jeo-code 0.7.27 → 0.7.29

package/CHANGELOG.md

@@ -6,6 +6,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.29] - 2026-07-02
+_gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder._
+
+### Fixed
+- **Safety refusals now keep retrying instead of surfacing a terminal provider error.** jeo already had the stronger context-mutating recovery ladder (plain resend → tool-result/thinking-replay reset → project-context guidance strip), but once those rungs were spent it still returned `Anthropic declined to answer (safety refusal — no content returned) even after automatic retries with a context reset`. gjc's session retry path treats that class as non-terminal and keeps the session alive. jeo now adds the same final rung: capped exponential backoff resends after all context mutations are spent, with an `Esc`/abort-cancellable wait and the turn wall-clock budget still bounding the whole run.
+- **The stale fallback refusal copy no longer claims automatic retries were exhausted.** The friendly provider error text is now reserved for non-engine call sites and points users at `/retry`, `/compact`, `/new`, or `/model` without implying the agent already gave up.
+
+### Verified
+- `bun run typecheck` clean; full suite green — 2146 pass / 0 fail across 244 files. Targeted coverage updated in `test/refusal-recovery.test.ts` for the new post-ladder backoff recovery and for Esc/Ctrl+C aborting a refusal backoff as `Cancelled.` instead of surfacing the refusal error.
+
+## [0.7.28] - 2026-07-02
+_gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests)._
+
+### Fixed
+- **Generic 429 rate limits with a long server `Retry-After` were treated as FATAL — gajae 0.7.10 (#1370) keeps them retryable, and now jeo does too.** The old behavior failed fast on any 429 whose server-directed delay exceeded a hard-coded 5-minute budget, and silently compressed every honored `Retry-After` to 30s (retrying into a still-closed window). gjc's contract (verified against its `agent-session-retry-cap` tests): a transient rate limit honors the provider's wait IN FULL — even a ~3.1h `retry-after-ms=11180000` — while usage/quota/model-limit errors keep failing fast via `isUsageLimitError` → `defaultRetryable`. `withRetry` (`src/util/retry.ts`) now honors server-directed delays uncapped (the 30s `RATE_LIMIT_FLOOR_CAP_MS` only caps the SYNTHETIC escalating floor for server-silent 429s), and `resolveRetryOptions` no longer injects a default `rateLimitMaxServerDelayMs` — it remains available as explicit opt-in config (`retry.rateLimitMaxServerDelayMs`, added to the Config type + zod schema).
+- **A long honored rate-limit wait is now user-cancellable.** `RetryOptions.signal` (new) aborts an in-progress backoff sleep: `resolveCall` threads the caller's ORIGINAL abort signal (Ctrl-C / turn abort) into the retry layer — distinct from the per-attempt fetch timeout, so one attempt's timeout can never cut short the next attempt's backoff, while Esc/Ctrl-C interrupts a multi-hour wait immediately instead of after the sleep elapses.
+- **`isUsageLimitError` missed gajae's usage-exhaustion phrasings.** Added `model.?limit` / `message.?limit` / `limit for this model` / `out_of_credits` / Anthropic's account-level `request would exceed your account's rate limit` and the qualified `Resource has been exhausted (… quota/limit)` form (bare gRPC `resource exhausted` stays transient — deliberate jeo choice for Gemini windows that clear quickly). Without these, an out-of-credits 429 was retried on a pointless backoff ladder instead of failing fast to the model/credential-switch hint.
+- **Anthropic 429s now carry their rate-limit response headers in the error detail** (gjc `getSafeAnthropicHeaderEvidence` parity): `retry-after`, `retry-after-ms`, and every `anthropic-ratelimit-*` header — including the decisive `anthropic-ratelimit-unified-overage-disabled-reason=out_of_credits`, which often arrives ONLY as a header. Without it an out-of-credits 429 read like a generic per-minute rate limit.
+
+### Added
+- **Kimi Code (Moonshot coding subscription) OAuth — completed end-to-end.** The device-code flow (`src/auth/flows/kimi.ts`, RFC 8628: `auth.kimi.com` device_authorization → poll with `authorization_pending`/`slow_down`/`expired_token`/`access_denied` semantics, X-Msh-* device headers, persisted `kimi-device-id`) now has: catalog entries for the Kimi Code models (`kimi-for-coding`, `kimi-k2.7-code`, `kimi/kimi-k2.5`, `kimi/kimi-k2-turbo-preview`, `kimi/kimi-k2` — 262k context, provider-qualified where canonicals collide with tencent's), a `KIMI_CODE_MODELS` export, OAuth gating (`oauthServesModel`: kimi OAuth serves ONLY the Kimi Code set; Moonshot API ids fall back to `KIMI_API_KEY` via `effectiveCredentialForProvider`, with an actionable error when no key exists), and an OAuth-only discovery fallback that lists exactly the Kimi Code models (`catalogOr`) instead of faking moonshot ids. The `kimiAdapter` dispatches on credential kind — OAuth → Anthropic-compatible `api.kimi.com/coding/v1/messages` with plain Bearer + X-Msh headers (no Claude-Code cloaking; gated by `shouldUseClaudeCodeOAuthShape`'s baseUrl check), api_key → the unchanged OpenAI-compatible `api.moonshot.ai/v1`.
+- **Codex/Responses provider-side prompt caching (gjc parity — closes the `ponytail` note in `openai-responses.ts`).** New `CallOptions.sessionKey` threads a stable per-conversation key from `launch.ts` (the session id), `team.ts`, and `task-tool.ts` (per-run UUIDs) through the engine loop into every model call. `codexResponsesRequest` stamps it as `prompt_cache_key` in the body (both the OAuth Codex backend and the public `api.openai.com/v1/responses`) plus `session_id`/`conversation_id`/`x-client-request-id` correlation headers on the Codex backend (`normalizePromptCacheKey`: ≤64 chars verbatim, longer keys hashed `pc_*` — gjc `normalizeOpenAIResponsesPromptCacheKey` parity). An agent loop replays nearly-identical history each step, so cache hits cut both latency and billed input tokens.
+
+### Verified
+- `bun run typecheck` clean; full suite green — 2142 pass / 0 fail across 244 files (before the codex/kimi test additions), then targeted suites re-run green: `retry` (26), `rate-limit-handling` (5), `provider-errors`, `round-b`, `kimi-provider` (7 new), `kimi-oauth` (7 new), `codex-responses` (+3 new). The corrected rate-limit contract is pinned by tests that mirror gjc's own fixtures (3.1h retry-after honored + recovered; model-limit fails fast; mid-wait abort interrupts the sleep).
+
 ## [0.7.27] - 2026-07-02
 _Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks._
 

package/README.ja.md

@@ -205,11 +205,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
+- **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
-- **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -205,11 +205,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
+- **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
-- **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -232,11 +232,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
+- **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
-- **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -205,11 +205,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
+- **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
-- **[0.7.23]** (2026-07-01) — Anthropic 5th-generation model catalog: adds Sonnet 5, Fable 5, and Mythos 5, promotes the 4.6 generation to 1M context / 128k output, and retires the superseded 4.5/3.5/4.1 ids. Bumps the default model to Sonnet 4.6, prices the new tiers, and fixes the thinking transport for Haiku 4.5 and every 5th-gen model.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.27",
+  "version": "0.7.29",
 
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",

package/src/agent/config-schema.ts

@@ -105,6 +105,7 @@ export const ConfigSchema = z
         maxDelayMs: z.number().int().min(0).optional(),
         rateLimitRetries: z.number().int().min(0).optional(),
         rateLimitMinDelayMs: z.number().int().min(0).optional(),
+        rateLimitMaxServerDelayMs: z.number().int().min(0).optional(),
       })
       .optional(),
     /**

package/src/agent/engine.ts

@@ -15,7 +15,7 @@ import { nativeToolSchemasFor, normalizeNativeToolName } from "./tool-schemas";
 import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, type ToolResult } from "./tools";
 import { webSearchTool, setWebSearchActiveModel } from "./web-search";
 import { executeComputerAction } from "../commands/computer";
-import { isRateLimitError } from "../util/retry";
+import { isRateLimitError, waitAbortable } from "../util/retry";
 import { isContextOverflowError, isRefusalError, friendlyProviderError } from "../util/provider-error";
 import { runPreToolHooks, runPostTurnHooksForBatch } from "./hooks";
 import { truncateToolOutput, formatToolResultBody } from "./tool-output";
@@ -40,6 +40,7 @@ async function invokeCallLlm(history: Message[], options: {
   onReasoningStart?: () => void;
   onReasoningArtifact?: (artifact: import("../ai/types").ReasoningArtifact) => void;
   tools?: import("../ai/types").NativeToolSchema[];
+  sessionKey?: string;
 }): Promise<string> {
   const mod = await import("./loop");
   return mod.callLlm(history, options);
@@ -265,6 +266,11 @@ export interface AgentLoopOptions {
    *  so an additional query typed while the turn runs steers the live turn instead of
    *  waiting for the next prompt. Return [] when nothing is pending. */
   steer?: () => string[];
+  /** Stable per-conversation key (the session id): threaded to every model call for
+   *  provider-side prompt caching (gjc parity — Codex prompt_cache_key/session_id).
+   *  An agent loop replays nearly-identical history each step, so cache hits here cut
+   *  both latency and billed input tokens. */
+  sessionKey?: string;
 }
 
 export interface AgentLoopResult {
@@ -388,7 +394,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
                 "with what you have already found this turn, and state explicitly anything that is still uncertain.",
             },
           ],
-          { jsonMode: false, model: opts.model, maxTokens: opts.maxTokens, signal: opts.signal },
+          { jsonMode: false, model: opts.model, maxTokens: opts.maxTokens, signal: opts.signal, sessionKey: opts.sessionKey },
         );
         const consolidated = wrapUp.trim();
         if (consolidated) {
@@ -437,11 +443,13 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   // Round-6 #4: ONE reactive recovery when the PROVIDER reports context overflow
   // (authoritative where the local estimate drifted — images, tokenizer mismatch).
   let contextOverflowRetryUsed = false;
-  // Refusal recovery budget: a safety refusal (HTTP 200, no content) on routine
-  // coding work is usually a transient false-positive. Retry the SAME step once
-  // as-is, then once more with an explicit re-grounding note; only a third
-  // refusal in the turn surfaces the (friendly) error. Bounded per turn so a
-  // genuinely refused request can never burn billed calls in a loop.
+  // Refusal recovery: a safety refusal (HTTP 200, no content) on routine coding
+  // work is usually a transient false-positive. The first rungs MUTATE the context
+  // (plain resend → context reset + re-grounding note → guidance strip); after the
+  // ladder is exhausted the loop keeps resending with capped exponential backoff
+  // instead of surfacing a terminal error (gjc parity: a refusal is retried until
+  // it clears or the user cancels — Esc aborts the backoff wait via opts.signal,
+  // and the turn wall-clock budget still bounds the whole turn).
   const MAX_REFUSAL_RETRIES = GUARD_LIMITS.MAX_REFUSAL_RETRIES;
   let refusalRetries = 0;
   let lastSig = "";
@@ -557,6 +565,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
               maxTokens: opts.maxTokens,
               reasoningEffort: opts.reasoningEffort,
               signal: opts.signal,
+              sessionKey: opts.sessionKey,
               onUsage: u => { acc.inputTokens += u.inputTokens ?? 0; acc.outputTokens += u.outputTokens ?? 0; sawUsage = true; },
               onToken,
               onReasoning,
@@ -603,7 +612,15 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       //      routine). Strip that block for the rest of the turn and retry once;
       //      core instructions stay intact. Field case: `$gjc init` inside a
       //      repo whose guidance files refuse-trip the OAuth classifier.
-      if (isRefusalError(err) && refusalRetries < MAX_REFUSAL_RETRIES) {
+      //   4) unbounded backoff — the classifier verdict is TIME-sensitive (rolling
+      //      classifier state, per-request user-id rotation), so once every
+      //      context mutation is spent, keep resending with capped exponential
+      //      backoff instead of surfacing a terminal error (gjc parity: gjc's
+      //      session auto-retry classifies a refusal as retryable and never ends
+      //      the turn on it). Esc/cancel aborts the wait via opts.signal and the
+      //      loop-top check turns it into "Cancelled."; JEO_TURN_MAX_MS still
+      //      bounds the whole turn.
+      if (isRefusalError(err)) {
         refusalRetries++;
         if (refusalRetries === 1) {
           ev.onNotice?.("provider refused the last call (no content) — retrying the same step");
@@ -635,15 +652,24 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           step++;
           continue;
         }
-        const sys = history[0];
-        if (sys?.role === "system" && sys.content.includes("<project_context>")) {
-          const stripped = sys.content.replace(/\n*<project_context>[\s\S]*?<\/project_context>/, "").trimEnd();
-          history[0] = { ...sys, content: stripped }; // replace, never mutate (identity caches)
-          ev.onNotice?.("provider refused a third time — removed project-context guidance from the system prompt and retrying once more");
-          continue; // same step, reduced system prompt
+        if (refusalRetries === 3) {
+          const sys = history[0];
+          if (sys?.role === "system" && sys.content.includes("<project_context>")) {
+            const stripped = sys.content.replace(/\n*<project_context>[\s\S]*?<\/project_context>/, "").trimEnd();
+            history[0] = { ...sys, content: stripped }; // replace, never mutate (identity caches)
+            ev.onNotice?.("provider refused a third time — removed project-context guidance from the system prompt and retrying once more");
+            continue; // same step, reduced system prompt
+          }
+          // Nothing left to strip — fall through to the backoff rung below.
         }
-        // Nothing left to strip — fall through to the friendly terminal error
-        // instead of burning an identical billed call.
+        // Rung 4: every context mutation is spent. Backoff-resend forever (abortable).
+        const attempt = Math.max(1, refusalRetries - MAX_REFUSAL_RETRIES);
+        const baseRaw = Number(jeoEnv("REFUSAL_BACKOFF_BASE_MS") ?? NaN);
+        const baseMs = Number.isFinite(baseRaw) && baseRaw >= 0 ? baseRaw : GUARD_LIMITS.REFUSAL_BACKOFF_BASE_MS;
+        const delayMs = Math.min(baseMs * 2 ** (attempt - 1), GUARD_LIMITS.REFUSAL_BACKOFF_MAX_MS);
+        ev.onNotice?.(`provider refused again — auto-retry #${attempt} in ${Math.max(1, Math.round(delayMs / 1000))}s (Esc to cancel)`);
+        await waitAbortable(delayMs, opts.signal);
+        continue; // loop top surfaces "Cancelled." when the wait was aborted
       }
       const message = friendlyProviderError(err);
       // The error IS the turn's doneReason and every caller displays that — emitting a
@@ -1132,7 +1158,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
               "the key findings/changes so far, and what remains to be done next.",
           },
         ],
-        { jsonMode: false, model: opts.model, maxTokens: opts.maxTokens, signal: opts.signal },
+        { jsonMode: false, model: opts.model, maxTokens: opts.maxTokens, signal: opts.signal, sessionKey: opts.sessionKey },
       );
       const consolidated = wrapUp.trim();
       if (consolidated) {

package/src/agent/loop-guards.ts

@@ -25,7 +25,7 @@ export type GuardState =
   | "invalid_tool_stop" // MAX_INVALID_CALLS replies with no usable tool field → stop
   | "parse_salvage" // repeated non-JSON prose → salvage the text as the final answer
   | "context_overflow_retry" // provider reported context overflow → ONE trim + retry
-  | "refusal_retry" // transient safety refusal → bounded resend ladder
+  | "refusal_retry" // safety refusal → context-reset ladder, then unbounded backoff resends
   | "done_unverified" // mutated files, no verification signal → pushback on done
   | "done_stale_verification" // verified, then mutated again → re-verify before done
   | "done_hook_failing" // post-turn hook still failing → pushback on done
@@ -41,8 +41,13 @@ export const GUARD_LIMITS = Object.freeze({
   MAX_REPEAT: 4,
   /** Consecutive different-but-failing steps before the turn stops. */
   MAX_FAILURES: 5,
-  /** Safety-refusal resends per turn before surfacing the friendly error. */
+  /** Context-mutating refusal-ladder rungs (resend → reset → guidance strip) before
+   *  recovery switches to unbounded backoff resends (gjc parity: never terminal). */
   MAX_REFUSAL_RETRIES: 3,
+  /** First post-ladder refusal backoff wait (ms); doubles per attempt (gjc retry.baseDelayMs). */
+  REFUSAL_BACKOFF_BASE_MS: 2_000,
+  /** Ceiling on the post-ladder refusal backoff wait (ms). */
+  REFUSAL_BACKOFF_MAX_MS: 30_000,
   /** Replies with no usable `tool`/`tools` field before the turn stops. */
   MAX_INVALID_CALLS: 3,
   /** Consecutive non-JSON parse failures before the prose is salvaged as the answer. */

package/src/agent/loop.ts

@@ -31,6 +31,9 @@ export interface ChatOptions {
   onReasoningArtifact?: (artifact: import("../ai/types").ReasoningArtifact) => void;
   /** NATIVE tool-calling function declarations (forwarded to capable adapters). */
   tools?: import("../ai/types").NativeToolSchema[];
+  /** Stable per-conversation key (session id) for provider-side prompt caching
+   *  (gjc parity: prompt_cache_key / session_id correlation on Codex/Responses). */
+  sessionKey?: string;
 }
 
 const manager = createModelManager();

package/src/agent/state.ts

@@ -78,6 +78,11 @@ export interface Config {
     rateLimitRetries?: number;
     /** Minimum backoff (ms) for a 429 when the server sends no Retry-After. */
     rateLimitMinDelayMs?: number;
+    /** Opt-in ceiling (ms) on a 429's server-directed Retry-After: a delay beyond it fails
+     *  fast instead of sleeping. Unset (the default) honors any server-directed delay in
+     *  full, however long — a generic rate limit is retried forever, not treated as fatal
+     *  past some budget. Set this only if unbounded rate-limit waits are undesirable. */
+    rateLimitMaxServerDelayMs?: number;
     /** HTTP statuses to treat as NON-retryable even when defaultRetryable would
      *  retry them (e.g. pin 503 to fail fast instead of riding the backoff ladder). */
     failFastStatuses?: number[];
@@ -385,14 +390,88 @@ export async function readRawGlobalConfig(): Promise<Config> {
   return salvageCredentials(clean, parsed);
 }
 
+/**
+ * Global config write lock — HIGH-1 lost-update fix (gjc parity: auth-storage.ts
+ * SqliteAuthCredentialStore serializes credential writes inside SQLite). jeo keeps
+ * everything in one config.json, so EVERY read-modify-write must serialize through one
+ * lock file; otherwise two concurrent per-provider OAuth refreshes (e.g. doctor.ts
+ * Promise.all) read the same base config and the later write clobbers the earlier one's
+ * just-rotated refresh token → silent logout.
+ *
+ * Semantics mirror src/auth/storage.ts acquireLock (stale-lock detection + bounded wait
+ * + single steal at the deadline) but are implemented locally: storage.ts imports
+ * state.ts, so importing it back would create a cycle.
+ * // ponytail: extract a shared lockfile helper module if a third lockfile user appears.
+ */
+const CONFIG_LOCK_STALE_MS = 5_000;
+
+function configLockPath(): string {
+  return `${globalConfigPath()}.lock`;
+}
+
+async function acquireConfigLock(timeoutMs = CONFIG_LOCK_STALE_MS): Promise<void> {
+  const lockPath = configLockPath();
+  await fs.mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+  // `timeoutMs` is the STALENESS threshold for a dead holder's lock file; the
+  // acquisition wait itself is bounded at 2× that (same policy as storage.ts).
+  const deadline = Date.now() + Math.max(timeoutMs * 2, 1_000);
+  while (true) {
+    try {
+      const handle = await fs.open(lockPath, "wx");
+      await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: Date.now() }), "utf-8");
+      await handle.close();
+      return;
+    } catch (err: any) {
+      if (err.code !== "EEXIST") throw err;
+      try {
+        const info = JSON.parse(await fs.readFile(lockPath, "utf-8"));
+        if (typeof info.createdAt === "number" && info.createdAt + timeoutMs < Date.now()) {
+          await fs.unlink(lockPath).catch(() => {});
+        }
+      } catch {
+        try {
+          const stat = await fs.stat(lockPath);
+          if (stat.mtimeMs + timeoutMs < Date.now()) {
+            await fs.unlink(lockPath).catch(() => {});
+          }
+        } catch {}
+      }
+    }
+    if (Date.now() >= deadline) {
+      // Deadline reached: the holder is dead or wedged. Steal once — the lock guards
+      // a short config read-modify-write, so waiting longer only hangs the caller.
+      await fs.unlink(lockPath).catch(() => {});
+      const handle = await fs.open(lockPath, "wx").catch(() => null);
+      if (handle) {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: Date.now(), stolen: true }), "utf-8");
+        await handle.close();
+        return;
+      }
+      throw new Error(`config lock could not be acquired within ${Math.max(timeoutMs * 2, 1_000)}ms (${lockPath})`);
+    }
+    await new Promise(resolve => setTimeout(resolve, 50));
+  }
+}
+
+async function releaseConfigLock(): Promise<void> {
+  await fs.unlink(configLockPath()).catch(() => {});
+}
+
 /** Merge a patch onto the RAW on-disk config and persist. The `build` callback
  *  receives the raw config so partial updates (subagents/roles maps) are derived
- *  from on-disk state, never from the env-overlaid runtime config. */
+ *  from on-disk state, never from the env-overlaid runtime config. The whole
+ *  read→merge→write cycle holds the global config lock so concurrent patches
+ *  (per-provider OAuth refreshes, /model save, doctor sweeps) never lose updates. */
 export async function saveConfigPatch(build: (raw: Config) => Partial<Config>): Promise<Config> {
-  const raw = await readRawGlobalConfig();
-  const next = { ...raw, ...build(raw) };
-  await saveGlobalConfig(next);
-  return next;
+  await acquireConfigLock();
+  try {
+    const raw = await readRawGlobalConfig();
+    const next = { ...raw, ...build(raw) };
+    await saveGlobalConfig(next);
+    return next;
+  } finally {
+    await releaseConfigLock();
+  }
 }
 
 export function getLocalJeoDir(cwd: string = process.cwd()): string {

package/src/agent/task-tool.ts

@@ -220,6 +220,9 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       model,
       maxSteps,
       maxTokens: resolveMaxOutputTokens(model, thinking),
+      // Per-run prompt-cache key: the subagent replays its own growing history each
+      // step, so a stable per-run key gets provider cache hits (gjc sub-session parity).
+      sessionKey: crypto.randomUUID(),
       // Bounded delegation: a subagent's step contract stays exact — the parent
       // owns any retry/extension decision, so the gjc retry flow is disabled here.
       budget: { maxExtensions: 0 },

package/src/ai/model-catalog.ts

@@ -93,6 +93,14 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
   { canonical: "kimi-thinking-preview", provider: "kimi", providerModel: "kimi-thinking-preview", contextTokens: 128_000, maxOutputTokens: 32_000, thinking: FULL, images: true },
   { canonical: "kimi-latest", provider: "kimi", providerModel: "kimi-latest", contextTokens: 128_000, maxOutputTokens: 16_384, thinking: [], images: true },
   { canonical: "moonshot-v1-128k", provider: "kimi", providerModel: "moonshot-v1-128k", contextTokens: 128_000, maxOutputTokens: 16_384, thinking: [], images: false },
+  // Kimi Code (Moonshot coding subscription, device-code OAuth) — Anthropic-compatible
+  // at https://api.kimi.com/coding. Provider-qualified (`kimi/…`) to avoid canonical
+  // collisions (kimi-k2.5 also exists under tencent). gjc catalog parity: kimi-code.
+  { canonical: "kimi-for-coding", provider: "kimi", providerModel: "kimi/kimi-for-coding", contextTokens: 262_144, maxOutputTokens: 32_000, thinking: FULL, images: true, company: "Moonshot (Kimi Code)" },
+  { canonical: "kimi-k2.7-code", provider: "kimi", providerModel: "kimi/kimi-k2.7-code", contextTokens: 262_144, maxOutputTokens: 65_536, thinking: FULL, images: true, company: "Moonshot (Kimi Code)" },
+  { canonical: "kimi/kimi-k2.5", provider: "kimi", providerModel: "kimi/kimi-k2.5", contextTokens: 262_144, maxOutputTokens: 65_536, thinking: FULL, images: true, company: "Moonshot (Kimi Code)" },
+  { canonical: "kimi/kimi-k2-turbo-preview", provider: "kimi", providerModel: "kimi/kimi-k2-turbo-preview", contextTokens: 262_144, maxOutputTokens: 32_000, thinking: FULL, images: false, company: "Moonshot (Kimi Code)" },
+  { canonical: "kimi/kimi-k2", provider: "kimi", providerModel: "kimi/kimi-k2", contextTokens: 262_144, maxOutputTokens: 262_144, thinking: [], images: false, company: "Moonshot (Kimi Code)" },
   // Google
   { canonical: "gemini-1.5-pro", provider: "gemini", providerModel: "gemini-1.5-pro", contextTokens: 1_000_000, maxOutputTokens: 8_192, thinking: [], images: true },
   { canonical: "gemini-2.0-flash", provider: "gemini", providerModel: "gemini-2.0-flash", contextTokens: 1_000_000, maxOutputTokens: 8_192, thinking: [], images: true },
@@ -144,6 +152,21 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
  */
 export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4"];
 
+/**
+ * Model ids the Kimi Code OAuth backend (api.kimi.com/coding, Anthropic Messages
+ * format) actually serves. The subscription endpoint rejects Moonshot API-platform
+ * ids (kimi-latest, moonshot-v1-*, kimi-thinking-preview), so a Kimi OAuth login is
+ * limited to exactly these; an API key serves the api.moonshot.ai catalog instead.
+ * gjc parity: models.json `kimi-code` provider entries (wire ids, `kimi/` stripped).
+ */
+export const KIMI_CODE_MODELS: readonly string[] = [
+  "kimi-for-coding",
+  "kimi-k2.7-code",
+  "kimi-k2.5",
+  "kimi-k2-turbo-preview",
+  "kimi-k2",
+];
+
 /** Format a token count compactly (1000 → 1K, 1_000_000 → 1M). */
 export function formatTokens(n: number): string {
   if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(n % 1_000_000 === 0 ? 0 : 1)}M`;

package/src/ai/model-discovery.ts

@@ -11,7 +11,7 @@ import { readGlobalConfig, type Config } from "../agent/state";
 import { resolveCredential, type AuthProvider, type Credential } from "../auth";
 import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
-import { catalogByProvider, CODEX_MODELS } from "./model-catalog";
+import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS } from "./model-catalog";
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
@@ -291,7 +291,11 @@ export function catalogOr(result: ProviderModelsResult): ProviderModelsResult {
   if (!eligible) return result;
   const ids = result.provider === "openai" && result.source === "oauth"
     ? [...CODEX_MODELS]
-    : catalogByProvider(result.provider).map(m => m.providerModel);
+    : result.provider === "kimi" && result.source === "oauth"
+      // Kimi OAuth (Kimi Code subscription) serves ONLY the Kimi Code catalog —
+      // moonshot API-platform ids would 404 against api.kimi.com/coding.
+      ? KIMI_CODE_MODELS.map(id => `kimi/${id}`)
+      : catalogByProvider(result.provider).map(m => m.providerModel);
   if (ids.length === 0) return result;
   return { ...result, models: ids, ok: true, fallback: true };
 }

package/src/ai/model-manager.ts

@@ -6,7 +6,7 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS, findCatalogModel } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { OPENAI_COMPAT_NAMES, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
 import { withRetry, defaultRetryable, type RetryOptions } from "../util/retry";
@@ -194,19 +194,18 @@ const ALIAS_DEFAULTS = { fast: "ollama/qwen2.5:0.5b", local: "ollama/qwen2.5:0.5
  * requestMaxRetries + 1. When unset, the `withRetry` defaults apply (3 attempts),
  * but rate-limit (429) errors get a more generous budget + a backoff floor so a
  * transient per-minute window can clear instead of the very first 429 instantly
- * exhausting auto-retry. A server-directed retry delay above the five-minute
- * budget is surfaced immediately with its reset hint instead of being capped and
- * retried pointlessly. Explicit config (`requestMaxRetries`/`maxDelayMs`) always
- * wins and disables the matching rate-limit default.
- * `maxDelayMs` caps per-attempt backoff when provided.
+ * exhausting auto-retry. A server-directed retry delay is honored IN FULL — no
+ * default ceiling — because a generic 429 is retried forever, not treated as fatal
+ * past some arbitrary budget (gjc parity: even a multi-hour Anthropic rate-limit
+ * window is retried, not bailed on); `rateLimitMaxServerDelayMs` remains available
+ * as an explicit opt-in for a caller that truly cannot wait that long. Explicit
+ * config (`requestMaxRetries`/`maxDelayMs`) always wins and disables the matching
+ * rate-limit default. `maxDelayMs` caps per-attempt backoff when provided.
  */
 const DEFAULT_RATE_LIMIT_RETRIES = 6; // total attempts for 429 (initial + 5 retries)
 // 429 floor when the server sends no Retry-After. Escalates per attempt inside
 // withRetry (2s → 4s → 8s → 16s → 30s ≈ 60s total), spanning a per-minute window.
 const DEFAULT_RATE_LIMIT_MIN_DELAY_MS = 2000;
-// GJC parity for server-directed 429s: retry short windows, but do not hang a CLI
-// through long subscription/account resets.
-const DEFAULT_RATE_LIMIT_MAX_SERVER_DELAY_MS = 5 * 60 * 1000;
 export function resolveRetryOptions(retry: Config["retry"], kind: "request" | "stream" = "request"): RetryOptions {
   const opts: RetryOptions = { isRetryable: defaultRetryable };
 
@@ -244,7 +243,12 @@ export function resolveRetryOptions(retry: Config["retry"], kind: "request" | "s
   // 429 backoff floor: explicit wins; else default UNLESS the user pinned maxDelayMs.
   if (typeof retry?.rateLimitMinDelayMs === "number") opts.rateLimitMinDelayMs = retry.rateLimitMinDelayMs;
   else if (typeof retry?.maxDelayMs !== "number") opts.rateLimitMinDelayMs = DEFAULT_RATE_LIMIT_MIN_DELAY_MS;
-  opts.rateLimitMaxServerDelayMs = DEFAULT_RATE_LIMIT_MAX_SERVER_DELAY_MS;
+  // No default `rateLimitMaxServerDelayMs` ceiling: gjc parity retries a generic 429
+  // forever, honoring however long the server asks (see the doc comment above). Usage
+  // limits fail fast on their own via isUsageLimitError → defaultRetryable, well before a
+  // wait is ever computed, so this is safe. An explicit config value is still honored for
+  // a caller that truly cannot wait an unbounded server-directed delay.
+  if (typeof retry?.rateLimitMaxServerDelayMs === "number") opts.rateLimitMaxServerDelayMs = retry.rateLimitMaxServerDelayMs;
 
   // Config-driven fail-fast overrides: a status in `failFastStatuses` or a message
   // matching any `failFastPattern` is forced non-retryable, layered on top of the
@@ -281,12 +285,18 @@ export function resolveRetryOptions(retry: Config["retry"], kind: "request" | "s
 /**
  * Whether the bundled adapter can serve this provider+model over OAuth end-to-end.
  * OpenAI OAuth (ChatGPT/Codex) only serves Codex models, so any other OpenAI model
- * must use an API key. A provider whose OAuth backend is not verified end-to-end
+ * must use an API key. Kimi OAuth (Kimi Code subscription) only serves the Kimi Code
+ * catalog (api.kimi.com/coding) — Moonshot API-platform ids (kimi-latest, moonshot-v1-*)
+ * need a KIMI_API_KEY. A provider whose OAuth backend is not verified end-to-end
  * cannot serve any model over OAuth. Everything else (Anthropic Messages, Gemini /
  * Antigravity Cloud Code Assist) is served end-to-end.
  */
 function oauthServesModel(provider: AuthProvider, model: string): boolean {
   if (provider === "openai") return CODEX_MODELS.includes(model);
+  if (provider === "kimi") {
+    const wire = model.startsWith("kimi/") ? model.slice(5) : model;
+    return KIMI_CODE_MODELS.includes(wire);
+  }
   if (isOAuthProvider(provider) && OAUTH_FLOW_REGISTRY[provider].verifiedEndToEnd === false) return false;
   return true;
 }
@@ -375,6 +385,7 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
     onReasoning: options.onReasoning,
     onReasoningArtifact: options.onReasoningArtifact,
     tools: options.tools,
+    sessionKey: options.sessionKey,
   };
   // Caller-supplied retry sink rides on the config-derived retry budget so the
   // engine/TUI can surface "rate limited — retrying in Ns" instead of a silent wait.
@@ -383,7 +394,12 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
   // never replays after the first emitted chunk). Both fall back to `maxRetries`,
   // and an unset stream budget keeps the conservative withRetry default — the
   // generous gjc default of 100 only applies when the user configures it.
-  const retry: RetryOptions = { ...resolveRetryOptions(config.retry, kind), ...(options.onRetry ? { onRetry: options.onRetry } : {}) };
+  // `retry.signal` is the caller's ORIGINAL signal (Ctrl-C / turn abort) — not the
+  // per-attempt fetch timeout composed below — so a long, honored server-directed
+  // retry wait (see resolveRetryOptions) can still be cancelled by the user without
+  // waiting out the full delay, while a single attempt's timeout never cuts short
+  // the NEXT attempt's backoff sleep.
+  const retry: RetryOptions = { ...resolveRetryOptions(config.retry, kind), ...(options.onRetry ? { onRetry: options.onRetry } : {}), ...(callOptions.signal ? { signal: callOptions.signal } : {}) };
 
   if (provider === "ollama" || provider === "lmstudio") {
     return { adapter, callOptions, credential: { kind: "none", provider: "openai" }, retry };
@@ -416,6 +432,11 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
       "OpenAI OAuth 자격증명은 Codex 모델(gpt-5.5/gpt-5.4)만 지원. OPENAI_API_KEY를 설정하거나 모델을 변경하세요"
     );
   }
+  if (provider === "kimi" && effective.kind === "oauth" && !oauthServesModel("kimi", model)) {
+    throw new Error(
+      `Kimi OAuth (Kimi Code subscription) serves only the Kimi Code models (${KIMI_CODE_MODELS.join(", ")}). Set KIMI_API_KEY for Moonshot API models, or pick a Kimi Code model with /model.`,
+    );
+  }
   if (effective.kind === "none" && !isLocalOpenAi) {
     throw new Error(
       `No credential for provider '${provider}'. Run 'jeo setup', 'jeo auth login', or set ${provider.toUpperCase()}_API_KEY / ${provider.toUpperCase()}_OAUTH_TOKEN.`