jeo-code 0.7.28 → 0.7.29

package/CHANGELOG.md

@@ -6,6 +6,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.29] - 2026-07-02
+_gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder._
+
+### Fixed
+- **Safety refusals now keep retrying instead of surfacing a terminal provider error.** jeo already had the stronger context-mutating recovery ladder (plain resend → tool-result/thinking-replay reset → project-context guidance strip), but once those rungs were spent it still returned `Anthropic declined to answer (safety refusal — no content returned) even after automatic retries with a context reset`. gjc's session retry path treats that class as non-terminal and keeps the session alive. jeo now adds the same final rung: capped exponential backoff resends after all context mutations are spent, with an `Esc`/abort-cancellable wait and the turn wall-clock budget still bounding the whole run.
+- **The stale fallback refusal copy no longer claims automatic retries were exhausted.** The friendly provider error text is now reserved for non-engine call sites and points users at `/retry`, `/compact`, `/new`, or `/model` without implying the agent already gave up.
+
+### Verified
+- `bun run typecheck` clean; full suite green — 2146 pass / 0 fail across 244 files. Targeted coverage updated in `test/refusal-recovery.test.ts` for the new post-ladder backoff recovery and for Esc/Ctrl+C aborting a refusal backoff as `Cancelled.` instead of surfacing the refusal error.
+
 ## [0.7.28] - 2026-07-02
 _gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests)._
 

package/README.ja.md

@@ -205,11 +205,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
 - **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -205,11 +205,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
 - **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -232,11 +232,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
 - **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -205,11 +205,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.29]** (2026-07-02) — gajae-code safety-refusal retry parity: Anthropic/OAuth content-classifier refusals no longer end the turn with a fatal "declined to answer" message after the context-reset ladder.
 - **[0.7.28]** (2026-07-02) — gajae-code 0.7.9–0.7.10 OAuth + model-execution parity: generic long rate-limit windows are retried (never fatal), retry waits are abort-cancellable, Codex prompt caching via session correlation, and the Kimi Code device-flow OAuth is completed end-to-end (catalog, gating, discovery, tests).
 - **[0.7.27]** (2026-07-02) — Extended-keyboard decode layer: Esc/Ctrl+C work again on kitty-protocol terminals, Shift+Enter breaks lines on every terminal incl. Windows, row/draft-aware Cmd+←→/↑↓ + Home/End/Ctrl+Home/End, Ctrl+V text-paste fallback. Plus Anthropic 5th-gen omp-parity: catalog-derived output budgets end thinking-vs-reply starvation; refusals fail fast at the transport and the recovery ladder strips replayed thinking blocks.
 - **[0.7.26]** (2026-07-02) — Esc/Ctrl+C reliably clears the input box (fixes a gate the earlier reorder missed), and un-bracketed multi-line pastes no longer shred into premature per-line submits.
 - **[0.7.25]** (2026-07-02) — Shift+Enter now reliably distinguishable from Enter on kitty/WezTerm/iTerm2/xterm via modifyOtherKeys + kitty keyboard protocol; row-aware Home/End and Cmd+Left/Right in multi-row drafts.
-- **[0.7.24]** (2026-07-02) — OAuth callback page redesign with embedded jeo wordmark + Close button; memory budget O(n²)→O(n) incremental tracking fix.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.28",
+  "version": "0.7.29",
 
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",

package/src/agent/engine.ts

@@ -15,7 +15,7 @@ import { nativeToolSchemasFor, normalizeNativeToolName } from "./tool-schemas";
 import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, type ToolResult } from "./tools";
 import { webSearchTool, setWebSearchActiveModel } from "./web-search";
 import { executeComputerAction } from "../commands/computer";
-import { isRateLimitError } from "../util/retry";
+import { isRateLimitError, waitAbortable } from "../util/retry";
 import { isContextOverflowError, isRefusalError, friendlyProviderError } from "../util/provider-error";
 import { runPreToolHooks, runPostTurnHooksForBatch } from "./hooks";
 import { truncateToolOutput, formatToolResultBody } from "./tool-output";
@@ -443,11 +443,13 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   // Round-6 #4: ONE reactive recovery when the PROVIDER reports context overflow
   // (authoritative where the local estimate drifted — images, tokenizer mismatch).
   let contextOverflowRetryUsed = false;
-  // Refusal recovery budget: a safety refusal (HTTP 200, no content) on routine
-  // coding work is usually a transient false-positive. Retry the SAME step once
-  // as-is, then once more with an explicit re-grounding note; only a third
-  // refusal in the turn surfaces the (friendly) error. Bounded per turn so a
-  // genuinely refused request can never burn billed calls in a loop.
+  // Refusal recovery: a safety refusal (HTTP 200, no content) on routine coding
+  // work is usually a transient false-positive. The first rungs MUTATE the context
+  // (plain resend → context reset + re-grounding note → guidance strip); after the
+  // ladder is exhausted the loop keeps resending with capped exponential backoff
+  // instead of surfacing a terminal error (gjc parity: a refusal is retried until
+  // it clears or the user cancels — Esc aborts the backoff wait via opts.signal,
+  // and the turn wall-clock budget still bounds the whole turn).
   const MAX_REFUSAL_RETRIES = GUARD_LIMITS.MAX_REFUSAL_RETRIES;
   let refusalRetries = 0;
   let lastSig = "";
@@ -610,7 +612,15 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       //      routine). Strip that block for the rest of the turn and retry once;
       //      core instructions stay intact. Field case: `$gjc init` inside a
       //      repo whose guidance files refuse-trip the OAuth classifier.
-      if (isRefusalError(err) && refusalRetries < MAX_REFUSAL_RETRIES) {
+      //   4) unbounded backoff — the classifier verdict is TIME-sensitive (rolling
+      //      classifier state, per-request user-id rotation), so once every
+      //      context mutation is spent, keep resending with capped exponential
+      //      backoff instead of surfacing a terminal error (gjc parity: gjc's
+      //      session auto-retry classifies a refusal as retryable and never ends
+      //      the turn on it). Esc/cancel aborts the wait via opts.signal and the
+      //      loop-top check turns it into "Cancelled."; JEO_TURN_MAX_MS still
+      //      bounds the whole turn.
+      if (isRefusalError(err)) {
         refusalRetries++;
         if (refusalRetries === 1) {
           ev.onNotice?.("provider refused the last call (no content) — retrying the same step");
@@ -642,15 +652,24 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           step++;
           continue;
         }
-        const sys = history[0];
-        if (sys?.role === "system" && sys.content.includes("<project_context>")) {
-          const stripped = sys.content.replace(/\n*<project_context>[\s\S]*?<\/project_context>/, "").trimEnd();
-          history[0] = { ...sys, content: stripped }; // replace, never mutate (identity caches)
-          ev.onNotice?.("provider refused a third time — removed project-context guidance from the system prompt and retrying once more");
-          continue; // same step, reduced system prompt
+        if (refusalRetries === 3) {
+          const sys = history[0];
+          if (sys?.role === "system" && sys.content.includes("<project_context>")) {
+            const stripped = sys.content.replace(/\n*<project_context>[\s\S]*?<\/project_context>/, "").trimEnd();
+            history[0] = { ...sys, content: stripped }; // replace, never mutate (identity caches)
+            ev.onNotice?.("provider refused a third time — removed project-context guidance from the system prompt and retrying once more");
+            continue; // same step, reduced system prompt
+          }
+          // Nothing left to strip — fall through to the backoff rung below.
         }
-        // Nothing left to strip — fall through to the friendly terminal error
-        // instead of burning an identical billed call.
+        // Rung 4: every context mutation is spent. Backoff-resend forever (abortable).
+        const attempt = Math.max(1, refusalRetries - MAX_REFUSAL_RETRIES);
+        const baseRaw = Number(jeoEnv("REFUSAL_BACKOFF_BASE_MS") ?? NaN);
+        const baseMs = Number.isFinite(baseRaw) && baseRaw >= 0 ? baseRaw : GUARD_LIMITS.REFUSAL_BACKOFF_BASE_MS;
+        const delayMs = Math.min(baseMs * 2 ** (attempt - 1), GUARD_LIMITS.REFUSAL_BACKOFF_MAX_MS);
+        ev.onNotice?.(`provider refused again — auto-retry #${attempt} in ${Math.max(1, Math.round(delayMs / 1000))}s (Esc to cancel)`);
+        await waitAbortable(delayMs, opts.signal);
+        continue; // loop top surfaces "Cancelled." when the wait was aborted
       }
       const message = friendlyProviderError(err);
       // The error IS the turn's doneReason and every caller displays that — emitting a

package/src/agent/loop-guards.ts

@@ -25,7 +25,7 @@ export type GuardState =
   | "invalid_tool_stop" // MAX_INVALID_CALLS replies with no usable tool field → stop
   | "parse_salvage" // repeated non-JSON prose → salvage the text as the final answer
   | "context_overflow_retry" // provider reported context overflow → ONE trim + retry
-  | "refusal_retry" // transient safety refusal → bounded resend ladder
+  | "refusal_retry" // safety refusal → context-reset ladder, then unbounded backoff resends
   | "done_unverified" // mutated files, no verification signal → pushback on done
   | "done_stale_verification" // verified, then mutated again → re-verify before done
   | "done_hook_failing" // post-turn hook still failing → pushback on done
@@ -41,8 +41,13 @@ export const GUARD_LIMITS = Object.freeze({
   MAX_REPEAT: 4,
   /** Consecutive different-but-failing steps before the turn stops. */
   MAX_FAILURES: 5,
-  /** Safety-refusal resends per turn before surfacing the friendly error. */
+  /** Context-mutating refusal-ladder rungs (resend → reset → guidance strip) before
+   *  recovery switches to unbounded backoff resends (gjc parity: never terminal). */
   MAX_REFUSAL_RETRIES: 3,
+  /** First post-ladder refusal backoff wait (ms); doubles per attempt (gjc retry.baseDelayMs). */
+  REFUSAL_BACKOFF_BASE_MS: 2_000,
+  /** Ceiling on the post-ladder refusal backoff wait (ms). */
+  REFUSAL_BACKOFF_MAX_MS: 30_000,
   /** Replies with no usable `tool`/`tools` field before the turn stops. */
   MAX_INVALID_CALLS: 3,
   /** Consecutive non-JSON parse failures before the prose is salvaged as the answer. */

package/src/util/provider-error.ts

@@ -61,7 +61,7 @@ export function friendlyProviderError(err: unknown): string {
     return `${provider} rejected the request: the conversation no longer fits the model's context window. Run /compact, drop large attachments, or start a fresh session.`;
   }
   if (isRefusalError(err)) {
-    return `${provider} declined to answer (safety refusal — no content returned) even after automatic retries with a context reset. Usually a content classifier tripped on recently read file/search content: /retry once more, /compact or /new to drop the triggering context, or switch model with /model. If this persists on a Claude subscription (OAuth) login, Anthropic restricts third-party OAuth clients — set ANTHROPIC_API_KEY or use another provider.`;
+    return `${provider} declined to answer (safety refusal — no content returned). Usually a content classifier tripped on recently read file/search content: /retry, /compact or /new to drop the triggering context, or switch model with /model. If this persists on a Claude subscription (OAuth) login, Anthropic restricts third-party OAuth clients — set ANTHROPIC_API_KEY or use another provider.`;
   }
   if (status === 404) {
     return `${provider} does not recognize the requested model (HTTP 404). The id may be retired, gated, or mistyped — pick another with /model.`;

package/src/util/retry.ts

@@ -208,6 +208,26 @@ function abortableSleep(sleep: (ms: number) => Promise<void>, ms: number, signal
   return promise;
 }
 
+/** Abortable wait for the ENGINE's post-ladder refusal backoff: resolves EARLY (never
+ *  rejects) when `signal` aborts, so the agent loop's top-of-loop cancellation check
+ *  owns the exit path. Distinct from the rejecting `abortableSleep` inside `withRetry`,
+ *  whose callers need the abort reason propagated as an error. */
+export function waitAbortable(ms: number, signal?: AbortSignal): Promise<void> {
+  const { promise, resolve } = Promise.withResolvers<void>();
+  if (signal?.aborted) {
+    resolve();
+    return promise;
+  }
+  const finish = () => {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", finish);
+    resolve();
+  };
+  const timer = setTimeout(finish, ms);
+  signal?.addEventListener("abort", finish, { once: true });
+  return promise;
+}
+
 // Extract a non-negative `retryAfterMs` from an error, if it carries one (e.g. ProviderHttpError).
 function retryAfterOf(err: unknown): number | undefined {
   if (typeof err === "object" && err !== null) {
@@ -258,8 +278,9 @@ export function isUsageLimitError(err: unknown): boolean {
  *  block reasons). Lives here (not provider-error.ts) so `defaultRetryable` can
  *  fail fast on it: a refusal is DETERMINISTIC for the same conversation content —
  *  transport-level resends of an identical payload just burn billed calls. The
- *  engine's bounded refusal ladder (resend → context reset → guidance strip) is
- *  the correct recovery layer because it MUTATES the context between attempts. */
+ *  engine's refusal ladder (resend → context reset → guidance strip, then unbounded
+ *  capped backoff — gjc parity: a refusal is never terminal) is the correct recovery
+ *  layer because it MUTATES the context between attempts. */
 export function isRefusalError(err: unknown): boolean {
   return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)/i.test(errorMessageOf(err));
 }