; wide terminals split into a left hero mark and a right workspace table
+ * (folder, version, model, context files) so the launch capture uses the extra
+ * resolution instead of leaving a dead right side.
  */
 export function renderWelcome(d: WelcomeData): string[] {
   const cols = d.cols ?? 80;
@@ -80,11 +126,11 @@ export function renderWelcome(d: WelcomeData): string[] {
   const dashStr = g.h.repeat(titleDashes);
   const titleHead = `${dashStr}${titleLabel}`;
   let topBorderLine: string;
-  if (titleHead.length + 2 > inner) {
-    const clipped = titleHead.slice(0, inner);
-    topBorderLine = lit(g.tl + clipped + g.h.repeat(Math.max(0, inner - clipped.length)) + g.tr);
+  if (visibleWidth(titleHead) + 2 > inner) {
+    const clipped = truncate(titleHead, inner);
+    topBorderLine = lit(g.tl + clipped + g.h.repeat(Math.max(0, inner - visibleWidth(clipped))) + g.tr);
   } else {
-    const fill = g.h.repeat(inner - titleHead.length);
+    const fill = g.h.repeat(inner - visibleWidth(titleHead));
     topBorderLine = useColor
       ? lit(g.tl + dashStr) + chalk.bold(lit(titleLabel)) + lit(fill) + lit(g.tr)
       : g.tl + titleHead + fill + g.tr;
@@ -93,44 +139,57 @@ export function renderWelcome(d: WelcomeData): string[] {
   const bottomBorderPlain = g.bl + g.h.repeat(inner) + g.br;
   const bottomBorderLine = shadow(bottomBorderPlain);
 
-  // Grand symbol when the box is wide enough; compact forge mark otherwise.
+  // Grand symbol when the box is wide enough; compact forge mark otherwise. In a
+  // split layout, art is constrained to the left pane so the right table remains stable.
   const colorLevel = useColor ? detectColorLevel(process.env, isTTY()) : ColorLevel.None;
-  const grand = inner >= grandWidth;
+  const wideMeta = inner >= 86;
+  const gap = wideMeta ? "   " : "";
+  const rightWidth = wideMeta ? Math.min(38, Math.max(28, Math.floor(inner * 0.34))) : 0;
+  const leftWidth = wideMeta ? Math.max(32, inner - rightWidth - visibleWidth(gap)) : inner;
+  const grand = leftWidth >= grandWidth;
   const artLines = renderForgeMark({
     color: useColor,
     phase: d.phase ?? 0,
     unicode,
     colorLevel,
     grand,
-    cols: inner,
+    cols: leftWidth,
   });
 
-  // Single centered hero column (gjc forge layout): breathing room, brand,
-  // tagline, the symbol, then the model/provider pills.
-  const content: string[] = [];
-  content.push("");
-  content.push(useColor ? chalk.bold.cyan("Jeo forge") : "Jeo forge");
-  content.push(useColor ? chalk.dim("evolve · act · prove") : "evolve · act · prove");
-  content.push("");
-  for (const line of artLines) content.push(line);
-  content.push("");
-
-  const modelIcon = unicode ? "◆" : "*";
-  const modelPill = truncate(`[ ${modelIcon} ${d.model} ]`, inner);
-  content.push(useColor ? chalk.cyan(modelPill) : modelPill);
-  if (d.provider) {
-    const providerIcon = unicode ? "◇" : "o";
-    const providerPill = truncate(`[ ${providerIcon} ${d.provider} ]`, inner);
-    content.push(useColor ? chalk.blue(providerPill) : providerPill);
+  const pill = (icon: string, text: string, paint: (s: string) => string): string => {
+    const p = truncate(`[ ${icon} ${text} ]`, leftWidth);
+    return useColor ? paint(p) : p;
+  };
+  const leftContent: string[] = [];
+  leftContent.push("");
+  leftContent.push(useColor ? chalk.bold.cyan("Jeo forge") : "Jeo forge");
+  leftContent.push(useColor ? chalk.dim("evolve · act · prove") : "evolve · act · prove");
+  leftContent.push("");
+  leftContent.push(...artLines);
+  leftContent.push("");
+  leftContent.push(pill(unicode ? "◆" : "*", d.model, chalk.cyan));
+  if (d.provider) leftContent.push(pill(unicode ? "◇" : "o", d.provider, chalk.blue));
+  leftContent.push("");
+
+  let content: string[];
+  if (wideMeta) {
+    const tableTitle = useColor ? chalk.bold("workspace") : "workspace";
+    const rightContent = [
+      "",
+      padLine(tableTitle, rightWidth, "center"),
+      (useColor ? chalk.dim : (s: string) => s)(padLine("forge context", rightWidth, "center")),
+      "",
+      ...metaRows(d, rightWidth, unicode, useColor),
+      "",
+    ];
+    content = zipColumns(centerColumn(leftContent, leftWidth), rightContent, leftWidth, gap, rightWidth);
+  } else {
+    content = centerColumn(leftContent, inner);
   }
-  content.push("");
 
   const leftBorder = lit(g.v);
   const rightBorder = shadow(g.v);
-  const finalContentLines = content.map(raw => {
-    const line = padLine(truncate(raw, inner), inner, "center");
-    return leftBorder + line + rightBorder;
-  });
+  const finalContentLines = content.map(raw => leftBorder + padLine(truncate(raw, inner), inner) + rightBorder);
 
   return [topBorderLine, ...finalContentLines, bottomBorderLine];
 }

package/src/tui/terminal.ts

@@ -130,8 +130,10 @@ export function enableKittyKeyboard(): string {
   return `${ESC}>1u`;
 }
 
-/** Reset the kitty keyboard protocol flags to 0 (disabled) on exit, the counterpart to
- *  {@link enableKittyKeyboard}. */
+/** Undo {@link enableKittyKeyboard} on exit. `CSI > 1 u` PUSHES an entry onto the
+ *  terminal's keyboard-mode stack, so the counterpart is a POP (`CSI < u`) — pushing
+ *  `>0u` instead would leak our entry and leave flags-0 stacked on top of whatever
+ *  the shell/tmux had. Terminals without kitty-protocol support ignore both. */
 export function disableKittyKeyboard(): string {
-  return `${ESC}>0u`;
+  return `${ESC}<u`;
 }

package/src/util/provider-error.ts

@@ -4,7 +4,10 @@
  * (carrying `.status` and a body), and the agent loop surfaces failures both as a
  * thrown error and as a `doneReason`, so this lives in a shared util used by both.
  */
-import { isUsageLimitError } from "./retry";
+import { isUsageLimitError, isRefusalError } from "./retry";
+// Re-export: engine.ts and callers import the refusal predicate from here; the
+// definition lives in retry.ts so defaultRetryable can fail fast without a cycle.
+export { isRefusalError } from "./retry";
 
 /** Provider-authoritative context-overflow signal (HTTP 400/413 family). The
  *  local token estimate can drift under the real count (images, tokenizer
@@ -18,17 +21,6 @@ export function isContextOverflowError(err: unknown): boolean {
   return status === 413; // payload-too-large is always an overflow signal
 }
 
-/** Provider safety-refusal signal: an HTTP-200 completion that returned NO
- *  content because the model/provider declined (Anthropic `stop_reason=refusal`,
- *  OpenAI `finish_reason=content_filter`, Gemini `SAFETY`/`PROHIBITED_CONTENT`
- *  block reasons). On routine coding work these are usually transient
- *  false-positives — the engine retries the step (bounded) instead of killing
- *  the turn with a dead "Error: … returned no content". */
-export function isRefusalError(err: unknown): boolean {
-  const msg = (err as Error)?.message ?? String(err);
-  return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)/i.test(msg);
-}
-
 function formatDuration(ms: number): string {
   const totalSeconds = Math.ceil(ms / 1000);
   if (totalSeconds < 60) return `${totalSeconds}s`;

package/src/util/retry.ts

@@ -7,8 +7,14 @@ export interface RetryOptions {
   random?: () => number;   // injectable RNG for jitter (default Math.random); equal-jitter in [0.5x, 1x]
   /** Notified before each backoff wait; `delayMs` is the wait actually applied. */
   onRetry?: (attempt: number, err: unknown, delayMs: number) => void;
+  /** Aborts an in-progress backoff wait (e.g. Ctrl-C / turn cancel). Already-aborted or
+   *  aborted-mid-wait rejects immediately instead of completing the sleep — the escape hatch
+   *  for a long, honored provider `Retry-After` (see `rateLimitMaxServerDelayMs`: those are no
+   *  longer capped by default). Does NOT cancel the in-flight `fn()` call itself; thread the
+   *  same signal into the request (e.g. `fetch`) for that. */
+  signal?: AbortSignal;
   /** Minimum backoff (ms) applied specifically to rate-limit (429) errors. The floor
-   *  ESCALATES per attempt (floor × 2^(attempt-1), capped at RETRY_AFTER_CAP_MS) because a
+   *  ESCALATES per attempt (floor × 2^(attempt-1), capped at RATE_LIMIT_FLOOR_CAP_MS) because a
    *  rate-limit window rarely clears in <1s and often needs tens of seconds — a flat
    *  sub-second retry cadence just burns the budget; default 0 (no floor) preserves
    *  generic behavior. */
@@ -17,9 +23,13 @@ export interface RetryOptions {
    *  When higher than `retries`, rate-limit errors get extra attempts so a transient
    *  per-minute window can reset; non-rate-limit errors still use `retries`. */
   rateLimitRetries?: number;
-  /** If a 429 carries a server-directed retry delay above this budget, fail fast
-   * instead of capping the wait and replaying a request the server already said
-   * cannot succeed soon. */
+  /** Opt-in ceiling on a 429's server-directed retry delay: set it and a delay beyond it fails
+   *  fast with the original error instead of sleeping. Unset (the default) honors ANY
+   *  server-directed delay in full, however long — gjc parity: a generic rate limit is retried
+   *  forever, not treated as fatal past some arbitrary budget. Usage/quota-limit errors
+   *  (`isUsageLimitError`) are unaffected either way: `defaultRetryable` already classifies
+   *  them non-retryable before this wait is ever computed. Pair with `signal` so an unbounded
+   *  wait stays user-cancellable. */
   rateLimitMaxServerDelayMs?: number;
 }
 
@@ -38,6 +48,14 @@ export function defaultRetryable(err: unknown): boolean {
   if (isUsageLimitError(err)) {
     return false;
   }
+  // Safety refusals are DETERMINISTIC for identical conversation content: the
+  // classifier trips on what's IN the context, so a transport-level resend of the
+  // same payload re-refuses every time (observed: each engine ladder rung burned
+  // 2 extra billed calls before this check). Fail fast — the engine's refusal
+  // ladder owns recovery because it mutates the context between attempts.
+  if (isRefusalError(err)) {
+    return false;
+  }
 
   let message = "";
   if (err instanceof Error) {
@@ -94,37 +112,45 @@ export function defaultRetryable(err: unknown): boolean {
   return false;
 }
 
-// Server-directed `Retry-After` is honored but capped so a CLI never hangs on a hostile header.
-const RETRY_AFTER_CAP_MS = 30_000;
-// Long account/subscription windows should be reported, not silently compressed to 30s.
+// Synthetic per-minute floor for a 429 that carries NO server `Retry-After` (see
+// `rateLimitMinDelayMs`) — caps the escalating floor so a SILENT rate limit still waits a
+// realistic window instead of ~8s. Does NOT cap a genuine server-directed Retry-After: a
+// provider that names its own wait is authoritative and is honored in full (gjc parity);
+// `rateLimitMaxServerDelayMs` is the opt-in ceiling for a caller that truly cannot wait that long.
+const RATE_LIMIT_FLOOR_CAP_MS = 30_000;
 
 // Run fn; on a retryable error, back off and retry up to `retries` attempts. Backoff is
-// exponential (baseDelay * 2^(attempt-1), capped at maxDelay) with equal jitter (the wait lands in
-// [0.5x, 1x] of that cap), unless the error carries a `retryAfterMs` (server `Retry-After`), which
-// takes precedence (capped at RETRY_AFTER_CAP_MS). A 429 with a server delay beyond
-// `rateLimitMaxServerDelayMs` is not retried because the provider has identified a
-// long account-wide window; callers can surface the reset time instead of hanging.
+// exponential (baseDelay * 2^(attempt-1), capped at maxDelay) with equal jitter (the wait lands
+// in [0.5x, 1x] of that cap). A server-directed `retryAfterMs` (Retry-After) wins over the
+// jitter and is honored IN FULL — no cap — unless `rateLimitMaxServerDelayMs` is explicitly set
+// and exceeded, in which case the original error is re-thrown immediately instead of sleeping.
+// `opts.signal` can abort an in-progress wait, so an unbounded honored delay stays cancellable.
 export async function withRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): Promise<T> {
   const retries = opts?.retries ?? 3;
   const baseDelayMs = opts?.baseDelayMs ?? 250;
   const maxDelayMs = opts?.maxDelayMs ?? 4000;
   const isRetryable = opts?.isRetryable ?? defaultRetryable;
-  const sleep = opts?.sleep ?? ((ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms)));
+  const sleep = opts?.sleep ?? ((ms: number) => {
+    const { promise, resolve } = Promise.withResolvers<void>();
+    setTimeout(resolve, ms);
+    return promise;
+  });
   const random = opts?.random ?? Math.random;
   const onRetry = opts?.onRetry;
   const rateLimitMinDelayMs = opts?.rateLimitMinDelayMs ?? 0;
   const rateLimitRetries = opts?.rateLimitRetries;
   const rateLimitMaxServerDelayMs = opts?.rateLimitMaxServerDelayMs;
+  const signal = opts?.signal;
 
   let attempt = 1;
   while (true) {
     try {
       return await fn();
     } catch (err) {
-      // Rate-limit (429) errors may use a higher attempt cap so a transient
-      // per-minute window can reset before we surface the failure. If the server
-      // says the window is much longer than our retry budget, fail fast with the
-      // original error so the UI can show the real reset delay.
+      // Rate-limit (429) errors may use a higher attempt cap so a transient per-minute window
+      // can reset before we surface the failure. `rateLimitMaxServerDelayMs` is opt-in
+      // (unset by default): only when explicitly configured and the server's own wait exceeds
+      // it do we fail fast instead of sleeping through a window the caller declared too long.
       const rateLimited = isRateLimitError(err);
       const serverDelay = retryAfterOf(err);
       if (
@@ -143,15 +169,15 @@ export async function withRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): P
       const capped = Math.min(baseDelayMs * Math.pow(2, attempt - 1), maxDelayMs);
       // Equal jitter: half fixed + half random → [0.5x, 1x] of the capped backoff.
       const jittered = capped / 2 + random() * (capped / 2);
-      // Server `Retry-After` wins (capped); else jitter. For rate limits, apply the
-      // floor in BOTH cases so a 0/near-0 Retry-After (or sub-second jitter) doesn't
-      // burn the 429 budget back-to-back with no real pause. The floor escalates per
-      // attempt (×2 each retry, capped) so the total wait across the 429 budget spans
-      // a realistic rate-limit window (~a minute) instead of ~8s.
-      const cappedServer = serverDelay !== undefined ? Math.min(serverDelay, RETRY_AFTER_CAP_MS) : undefined;
-      const base = cappedServer !== undefined ? cappedServer : jittered;
+      // Server `Retry-After` wins, honored IN FULL (no cap — gjc parity: even a multi-hour
+      // provider-directed window is retried, never silently compressed). For rate limits,
+      // apply the floor in BOTH cases so a 0/near-0 Retry-After (or sub-second jitter) doesn't
+      // burn the 429 budget back-to-back with no real pause. The floor escalates per attempt
+      // (×2 each retry, capped at RATE_LIMIT_FLOOR_CAP_MS) so a SYNTHETIC (server-silent) wait
+      // spans a realistic rate-limit window (~a minute) instead of ~8s.
+      const base = serverDelay !== undefined ? serverDelay : jittered;
       const floor = rateLimited
-        ? Math.min(rateLimitMinDelayMs * Math.pow(2, attempt - 1), RETRY_AFTER_CAP_MS)
+        ? Math.min(rateLimitMinDelayMs * Math.pow(2, attempt - 1), RATE_LIMIT_FLOOR_CAP_MS)
         : 0;
       const delay = Math.max(base, floor);
 
@@ -159,12 +185,29 @@ export async function withRetry<T>(fn: () => Promise<T>, opts?: RetryOptions): P
         onRetry(attempt, err, delay);
       }
 
-      await sleep(delay);
+      await abortableSleep(sleep, delay, signal);
       attempt++;
     }
   }
 }
 
+/** Race `sleep(ms)` against `signal`; an already-aborted or mid-wait-aborted signal rejects
+ *  immediately with its abort reason instead of completing the wait. Keeps a long, honored
+ *  server-directed retry delay (see `withRetry`) user-cancellable even though it is no longer
+ *  capped. A no-op passthrough when no signal is supplied (existing callers/tests unaffected). */
+function abortableSleep(sleep: (ms: number) => Promise<void>, ms: number, signal?: AbortSignal): Promise<void> {
+  if (!signal) return sleep(ms);
+  if (signal.aborted) return Promise.reject(signal.reason ?? new Error("aborted"));
+  const { promise, resolve, reject } = Promise.withResolvers<void>();
+  const onAbort = () => reject(signal.reason ?? new Error("aborted"));
+  signal.addEventListener("abort", onAbort, { once: true });
+  sleep(ms).then(
+    value => { signal.removeEventListener("abort", onAbort); resolve(value); },
+    err => { signal.removeEventListener("abort", onAbort); reject(err); },
+  );
+  return promise;
+}
+
 // Extract a non-negative `retryAfterMs` from an error, if it carries one (e.g. ProviderHttpError).
 function retryAfterOf(err: unknown): number | undefined {
   if (typeof err === "object" && err !== null) {
@@ -197,12 +240,26 @@ function errorMessageOf(err: unknown): string {
 
 /**
  * Persistent usage/quota-limit detection (gjc parity: `isUsageLimitError`). These are
- * subscription/window limits ("usage limit reached", "quota exceeded") that need a model
- * or credential switch — retrying within seconds is pure waste, unlike a per-minute 429.
- * Deliberately excludes the ambiguous "resource exhausted" (Gemini uses it for windows
- * that often DO clear within a retry budget).
+ * subscription/window limits ("usage limit reached", "quota exceeded", model/message
+ * window limits, credit exhaustion, Anthropic ACCOUNT-level exhaustion) that need a
+ * model or credential switch — retrying within seconds is pure waste, unlike a
+ * per-minute 429. Bare "resource exhausted" (gRPC capacity wording) stays transient;
+ * only the qualified "Resource has been exhausted (… quota/limit)" form is persistent
+ * (gjc fixture parity: rate-limit-utils.test.ts).
  */
-const USAGE_LIMIT_PATTERN = /usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?exceeded|exceeded your/i;
+const USAGE_LIMIT_PATTERN = /usage.?limit|usage_limit_reached|usage_not_included|limit_reached|model.?limit|message.?limit|limit for this model|quota.?exceeded|out_of_credits|request would exceed your account.?s rate limit|resource has been exhausted[^\n]*(?:quota|limit)|exceeded your/i;
 export function isUsageLimitError(err: unknown): boolean {
   return USAGE_LIMIT_PATTERN.test(errorMessageOf(err));
 }
+
+/** Provider safety-refusal signal: an HTTP-200 completion that returned NO
+ *  content because the model/provider declined (Anthropic `stop_reason=refusal`,
+ *  OpenAI `finish_reason=content_filter`, Gemini `SAFETY`/`PROHIBITED_CONTENT`
+ *  block reasons). Lives here (not provider-error.ts) so `defaultRetryable` can
+ *  fail fast on it: a refusal is DETERMINISTIC for the same conversation content —
+ *  transport-level resends of an identical payload just burn billed calls. The
+ *  engine's bounded refusal ladder (resend → context reset → guidance strip) is
+ *  the correct recovery layer because it MUTATES the context between attempts. */
+export function isRefusalError(err: unknown): boolean {
+  return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)/i.test(errorMessageOf(err));
+}