jeo-code 0.7.3 → 0.7.4

package/CHANGELOG.md

@@ -6,6 +6,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.4] - 2026-06-22
+_Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop._
+
+### Fixed
+- **Per-session model selection no longer leaks between concurrent sessions.** The per-turn model now falls back to the model resolved at THIS session's start (a frozen snapshot) instead of re-reading the live global `defaultModel`. Previously a second `jeo` session running `/model` persisted the global default (`rememberModelPatch`), and the first session's next turn would silently pick up that write mid-run. Running sessions are now model-isolated — they never influence each other.
+
+### Changed
+- **Read-only code-inspection slash handlers are extracted into a pure module.** `/view`, `/diff`, `/find`, and `/search` move to `src/commands/launch/code-slash.ts` as self-contained async functions that take the raw input + cwd (and theme, for `/diff`) and return the lines to print — no closure-bound side effects. The REPL dispatch is now a thin `for (const line of await handle…) console.log(line)` adapter.
+- **The `/undo` git slash and `/history` view are extracted for direct testing.** `handleUndoSlash` (in `src/commands/launch/git-slash.ts`) keeps its guard rail — it refuses any commit lacking the `[jeo] auto-commit:` prefix and any non-git tree — verifiable against a throwaway repo. `historyViewLines` (in `src/commands/launch/slash-views.ts`) makes the `/history [N|all]` banner/separator math and turn-count parsing pure over the in-memory transcript + terminal width.
+
+### Verified
+- `bun run typecheck` clean; full suite **1848 pass / 0 fail** (225 files), including the new `test/launch-code-slash.test.ts`, `test/launch-git-slash.test.ts`, and `test/session-model-isolation.test.ts`, plus expanded `test/launch-slash-views.test.ts` (`/history`) and `test/tui-welcome.test.ts` (banner width tracks cols across a resize).
+
+
 ## [0.7.3] - 2026-06-22
 _Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback._
 

package/README.ja.md

@@ -193,11 +193,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
 - **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -193,11 +193,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
 - **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -195,11 +195,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
 - **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -193,11 +193,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
 - **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 - **[0.7.0]** (2026-06-22) — Adds an opt-in, fail-closed **computer-use** capability (a `computer` tool + `jeo computer` CLI for screenshot/click/type/keypress/scroll/drag/wait/batch), hardens the spec-first workflow against silent post-consensus plan edits and PID-reuse lock starvation, makes OAuth refresh degrade cleanly when the refresh token is dead, and teaches tool-arg JSON repair to tolerate unescaped control characters. Verified leak-free (`mem-probe`, 2000 turns, −447 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.6.41]** (2026-06-21) — The non-streaming model path now inherits the v0.6.40 300s window: an unattended long-reasoning turn (compaction, ralplan, deep-interview, memory distill, goal-verify, subagent/autopilot steps) is no longer false-aborted at the old 120s wall cap. Re-verified leak-free (`mem-probe`, 2000 turns, −610 bytes/turn slope) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/commands/launch/code-slash.ts

@@ -0,0 +1,99 @@
+/**
+ * Read-only code-inspection slash handlers extracted from launch.ts.
+ *
+ * Each handler is a self-contained async function that takes the raw slash
+ * input plus the working directory (and, for `/diff`, the active theme) and
+ * returns the lines to print. They perform no closure-bound side effects, so
+ * the REPL dispatch just prints whatever lines come back — matching the
+ * `{ lines }` contract used by the other extracted slash handlers.
+ */
+
+import * as path from "node:path";
+import * as fs from "node:fs";
+import chalk from "chalk";
+import { findTool, searchTool } from "../../agent/tools";
+import {
+  detectLanguage,
+  languageLabel,
+  parseLineRange,
+  sliceLines,
+  formatCodeBlock,
+  formatDiff,
+} from "../../tui/components/code-view";
+import { categoryBadge } from "../../tui/components/category-index";
+import { size as terminalSize } from "../../tui/terminal";
+import type { EvolutionTheme } from "../../tui/components/themes";
+
+/** `/view <file> [start-end]` — render a file (optionally a line range) as a code block. */
+export async function handleViewSlash(input: string, cwd: string): Promise<string[]> {
+  const tokens = input.substring(5).trim().split(/\s+/).filter(Boolean);
+  const file = tokens[0];
+  if (!file) {
+    return ["Usage: /view <file> [start-end]   (e.g. /view src/cli.ts 1-40)"];
+  }
+  let content: string;
+  try {
+    content = await fs.promises.readFile(path.resolve(cwd, file), "utf-8");
+  } catch (err) {
+    return [`! cannot read ${file}: ${(err as Error).message}`];
+  }
+  const range = tokens[1] ? parseLineRange(tokens[1]) : undefined;
+  if (tokens[1] && !range) {
+    return [`Invalid range '${tokens[1]}'. Use start-end | start- | start.`];
+  }
+  const lang = detectLanguage(file);
+  const { lines, startLine } = sliceLines(content, range ?? undefined);
+  const { cols } = terminalSize();
+  const out: string[] = [
+    `${categoryBadge("file")} ${chalk.bold(`${file}`)}${chalk.gray(`  (${languageLabel(lang)}, lines ${startLine}-${startLine + lines.length - 1})`)}`,
+  ];
+  for (const line of formatCodeBlock(lines.join("\n"), { startLine, lang, cols: Math.max(40, cols - 1), maxLines: 200 })) {
+    out.push(line);
+  }
+  return out;
+}
+
+/** `/diff [path]` — render `git diff` (optionally pathspec-scoped) with theme coloring. */
+export async function handleDiffSlash(input: string, cwd: string, theme: EvolutionTheme): Promise<string[]> {
+  const target = input.substring(5).trim();
+  const proc = Bun.spawnSync(["git", "diff", ...(target ? ["--", target] : [])], { cwd, stdout: "pipe", stderr: "pipe" });
+  if (proc.exitCode !== 0 && !proc.stdout.length) {
+    return [`! git diff failed: ${proc.stderr.toString().trim() || "not a git repo?"}`];
+  }
+  const text = proc.stdout.toString();
+  if (!text.trim()) {
+    return ["(no unstaged changes)"];
+  }
+  const { cols } = terminalSize();
+  const out: string[] = [`${categoryBadge("diff")} git diff${target ? ` -- ${target}` : ""}`];
+  for (const line of formatDiff(text, { cols: Math.max(40, cols - 1), maxLines: 400, theme })) out.push(line);
+  return out;
+}
+
+/** `/find <glob>` — list files matching a glob via the shared findTool. */
+export async function handleFindSlash(input: string, cwd: string): Promise<string[]> {
+  const glob = input.substring(5).trim();
+  if (!glob) {
+    return ["Usage: /find <glob>   (e.g. /find src/**/*.ts)"];
+  }
+  const res = await findTool(glob, cwd);
+  return [
+    `${categoryBadge("search")} find files matching '${glob}':`,
+    res.success ? (res.output || "(no matches)") : `! ${res.error}`,
+  ];
+}
+
+/** `/search <pattern> [glob]` — grep the tree via the shared searchTool. */
+export async function handleSearchSlash(input: string, cwd: string): Promise<string[]> {
+  const tokens = input.substring(7).trim().split(/\s+/).filter(Boolean);
+  const pattern = tokens[0];
+  const glob = tokens[1] ?? "*";
+  if (!pattern) {
+    return ["Usage: /search <pattern> [glob]   (e.g. /search resolveProvider src/**/*.ts)"];
+  }
+  const res = await searchTool(pattern, glob, cwd);
+  return [
+    `${categoryBadge("search")} search pattern '${pattern}' in '${glob}':`,
+    res.success ? (res.output || "(no matches)") : `! ${res.error}`,
+  ];
+}

package/src/commands/launch/git-slash.ts

@@ -0,0 +1,30 @@
+// Self-contained git-backed REPL slash handlers. Each returns the exact line
+// array the inline handler used to `console.log`, so the git side effects and
+// their guard rails stay verifiable against a throwaway repo without driving the
+// whole launch REPL. State comes in explicitly (cwd) — no closure capture.
+
+/**
+ * `/undo` — revert the most recent commit, but ONLY when jeo made it (the
+ * `[jeo] auto-commit:` message prefix). Refuses to touch human commits or
+ * non-git trees. Performs the `git reset --hard HEAD~1` as a side effect and
+ * returns the status lines to print.
+ */
+export function handleUndoSlash(cwd: string): string[] {
+  try {
+    const logRes = Bun.spawnSync(["git", "log", "-1", "--pretty=%B"], { cwd, stdout: "pipe", stderr: "ignore" });
+    if (logRes.exitCode !== 0) {
+      return ["! undo failed: could not read git log (not a git repo?)"];
+    }
+    const msg = logRes.stdout.toString().trim();
+    if (!msg.startsWith("[jeo] auto-commit:")) {
+      return ["! the last commit was not made by jeo (no '[jeo] auto-commit:' prefix). Use git manually to revert."];
+    }
+    const resetRes = Bun.spawnSync(["git", "reset", "--hard", "HEAD~1"], { cwd, stdout: "pipe", stderr: "pipe" });
+    if (resetRes.exitCode === 0) {
+      return ["(undid the last jeo auto-commit and restored the working tree)"];
+    }
+    return [`! undo failed: ${resetRes.stderr.toString().trim()}`];
+  } catch (err) {
+    return [`! undo failed: ${(err as Error).message}`];
+  }
+}

package/src/commands/launch/slash-views.ts

@@ -3,6 +3,8 @@
 // they can be unit-tested without driving the whole launch REPL. They hold NO
 // mutable session state — every input is passed in explicitly.
 import type { Message } from "../../agent/loop";
+import { formatTranscript } from "../../tui/components/transcript";
+
 
 /** Static keyboard-shortcut reference for `/hotkeys` (no inputs, no state). */
 export function hotkeysLines(): string[] {
@@ -51,3 +53,21 @@ export function contextUsageLines(
   lines.push("  Free context with /compact or /clear.");
   return lines;
 }
+
+/** Re-print the worked history into scrollback for `/history [N|all]`. Pure over
+ *  the in-memory transcript plus the terminal width, so the banner/separator math
+ *  and turn-count parsing are verifiable without driving the REPL.
+ *  `arg` is the raw text after `/history` (e.g. " 10", " all", ""). */
+export function historyViewLines(history: Message[], arg: string, columns: number | undefined): string[] {
+  const a = arg.trim().toLowerCase();
+  const maxTurns = a === "all" ? undefined : Math.max(1, Number.parseInt(a, 10) || 5);
+  const sep = "─".repeat(Math.min(48, Math.max(20, (columns ?? 80) - 1)));
+  return [
+    sep,
+    `history · last ${maxTurns ?? "all"} turn(s) (/history all for everything)`,
+    sep,
+    ...formatTranscript(history, { maxTurns, color: true, unicode: true }),
+    sep,
+  ];
+}
+

package/src/commands/launch.ts

@@ -60,7 +60,8 @@ import {
 import { liveModelPicker, renderLiveModelPicker, type ModelAssignmentBadge } from "../tui/components/live-model-picker";
 
 import { loginPicker, renderLoginPicker, onboardingPicker, renderOnboardingPicker, apiKeyPicker, renderApiKeyPicker, subscriptionLoginPicker, type OnboardingAction } from "../tui/components/provider-picker";
-import { detectLanguage, languageLabel, parseLineRange, sliceLines, formatCodeBlock, formatDiff, sanitizeForTerminal } from "../tui/components/code-view";
+import { sanitizeForTerminal } from "../tui/components/code-view";
+
 import { categoryBadge } from "../tui/components/category-index";
 import { renderInputFrame, type HighlightRange } from "../tui/components/input-box";
 
@@ -78,7 +79,8 @@ import { stripMarkdown } from "../tui/components/markdown-text";
 import { summarizeForgeInvocation } from "../tui/components/forge";
 import { formatDuration, formatUsage } from "../tui/components/duration";
 
-import { findTool, searchTool, bashTool } from "../agent/tools";
+import { bashTool } from "../agent/tools";
+
 import { loadProjectContext, withProjectContext } from "../agent/context-files";
 import { maybeCompact, historyTokens } from "../agent/compaction";
 import * as path from "node:path";
@@ -167,7 +169,9 @@ import {
 import {
   hotkeysLines,
   contextUsageLines,
+  historyViewLines,
 } from "./launch/slash-views";
+
 import {
   handleUsage,
   handleTools,
@@ -175,6 +179,15 @@ import {
   handleContext,
   type SlashContext,
 } from "./launch/slash-handlers";
+import {
+  handleViewSlash,
+  handleDiffSlash,
+  handleFindSlash,
+  handleSearchSlash,
+} from "./launch/code-slash";
+import { handleUndoSlash } from "./launch/git-slash";
+
+
 
 export {
   type LaunchFlags,
@@ -692,7 +705,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     opts?: { userCard?: string | null },
   ): Promise<{ done: boolean; steps: number; reply: string; rendered: boolean; usage: string }> => {
     const turnConfig = await readGlobalConfig();
-    const activeModel = sessionModel || turnConfig.defaultModel;
+    // Fall back to the model resolved at THIS session's start (frozen snapshot), NOT
+    // the live global default. A concurrent `jeo` session running `/model` persists the
+    // global default (rememberModelPatch), so re-reading turnConfig.defaultModel here let
+    // that write silently switch THIS running session's model mid-run. Per-session model
+    // selection must stay session-local: running sessions never influence each other.
+    const activeModel = sessionModel || defaultModel;
     const contextTokens = catalogMetadata(activeModel)?.contextTokens;
 
     // Resolve provider + dirty count up front — both are cheap and feed the live
@@ -730,7 +748,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         tui.start();
       }
       const compRes = await maybeCompact(history, {
-        model: sessionModel,
+        model: activeModel,
         contextTokens,
       });
       if (compRes.error) {
@@ -896,7 +914,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             }
 
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
-            const verdict = await verifyGoal(goalState.condition, history, sessionModel);
+            const verdict = await verifyGoal(goalState.condition, history, activeModel);
 
             goalState.verdicts.push({
               at: Date.now(),
@@ -938,7 +956,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         const opik = createOpikTracer({
           name: userInput.trim().slice(0, 80) || "jeo turn",
           input: userInput,
-          metadata: { model: sessionModel, cwd },
+          metadata: { model: activeModel, cwd },
           tags: ["jeo", "launch"],
         });
         opik.startTurn();
@@ -946,7 +964,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           cwd,
           tools,
           maxSteps: flags.maxSteps,
-          model: sessionModel,
+          model: activeModel,
           maxTokens: sessionThinking ? thinkingMaxTokens(sessionThinking) : undefined,
           reasoningEffort: sessionThinking ? thinkingToReasoningEffort(sessionThinking) : undefined,
           signal: ac.signal,
@@ -965,7 +983,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             tools,
             maxSteps: Math.min(6, flags.maxSteps > 0 ? flags.maxSteps : 6),
             budget: { maxExtensions: 0 },
-            model: sessionModel,
+            model: activeModel,
             maxTokens: sessionThinking ? thinkingMaxTokens(sessionThinking) : undefined,
             reasoningEffort: sessionThinking ? thinkingToReasoningEffort(sessionThinking) : undefined,
             signal: ac.signal,
@@ -1225,6 +1243,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     accent: accentPaint(welcomeTheme),
     accentShadow: accentShadowPaint(welcomeTheme),
   };
+  // welcomeData.cols is a launch-time snapshot; re-measure on every banner re-render
+  // (/clear, /resume) so the box fits the resized terminal instead of the old width.
+  const freshWelcomeLines = (): string[] =>
+    renderWelcome({ ...welcomeData, cols: terminalSize().cols });
   // gjc-style fresh-start clear so the banner opens atop a clean screen. TTY only,
   // never mid-turn (scrollback flood). ponytail: add an opt-out env if anyone misses their scrollback.
   if (process.stdout.isTTY) process.stdout.write(clearScreen());
@@ -2999,16 +3021,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         if (process.stdout.isTTY) {
           disarmPreview();
           process.stdout.write(clearScreen()); // clear screen + scrollback + cursor home
-          console.log(renderWelcome(welcomeData).join("\n"));
+          console.log(freshWelcomeLines().join("\n"));
         }
         console.log("(history cleared — back to the start screen)");
         continue;
       }
       if (input === "/compact") {
-        const turnConfig = await readGlobalConfig();
-        const activeModel = sessionModel || turnConfig.defaultModel;
+        // Session-start default snapshot (not the live global default) — keeps a
+        // concurrent session's `/model` write from changing this session's context budget.
+        const activeModel = sessionModel || defaultModel;
         const contextTokens = catalogMetadata(activeModel)?.contextTokens;
-        const res = await maybeCompact(history, { model: sessionModel, force: true, contextTokens });
+        const res = await maybeCompact(history, { model: activeModel, force: true, contextTokens });
         if (res.error) {
           console.error(chalk.red(res.error));
         } else if (res.compacted && sessionId && res.replacesThrough !== undefined) {
@@ -3106,7 +3129,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
               if (process.stdout.isTTY) {
                 disarmPreview();
                 process.stdout.write(clearScreen());
-                console.log(renderWelcome(welcomeData).join("\n"));
+                console.log(freshWelcomeLines().join("\n"));
               }
               const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
               logLines([
@@ -3267,13 +3290,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       if (input === "/history" || input.startsWith("/history ")) {
         // Re-print the worked history into scrollback (tmux-friendly review of
         // past prompts / tool steps / replies without terminal scrollback access).
-        const arg = input.slice("/history".length).trim().toLowerCase();
-        const maxTurns = arg === "all" ? undefined : Math.max(1, Number.parseInt(arg, 10) || 5);
-        const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
-        logLines([sep, `history · last ${maxTurns ?? "all"} turn(s) (/history all for everything)`, sep,
-          ...formatTranscript(history, { maxTurns, color: true, unicode: true }), sep]);
+        logLines(historyViewLines(history, input.slice("/history".length), process.stdout.columns));
         continue;
       }
+
       if (input === "/export" || input.startsWith("/export ")) {
         if (!sessionId) {
           console.log("(sessions are disabled — nothing to export)");
@@ -3335,7 +3355,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           process.stdout.write("btw> ");
           let streamed = "";
           const answer = await callLlm(side, {
-            model: sessionModel,
+            model: sessionModel || defaultModel,
             maxTokens: thinkingMaxTokens("low"),
             onToken: delta => {
               streamed += delta;
@@ -3350,28 +3370,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         continue;
       }
       if (input === "/undo") {
-        try {
-          const logRes = Bun.spawnSync(["git", "log", "-1", "--pretty=%B"], { cwd, stdout: "pipe", stderr: "ignore" });
-          if (logRes.exitCode === 0) {
-            const msg = logRes.stdout.toString().trim();
-            if (msg.startsWith("[jeo] auto-commit:")) {
-              const resetRes = Bun.spawnSync(["git", "reset", "--hard", "HEAD~1"], { cwd, stdout: "pipe", stderr: "pipe" });
-              if (resetRes.exitCode === 0) {
-                console.log("(undid the last jeo auto-commit and restored the working tree)");
-              } else {
-                console.log(`! undo failed: ${resetRes.stderr.toString().trim()}`);
-              }
-            } else {
-              console.log("! the last commit was not made by jeo (no '[jeo] auto-commit:' prefix). Use git manually to revert.");
-            }
-          } else {
-            console.log("! undo failed: could not read git log (not a git repo?)");
-          }
-        } catch (err) {
-          console.log(`! undo failed: ${(err as Error).message}`);
-        }
+        logLines(handleUndoSlash(cwd));
+
         continue;
       }
+
       if (input === "/goal" || input.startsWith("/goal ")) {
         const arg = input.substring(5).trim();
         if (!arg) {
@@ -4227,75 +4230,23 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         continue;
       }
       if (input.startsWith("/view") && (input === "/view" || input[5] === " ")) {
-        const tokens = input.substring(5).trim().split(/\s+/).filter(Boolean);
-        const file = tokens[0];
-        if (!file) {
-          console.log("Usage: /view <file> [start-end]   (e.g. /view src/cli.ts 1-40)");
-          continue;
-        }
-        let content: string;
-        try {
-          content = await fs.promises.readFile(path.resolve(cwd, file), "utf-8");
-        } catch (err) {
-          console.log(`! cannot read ${file}: ${(err as Error).message}`);
-          continue;
-        }
-        const range = tokens[1] ? parseLineRange(tokens[1]) : undefined;
-        if (tokens[1] && !range) {
-          console.log(`Invalid range '${tokens[1]}'. Use start-end | start- | start.`);
-          continue;
-        }
-        const lang = detectLanguage(file);
-        const { lines, startLine } = sliceLines(content, range ?? undefined);
-        const { cols } = await import("../tui/terminal").then(m => m.size());
-        console.log(`${categoryBadge("file")} ${chalk.bold(`${file}`)}${chalk.gray(`  (${languageLabel(lang)}, lines ${startLine}-${startLine + lines.length - 1})`)}`);
-        for (const line of formatCodeBlock(lines.join("\n"), { startLine, lang, cols: Math.max(40, cols - 1), maxLines: 200 })) {
-          console.log(line);
-        }
+        for (const line of await handleViewSlash(input, cwd)) console.log(line);
         continue;
       }
       if (input.startsWith("/diff") && (input === "/diff" || input[5] === " ")) {
-        const target = input.substring(5).trim();
-        const proc = Bun.spawnSync(["git", "diff", ...(target ? ["--", target] : [])], { cwd, stdout: "pipe", stderr: "pipe" });
-        if (proc.exitCode !== 0 && !proc.stdout.length) {
-          console.log(`! git diff failed: ${proc.stderr.toString().trim() || "not a git repo?"}`);
-          continue;
-        }
-        const text = proc.stdout.toString();
-        if (!text.trim()) {
-          console.log("(no unstaged changes)");
-          continue;
-        }
-        const { cols } = await import("../tui/terminal").then(m => m.size());
-        console.log(`${categoryBadge("diff")} git diff${target ? ` -- ${target}` : ""}`);
-        for (const line of formatDiff(text, { cols: Math.max(40, cols - 1), maxLines: 400, theme: uiTheme })) console.log(line);
+        for (const line of await handleDiffSlash(input, cwd, uiTheme)) console.log(line);
         continue;
       }
       if (input.startsWith("/find") && (input === "/find" || input[5] === " ")) {
-        const glob = input.substring(5).trim();
-        if (!glob) {
-          console.log("Usage: /find <glob>   (e.g. /find src/**/*.ts)");
-          continue;
-        }
-        console.log(`${categoryBadge("search")} find files matching '${glob}':`);
-        const res = await findTool(glob, cwd);
-        console.log(res.success ? (res.output || "(no matches)") : `! ${res.error}`);
+        for (const line of await handleFindSlash(input, cwd)) console.log(line);
         continue;
       }
       if (input.startsWith("/search") && (input === "/search" || input[7] === " ")) {
-        const tokens = input.substring(7).trim().split(/\s+/).filter(Boolean);
-        const pattern = tokens[0];
-        const glob = tokens[1] ?? "*";
-        if (!pattern) {
-          console.log("Usage: /search <pattern> [glob]   (e.g. /search resolveProvider src/**/*.ts)");
-          continue;
-        }
-        console.log(`${categoryBadge("search")} search pattern '${pattern}' in '${glob}':`);
-        const res = await searchTool(pattern, glob, cwd);
-        console.log(res.success ? (res.output || "(no matches)") : `! ${res.error}`);
+        for (const line of await handleSearchSlash(input, cwd)) console.log(line);
         continue;
       }
 
+
       const skillEntrypoint = input.startsWith("/skill:") ? "/skill:" : input.startsWith("/skill") && (input === "/skill" || input[6] === " ") ? "/skill" : "";
       if (skillEntrypoint) {
         if (flags.noSkills) {