jeo-code 0.7.41 → 0.7.42

package/CHANGELOG.md

@@ -6,6 +6,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.42] - 2026-07-06
+_Fixes a genuine infinite hang on "thinking"/"executing" (reported under `jeo --tmux`, but the two root causes are tmux-agnostic): the interactive streaming model call had no absolute wall-clock, and the ~30-minute turn stall budget was a passive check that could never interrupt a blocked await in the first place. A third, lower-confidence but plausible tmux-specific trigger (synchronous TUI frame writes blocking on a backpressured tmux pane) gets a defensive, generic fix too._
+
+### Fixed
+- **The interactive streaming model call had no absolute wall-clock — a connected-but-never-terminating stream hung "thinking" forever.** Unlike `manager.call()`/the non-stream fallback (both wrapped in a hard ~300s `withTimeout`), `manager.stream()` (`src/ai/model-manager.ts`) only armed its overall deadline when `JEO_STREAM_MAX_MS` was explicitly set — off by default — and its idle watchdog re-arms on ANY wire activity, including SSE keepalive/ping bytes and reasoning deltas. A stream that stays connected and periodically emits *something* (provider/proxy keepalives, an endless-reasoning response, a proxy that never forwards the terminal stop event) could re-arm that watchdog forever and never resolve or reject. `streamMaxMs()` now defaults to the same ~300s ceiling `callTimeoutMs()` already uses when `JEO_STREAM_MAX_MS` is unset, giving the streaming path parity with the non-streaming path; explicit overrides (including `0` to disable, for genuinely long-running reasoning use cases) are unchanged.
+- **The `JEO_TURN_MAX_MS` stall budget could never interrupt a hang inside a single blocked model call — the exact scenario it exists to catch.** It was implemented purely as a passive top-of-loop check (`Date.now() - lastProgressAt > turnBudgetMs`); with no armed timer anywhere in `engine.ts`, the check could only run *between* steps — a hang blocked inside one `await` on the model call (e.g. the non-terminating stream above) meant the loop never re-iterated and the budget never fired, even after 30+ minutes. `runAgentLoop` now arms a real `setTimeout` for the remaining budget immediately before each step's model call, aborting a dedicated controller (composed with the turn's existing external signal) when it fires; the timer is cleared and re-armed on every genuine progress reset (executed tool step, mid-turn steering) so a legitimately long multi-step turn is never prematurely cut off, and an internal stall-abort surfaces through the exact same error path as an external Esc/Ctrl-C cancel.
+- **(Defensive, tmux-specific) Live TUI frame writes are now backpressure-aware.** `LaunchTui`'s ~120ms frame tick wrote directly to `process.stdout` every beat; under `--tmux`, `process.stdout` is the tmux pane pty drained by the tmux *server*, and POSIX TTY writes are synchronous — a backpressured/slow-draining tmux client could block the write and freeze the event loop entirely (spinner, timers, and the stall-budget check all stop simultaneously, on whatever phase — "thinking" or "executing" — was current). The frame tick now checks `write()`'s boolean return value and skips scheduled frames while backpressured, resuming automatically on the stream's `'drain'` event, instead of piling up or blocking on synchronous writes. No tmux-detection branching — this is a generic backpressure-safe write pattern that helps regardless of what's on the other end of stdout.
+
+### Verified
+- `bun run typecheck` clean; full suite green.
+- New/updated coverage: `test/round-b.test.ts` (`streamMaxMs()` default/override/disable contract, plus a keepalive-forever stream aborted once the deadline elapses), `test/cycle-and-turn-budget.test.ts` (a never-resolving model call force-aborted once the remaining stall budget elapses, and a regression guard that a normal long multi-step turn is never prematurely aborted), `test/tui-app.test.ts` (the frame tick skips beats under simulated backpressure and resumes on `'drain'`).
+
 ## [0.7.41] - 2026-07-06
 _Refusal-handling workflow audit (follow-up to 0.7.39): fixes a HIGH-severity, long-masked bug where Gemini's real refusal error shape never matched jeo's refusal detector, plus Antigravity's opaque empty-response error, plus a category-aware fail-fast for deterministic ToS-severity refusals that previously spun the full 30-minute stall budget with zero chance of success._
 

package/README.ja.md

@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.42]** (2026-07-06) — Fixes a genuine infinite hang on "thinking"/"executing" (reported under `jeo --tmux`, but the two root causes are tmux-agnostic): the interactive streaming model call had no absolute wall-clock, and the ~30-minute turn stall budget was a passive check that could never interrupt a blocked await in the first place. A third, lower-confidence but plausible tmux-specific trigger (synchronous TUI frame writes blocking on a backpressured tmux pane) gets a defensive, generic fix too.
 - **[0.7.41]** (2026-07-06) — Refusal-handling workflow audit (follow-up to 0.7.39): fixes a HIGH-severity, long-masked bug where Gemini's real refusal error shape never matched jeo's refusal detector, plus Antigravity's opaque empty-response error, plus a category-aware fail-fast for deterministic ToS-severity refusals that previously spun the full 30-minute stall budget with zero chance of success.
 - **[0.7.40]** (2026-07-06) — Fixes the release CI's standalone-binary build, broken since before v0.7.31 (last release where that job actually ran and passed) — the `release-binaries` job on v0.7.38 and v0.7.39 both failed silently on every platform target, so neither release has downloadable binaries attached.
 - **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
 - **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
-- **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -259,11 +259,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.42]** (2026-07-06) — Fixes a genuine infinite hang on "thinking"/"executing" (reported under `jeo --tmux`, but the two root causes are tmux-agnostic): the interactive streaming model call had no absolute wall-clock, and the ~30-minute turn stall budget was a passive check that could never interrupt a blocked await in the first place. A third, lower-confidence but plausible tmux-specific trigger (synchronous TUI frame writes blocking on a backpressured tmux pane) gets a defensive, generic fix too.
 - **[0.7.41]** (2026-07-06) — Refusal-handling workflow audit (follow-up to 0.7.39): fixes a HIGH-severity, long-masked bug where Gemini's real refusal error shape never matched jeo's refusal detector, plus Antigravity's opaque empty-response error, plus a category-aware fail-fast for deterministic ToS-severity refusals that previously spun the full 30-minute stall budget with zero chance of success.
 - **[0.7.40]** (2026-07-06) — Fixes the release CI's standalone-binary build, broken since before v0.7.31 (last release where that job actually ran and passed) — the `release-binaries` job on v0.7.38 and v0.7.39 both failed silently on every platform target, so neither release has downloadable binaries attached.
 - **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
 - **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
-- **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -261,11 +261,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.42]** (2026-07-06) — Fixes a genuine infinite hang on "thinking"/"executing" (reported under `jeo --tmux`, but the two root causes are tmux-agnostic): the interactive streaming model call had no absolute wall-clock, and the ~30-minute turn stall budget was a passive check that could never interrupt a blocked await in the first place. A third, lower-confidence but plausible tmux-specific trigger (synchronous TUI frame writes blocking on a backpressured tmux pane) gets a defensive, generic fix too.
 - **[0.7.41]** (2026-07-06) — Refusal-handling workflow audit (follow-up to 0.7.39): fixes a HIGH-severity, long-masked bug where Gemini's real refusal error shape never matched jeo's refusal detector, plus Antigravity's opaque empty-response error, plus a category-aware fail-fast for deterministic ToS-severity refusals that previously spun the full 30-minute stall budget with zero chance of success.
 - **[0.7.40]** (2026-07-06) — Fixes the release CI's standalone-binary build, broken since before v0.7.31 (last release where that job actually ran and passed) — the `release-binaries` job on v0.7.38 and v0.7.39 both failed silently on every platform target, so neither release has downloadable binaries attached.
 - **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
 - **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
-- **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.42]** (2026-07-06) — Fixes a genuine infinite hang on "thinking"/"executing" (reported under `jeo --tmux`, but the two root causes are tmux-agnostic): the interactive streaming model call had no absolute wall-clock, and the ~30-minute turn stall budget was a passive check that could never interrupt a blocked await in the first place. A third, lower-confidence but plausible tmux-specific trigger (synchronous TUI frame writes blocking on a backpressured tmux pane) gets a defensive, generic fix too.
 - **[0.7.41]** (2026-07-06) — Refusal-handling workflow audit (follow-up to 0.7.39): fixes a HIGH-severity, long-masked bug where Gemini's real refusal error shape never matched jeo's refusal detector, plus Antigravity's opaque empty-response error, plus a category-aware fail-fast for deterministic ToS-severity refusals that previously spun the full 30-minute stall budget with zero chance of success.
 - **[0.7.40]** (2026-07-06) — Fixes the release CI's standalone-binary build, broken since before v0.7.31 (last release where that job actually ran and passed) — the `release-binaries` job on v0.7.38 and v0.7.39 both failed silently on every platform target, so neither release has downloadable binaries attached.
 - **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
 - **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
-- **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.41",
+  "version": "0.7.42",
 
 
   "description": "Clean, highly optimized AI coding agent using spec-first loop",

package/src/agent/engine.ts

@@ -330,6 +330,18 @@ export function turnMaxMs(env: Record<string, string | undefined> = process.env)
   }
   return 30 * 60 * 1000;
 }
+/** Minimum delay (ms) before a re-armed stall-interrupt timer may fire — guards against
+ *  a near-zero remaining budget scheduling a same-tick abort that would race the call
+ *  it is meant to protect. */
+const MIN_STALL_ARM_MS = 1_000;
+
+/** Combine the turn's external cancel signal (Esc/Ctrl-C) with an internal one. Mirrors
+ *  the composeAbort/boundedSignal pattern already used in src/ai/model-manager.ts and
+ *  src/auth/flows/google-project.ts — kept local since neither is exported. */
+function composeAbortSignal(outer: AbortSignal | undefined, inner: AbortSignal): AbortSignal {
+  if (!outer) return inner;
+  return typeof AbortSignal.any === "function" ? AbortSignal.any([outer, inner]) : inner;
+}
 
 
 /** Levenshtein distance (small inputs: tool/command names). */
@@ -408,6 +420,26 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   const turnBudgetMs = turnMaxMs();
   // Reset on every executed tool step and on mid-turn steering.
   let lastProgressAt = turnStartedAt;
+  // Real timer-based interrupt backing the passive check above: JEO_TURN_MAX_MS alone
+  // only re-evaluates at the TOP of the while loop, so it cannot fire while the loop is
+  // parked inside a single blocked model-call await (the exact "genuinely forever" hang
+  // this guards against — a stream that never resolves/rejects). Armed fresh before each
+  // model call for the REMAINING budget and disarmed as soon as that call settles, so it
+  // naturally re-arms on every lastProgressAt reset and never fires after the turn ends.
+  let stallTimer: ReturnType<typeof setTimeout> | undefined;
+  const armStallAbort = (): AbortSignal | undefined => {
+    if (turnBudgetMs <= 0) return opts.signal; // 0 disables the stall budget entirely
+    const ctrl = new AbortController();
+    const remaining = Math.max(MIN_STALL_ARM_MS, turnBudgetMs - (Date.now() - lastProgressAt));
+    stallTimer = setTimeout(() => {
+      ctrl.abort(new Error(`no tool progress for ${Math.round(turnBudgetMs / 60_000)}m — turn stall budget (JEO_TURN_MAX_MS) exceeded without done`));
+    }, remaining);
+    return composeAbortSignal(opts.signal, ctrl.signal);
+  };
+  const disarmStallAbort = () => {
+    if (stallTimer) clearTimeout(stallTimer);
+    stallTimer = undefined;
+  };
   // "steps" | "time" — drives honest wording in the consolidation message.
   let stopKind: "steps" | "time" = "steps";
   let step = 1;
@@ -624,6 +656,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       ev.onReasoningArtifactStream?.(a);
     };
     let responseText: string;
+    const stepSignal = armStallAbort();
     try {
       responseText = await invokeCallLlm(history, {
               jsonMode: true,
@@ -636,7 +669,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
               model: opts.model,
               maxTokens: opts.maxTokens,
               reasoningEffort: opts.reasoningEffort,
-              signal: opts.signal,
+              signal: stepSignal,
               sessionKey: opts.sessionKey,
               onUsage: u => { acc.inputTokens += u.inputTokens ?? 0; acc.outputTokens += u.outputTokens ?? 0; sawUsage = true; },
               onToken,
@@ -652,7 +685,9 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
                 ev.onNotice?.(`${what} — auto-retry #${attempt} in ${wait}s`);
               },
             });
+      disarmStallAbort(); // call settled successfully — the stall interrupt no longer applies
     } catch (err) {
+      disarmStallAbort(); // clear before classifying: a fired stall-abort must not linger past this call
       // Reactive context recovery: trim older tool results in place and retry the
       // SAME step once. The provider's overflow signal beats the local estimate;
       // a second overflow (or nothing left to trim) surfaces the friendly error.

package/src/ai/model-manager.ts

@@ -576,11 +576,20 @@ async function nextMaybeIdle(iter: AsyncIterator<string>, watchdog?: Promise<nev
   return Promise.race([iter.next(), watchdog]);
 }
 
-/** Opt-in overall stream wall-clock from the environment; undefined = off (default). */
+/** Overall stream wall-clock from the environment. Defaults to the same hard bound as
+ *  callTimeoutMs() (DEFAULT_CALL_TIMEOUT_MS) so the streaming path has parity with the
+ *  non-streaming call()/fallback path — a stream that stays connected and keeps emitting
+ *  SOMETHING (SSE keepalives, reasoning deltas) re-arms the per-chunk idle watchdog
+ *  forever and would otherwise never resolve or reject. JEO_STREAM_MAX_MS explicitly set
+ *  to a positive number overrides the default; explicitly set to 0 disables the overall
+ *  deadline entirely (mirrors JEO_TURN_MAX_MS's own 0-disables convention) for advanced
+ *  users with genuinely long-running legitimate reasoning models. */
 export function streamMaxMs(env?: Record<string, string | undefined>): number | undefined {
   const raw = jeoEnv("STREAM_MAX_MS", env);
-  const n = raw !== undefined ? parseInt(raw, 10) : NaN;
-  return Number.isFinite(n) && n > 0 ? n : undefined;
+  if (raw === undefined || raw === "") return DEFAULT_CALL_TIMEOUT_MS;
+  const n = parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < 0) return DEFAULT_CALL_TIMEOUT_MS;
+  return n === 0 ? undefined : n;
 }
 
 /** Per-chunk idle cap (ms) from the environment, falling back to the built-in default.

package/src/tui/app.ts

@@ -54,7 +54,7 @@ export interface LaunchTuiOptions {
   /** Resolved provider name for the footer (anthropic / openai / gemini / ollama). */
   provider?: string;
   sessionId?: string;
-  write?: (s: string) => void;
+  write?: (s: string) => void | boolean;
   /** Step budget for this turn; drives the footer's `step N/M` denominator. */
   maxSteps?: number;
   /** Whether to treat the output as a TTY (drives alt-screen use). Defaults to isTTY(). */
@@ -213,6 +213,13 @@ export class LaunchTui {
   private mutationGuarded = false;
   private finished = false;
   private timer: ReturnType<typeof setInterval> | undefined;
+  // Backpressure-aware live frame emission: process.stdout.write() returns false when the
+  // internal buffer is over the high-water mark (e.g. a tmux client draining slowly, or
+  // any slow consumer on the other end of stdout). Skipping scheduled frames while this is
+  // true — instead of piling up an unbounded queue of synchronous writes or blocking the
+  // event loop waiting on 'drain' — keeps the render loop responsive and non-blocking.
+  // Generic and tmux-agnostic: helps regardless of what's downstream of stdout.
+  private stdoutBackpressured = false;
   // Resize handling (gjc-style responsiveness): repaint IMMEDIATELY on the first event
   // so a deliberate resize never lags, then cap follow-ups to ~30fps so a drag-resize
   // tracks the cursor live (instead of staying stale until the drag pauses — the lag a
@@ -345,7 +352,19 @@ export class LaunchTui {
   private readonly thinkingLevel?: string;
 
   constructor(opts: LaunchTuiOptions) {
-    this.write = opts.write ?? ((s: string) => process.stdout.write(s));
+    // Backpressure-aware wrapper around the underlying writer (real stdout, or the
+    // caller-injected `write` used by tests). An explicit `false` return (Node/Bun stream
+    // convention: internal buffer over the high-water mark) arms the flag the live-frame
+    // interval checks; a real 'drain' event (asynchronous — never awaited here) clears it.
+    // A test double returning `undefined` (the existing convention throughout this file's
+    // tests) never trips the check, so non-backpressure-aware callers are unaffected.
+    const rawWrite = opts.write ?? ((s: string) => process.stdout.write(s));
+    this.write = (s: string) => {
+      if (rawWrite(s) === false && !this.stdoutBackpressured) {
+        this.stdoutBackpressured = true;
+        process.stdout.once("drain", () => { this.stdoutBackpressured = false; });
+      }
+    };
     this.tty = opts.tty ?? isTTY();
     this.inline = this.tty && jeoEnv("TUI_ALT_SCREEN") !== "1";
     // Row reservation is only needed (and only safe) for the inline main-buffer frame;
@@ -1040,6 +1059,11 @@ export class LaunchTui {
     this.timer = setInterval(() => {
       try {
         this.tickCount++;
+        // Backpressure: skip this scheduled frame entirely rather than piling up writes
+        // or blocking on 'drain' — the tick simply resumes once the writer drains (see
+        // the this.write wrapper above). The spinner/tickCount stay static for the
+        // skipped beat(s), matching the frozen frame this defers presenting.
+        if (this.stdoutBackpressured) return;
         // Self-healing resync: every ~3s drop the differential baseline so the next
         // draw rewrites EVERY line. Any screen corruption (stray child output, wheel
         // noise, terminal glitches) is repaired automatically without user action.