jeo-code 0.7.51 → 0.7.52

package/CHANGELOG.md

@@ -6,6 +6,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.52] - 2026-07-06
+_Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code._
+
+### Added
+- **Persistent routed-tier marker in the status bar** (`src/tui/components/status.ts`'s `StatusBarData.routedTier`/`renderStatusBar`, threaded through `LaunchTuiOptions`/`LaunchTui` in `src/tui/app.ts` and `src/commands/launch.ts`'s `runTurn`) — when PromptRouter picks THIS turn's model, a `⚡tier` marker (`~tier` in ASCII mode) renders right after the model name in the always-visible model bar, e.g. `claude-haiku-4-5 ⚡trivial`. Unlike the existing `[route] …` console notice (which intentionally stays silent for routine tier resolutions and only fires for interesting/escalated cases), the status-bar marker is unconditional whenever routing actually chose the model this turn — omitted when routing is off, the model is pinned, or the v0.7.51 credential-readiness gate vetoed the routed decision back to the default.
+- **Subagent thinking visibility** (`TaskSubEvent`'s new `"thinking"` kind in `src/agent/task-tool.ts`, wired through `runSubagentOnce`'s `onReasoningStream` callback and handled in `LaunchTui.onSubagentEvent`) — a delegated subagent's own native extended-thinking stream now surfaces as a live, per-slot preview in the TUI (mirrors the main turn's dimmed "Thinking" block, scoped to that subagent's row instead of a single shared region), tail-sliced and whitespace-collapsed the same way tool/step previews already are. Transient only: never persisted to the ledger/scrollback (matches how the main turn's live reasoning preview also never appears in the final record), and the non-TTY streaming log (`formatTaskSubEvent` in `src/commands/launch/stream.ts`) explicitly no-ops on `"thinking"` instead of falling through to a bogus `"ROLE done: <reasoning text>"` line.
+
+### Fixed
+- **`retry.failFastStatuses`/`retry.failFastPatterns` silently stripped from every saved config** (`src/agent/config-schema.ts`) — both fields existed on `Config.retry` (`state.ts`) and were actively read by `src/ai/model-manager.ts` to decide non-retryable errors, but were never declared on the NESTED `retry` `z.object`. Only the outer `ConfigSchema` calls `.passthrough()`; Zod's default strip-unknown-keys behavior silently dropped both fields on every config read/write that round-tripped through `parseConfig`, even though `config.json` faithfully stored them on disk — a user-configured fail-fast rule would quietly stop applying the moment anything else touched the config file. Fixed by declaring both fields on the nested object directly.
+- **Ponytail-mode dead-code sweep** (six files, five independent findings, all confirmed zero-call-site via `grep` before deletion): `src/agent/output-util.ts` lost `TOOL_SPILL_THRESHOLD`, `truncateToolOutput`, `spillToolResult`, and `logPerformanceMetric` (the last of these means `.jeo/state/performance-metrics.json` is never actually written by anything in this codebase — `PerfMetric`'s read-side in `dev/self-analysis.ts` is kept as the interface contract, but the writer was dead weight, not a working feature); `src/agent/ts-language-service.ts` lost `resetLanguageServiceCache` (no caller); `src/agent/task-tool.ts` lost the `@deprecated` `TASK_TOOL_PROTOCOL_LINE` static snapshot (superseded by `taskToolProtocolLine(config)`); `src/agent/step-budget.ts` simplified a no-op `key.replace(/^JEO_/, "JEO_")` (replacing a prefix with itself) in both `envNum` and `envSet` to a plain lookup; `src/agent/opik-tracer.ts` removed a `try/finally` around `onStep` whose `finally` block was an empty comment with no actual cleanup; `src/ai/model-manager.ts`'s `composeAbort` dropped an unreachable manual-polyfill branch for `AbortSignal.any` (native since Bun 1.1.13; `src/cli.ts` hard-enforces `engines.bun: ">=1.3.14"` at process start), cutting it from 17 lines to 2 with identical behavior for every real input.
+
+### Verified
+- `bun run typecheck` clean; `bun test` 2660 pass / 0 fail across 280 files on first run; a second full run reproduced 1 pre-existing flake (`test/hooks.test.ts`'s "disabled hooks never run", isolated-run-clean 3/3 — a cross-file `process.env.JEO_CONFIG_DIR` race under full-suite concurrency, not a regression from any change in this release).
+- `test/status-bar.test.ts` (+4 tests): `routedTier` renders the `⚡` marker right after the model and before thinking; omitted entirely when routing didn't engage; ASCII fallback uses `~`; all three tier values (`trivial`/`standard`/`complex`) render verbatim.
+- `test/tui-app.test.ts` (+3): `LaunchTui` threads `routedTier` into the persistent inline model bar and omits it when unset; `onSubagentEvent` with kind `"thinking"` drives the live per-slot preview but is never captured in the final scrollback record.
+- `test/task-tool.test.ts` (+2): a subagent whose mocked `callLlm` invokes `onReasoning` emits live `"thinking"` events tagged to its own slot/index; a subagent with no reasoning stream emits zero `"thinking"` events (no false positives).
+- `test/config-schema.test.ts` (+2, regression-focused): `retry.failFastStatuses`/`failFastPatterns` now survive `parseConfig` round-trip; a non-integer entry in `failFastStatuses` is rejected. The bug was confirmed empirically (bypassing the fix, both fields stripped silently) before applying it.
+- Every dead-code deletion re-verified zero call sites via `grep` across `src/` and `test/` immediately before removal; the env-signal-composition simplifications (`composeAbort`, `envNum`/`envSet`) are exercised indirectly through existing abort-signal tests (`test/engine.test.ts`, `test/retry.test.ts`, `test/transient-network-recovery.test.ts`) and env-override tests (`test/step-budget.test.ts`), all passing unchanged — proving each simplification is behavior-preserving, not just "looks safe."
+
 ## [0.7.51] - 2026-07-06
 _Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole._
 

package/README.ja.md

@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 - **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
 - **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 - **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
 - **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -262,11 +262,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 - **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
 - **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
 - **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
 - **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.51",
+  "version": "0.7.52",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -140,6 +140,18 @@ export const ConfigSchema = z
         rateLimitRetries: z.number().int().min(0).optional(),
         rateLimitMinDelayMs: z.number().int().min(0).optional(),
         rateLimitMaxServerDelayMs: z.number().int().min(0).optional(),
+        /** HTTP statuses to treat as NON-retryable even when defaultRetryable would
+         *  retry them (e.g. pin 503 to fail fast instead of riding the backoff ladder).
+         *  Bug fix: this field (and failFastPatterns below) existed on Config.retry in
+         *  state.ts and was actively read by model-manager.ts, but was never declared
+         *  on THIS nested z.object — since only the OUTER ConfigSchema calls
+         *  `.passthrough()`, Zod's default strip-unknown-keys behavior silently dropped
+         *  both fields on every config read/write that round-tripped through this
+         *  schema, even though the user's config.json faithfully stored them on disk. */
+        failFastStatuses: z.array(z.number().int()).optional(),
+        /** Case-insensitive substrings; an error whose message matches any of these
+         *  fails fast (non-retryable) even when the chosen predicate would retry it. */
+        failFastPatterns: z.array(z.string()).optional(),
       })
       .optional(),
     /**

package/src/agent/opik-tracer.ts

@@ -337,7 +337,7 @@ export function wrapEvents(events: AgentLoopEvents | undefined, tracer: OpikTrac
     onStep(step: number) {
       currentStep = step;
       stepStartedAt = Date.now();
-      try { base.onStep?.(step); } finally { /* tracer has no per-onStep write */ }
+      base.onStep?.(step);
     },
     onAssistant(raw: string, invocation: ToolInvocation | null) {
       base.onAssistant?.(raw, invocation);

package/src/agent/output-util.ts

@@ -1,64 +1,9 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-
-export const TOOL_SPILL_THRESHOLD = 32_000;
-
-export function truncateToolOutput(output: string, limit = 8000): string {
-  if (output.length <= limit) return output;
-  const half = Math.floor(limit / 2);
-  return output.slice(0, half) + "\n\n... (elided " + (output.length - limit) + " chars) ...\n\n" + output.slice(-half);
-}
-
-export async function spillToolResult(tool: string, output: string, cwd: string): Promise<string> {
-  const artifactsDir = path.join(cwd, ".jeo", "artifacts");
-  await fs.mkdir(artifactsDir, { recursive: true });
-
-  const ts = new Date().toISOString().replace(/[:.]/g, "-");
-  const filename = "result-" + tool + "-" + ts + ".txt";
-  const fullPath = path.join(artifactsDir, filename);
-
-  await fs.writeFile(fullPath, output, "utf-8");
-  return path.relative(cwd, fullPath);
-}
-
-/** One tool execution's performance record (consumed by dev self-analysis). */
+/** One tool execution's performance record (consumed by dev self-analysis's read
+ *  path — `.jeo/state/performance-metrics.json`, currently never populated by
+ *  any writer in this codebase; the shape is kept as the read-side contract). */
 export interface PerfMetric {
   tool: string;
   duration: number;
   success: boolean;
   error?: string;
 }
-
-/** Append a tool performance metric to `.jeo/state/performance-metrics.json`
- *  (bounded to the most recent 200 records). Best-effort: failures are ignored
- *  so metrics can never break an agent turn. */
-export async function logPerformanceMetric(cwd: string, metric: PerfMetric): Promise<void> {
-  try {
-    const dir = path.join(cwd, ".jeo", "state");
-    const file = path.join(dir, "performance-metrics.json");
-    await fs.mkdir(dir, { recursive: true });
-    let records: PerfMetric[] = [];
-    try {
-      const parsed = JSON.parse(await fs.readFile(file, "utf-8"));
-      if (Array.isArray(parsed)) records = parsed;
-    } catch { /* first write or corrupt file → start fresh */ }
-    records.push(metric);
-    if (records.length > 200) records = records.slice(-200);
-    await fs.writeFile(file, JSON.stringify(records), "utf-8");
-  } catch { /* best-effort */ }
-}
-
-/** Read spec-kit project context (`.specify/memory/constitution.md`) when the repo
- *  was initialized with GitHub spec-kit, so the agent honors the project
- *  constitution. Returns null when absent/unreadable; content is capped. */
-export async function loadSpecKitContext(cwd: string): Promise<string | null> {
-  try {
-    const file = path.join(cwd, ".specify", "memory", "constitution.md");
-    const content = (await fs.readFile(file, "utf-8")).trim();
-    if (!content) return null;
-    const capped = content.length > 4000 ? content.slice(0, 4000) + "…" : content;
-    return "\n\n<spec-kit-constitution>\n" + capped + "\n</spec-kit-constitution>";
-  } catch {
-    return null;
-  }
-}

package/src/agent/step-budget.ts

@@ -41,8 +41,7 @@ export interface ExtensionDecision {
 type EnvLike = Record<string, string | undefined>;
 
 function envNum(env: EnvLike, key: string, dflt: number, min: number, max: number): number {
-  // `key` is the legacy JEO_* name; the JEO_* spelling is preferred when both are set.
-  const raw = env[key.replace(/^JEO_/, "JEO_")] ?? env[key];
+  const raw = env[key];
   if (raw === undefined || raw === "") return dflt;
   const n = Number(raw);
   if (!Number.isFinite(n)) return dflt;
@@ -82,7 +81,7 @@ export function resolveStepBudgetConfig(
 
 /** True when `key` carries a non-empty value in `env`. */
 function envSet(env: EnvLike, key: string): boolean {
-  const raw = env[key.replace(/^JEO_/, "JEO_")] ?? env[key];
+  const raw = env[key];
   return raw !== undefined && raw !== "";
 }
 

package/src/agent/task-tool.ts

@@ -35,7 +35,11 @@ import { ensureSessionNotifyEndpoint, type SessionNotifyEndpoint } from "./notif
 /** Lifecycle event emitted while a delegated subagent runs. */
 export interface TaskSubEvent {
   role: string;
-  kind: "start" | "step" | "tool" | "done" | "error";
+  /** `"thinking"` streams the subagent's live reasoning/thought text (native
+   *  extended-thinking models) — a transient live-preview beat, not persisted to
+   *  the ledger (mirrors the main turn's dimmed "Thinking" block, scoped per
+   *  subagent slot instead of a single shared region). */
+  kind: "start" | "step" | "tool" | "done" | "error" | "thinking";
   detail?: string;
   success?: boolean;
   /** Current nested subagent step, when known. */
@@ -142,9 +146,6 @@ export function taskToolProtocolLine(config?: Pick<Config, "subagents">): string
   );
 }
 
-/** @deprecated static snapshot (bundled roles only) — prefer taskToolProtocolLine(config). */
-export const TASK_TOOL_PROTOCOL_LINE = taskToolProtocolLine();
-
 /**
  * A concise, gjc-style label for a subagent's tool call — the actual TARGET (file / command /
  * glob), not just the bare tool name — so the parent's live monitor shows "read src/x.ts" or
@@ -300,6 +301,17 @@ export async function runSubagentOnce(
     tools: subagentToolset(role),
     events: {
       onStep: n => { currentStep = n; },
+      // Live reasoning preview (native extended-thinking models only — the JSON-protocol
+      // "reasoning" field the main turn also extracts from onModelStream is intentionally
+      // NOT wired here: a subagent's forming tool-call JSON is rarely useful mid-stream and
+      // doubling the stream sinks would double emit() calls for the same underlying delta).
+      // Tail-sliced + whitespace-collapsed to a compact one-line preview — the ledger never
+      // records this (see the `kind` doc comment); it only drives the live per-slot status.
+      onReasoningStream: textSoFar => {
+        const tail = textSoFar.length > 200 ? textSoFar.slice(textSoFar.length - 200) : textSoFar;
+        const preview = tail.replace(/\s+/g, " ").trim();
+        if (preview) emit({ role: role.id, kind: "thinking", detail: preview, step: currentStep, maxSteps, model });
+      },
       onAssistant: (_raw, invocation) => {
         if (invocation && invocation.tool && invocation.tool !== "done") {
           lastTarget = toolTarget(invocation.tool, invocation.arguments);

package/src/agent/ts-language-service.ts

@@ -108,13 +108,6 @@ export async function languageServiceFor(cwd: string, absPath: string): Promise<
   return cached.service;
 }
 
-/** Drop a cached language service (tests / long-running sessions that need a
- *  clean project graph after large structural changes). */
-export function resetLanguageServiceCache(cwd?: string): void {
-  if (cwd) serviceCache.delete(cwd);
-  else serviceCache.clear();
-}
-
 export interface SymbolSelector { text: string; occurrence: number }
 
 /** Parse a loose `"name"` or `"name#N"` selector (1-indexed occurrence, default 1). */

package/src/ai/model-manager.ts

@@ -472,25 +472,12 @@ const DEFAULT_CALL_TIMEOUT_MS = 300_000;
  *  phase runs longer still; Ctrl-C remains the interactive escape for a truly dead one. */
 const STREAM_IDLE_TIMEOUT_MS = 300_000;
 
-/** Combine two abort signals into one. Preserves BOTH even when `AbortSignal.any`
- *  is unavailable (manual fallback), so neither the caller's cancel nor the timeout
- *  is silently dropped. */
+/** Combine two abort signals into one — neither the caller's cancel nor the timeout
+ *  is ever silently dropped. `AbortSignal.any` is native on every Bun this CLI runs on
+ *  (shipped in Bun 1.1.13; `src/cli.ts` hard-enforces `engines.bun: ">=1.3.14"` at
+ *  process start, so a manual polyfill fallback would be permanently unreachable). */
 function composeAbort(a: AbortSignal | undefined, b: AbortSignal): AbortSignal {
-  if (!a) return b;
-  if (typeof AbortSignal.any === "function") return AbortSignal.any([a, b]);
-  if (a.aborted || b.aborted) return AbortSignal.abort();
-  const ctrl = new AbortController();
-  // Memory hygiene: `a` is typically the TURN-long abort signal — a once-listener
-  // per model call would otherwise accumulate on it for the whole turn. Detach
-  // BOTH listeners as soon as either side fires.
-  const onAbort = () => {
-    a.removeEventListener("abort", onAbort);
-    b.removeEventListener("abort", onAbort);
-    ctrl.abort();
-  };
-  a.addEventListener("abort", onAbort, { once: true });
-  b.addEventListener("abort", onAbort, { once: true });
-  return ctrl.signal;
+  return a ? AbortSignal.any([a, b]) : b;
 }
 
 /** Compose the caller's signal (if any) with a fresh per-attempt timeout. */

package/src/commands/launch/stream.ts

@@ -53,11 +53,18 @@ export function formatTaskSubEvent(e: TaskSubEvent): string {
   if (e.kind === "step") return `  ${badge} ${chalk.cyan(`├─ ${roleLabel}`)} · ${detail || "working"}`;
   if (e.kind === "tool") return `  ${badge} ${e.success === false ? chalk.red("├─") : chalk.green("├─")} ${roleLabel} ${e.success === false ? chalk.red("✗") : chalk.green("✓")} ${detail || "tool"}${summary}`;
   if (e.kind === "error") return `  ${badge} ${chalk.red("├─")} ${roleLabel} ${chalk.red("✗")} ${detail || "error"}`;
+  // "thinking" is a live-only TUI preview (never persisted to the ledger — see
+  // TaskSubEvent.kind's doc comment) and has no place in an append-only, non-TTY
+  // log stream: a reasoning delta stream would otherwise fall through to the
+  // "done" branch below and print a bogus "ROLE done: <reasoning text>" line for
+  // every emitted preview. Empty string signals the caller to skip the line.
+  if (e.kind === "thinking") return "";
   return `${badge} ${e.success === false ? chalk.red("└─") : chalk.green("└─")} ${roleLabel} done${tokTag}${e.success === false ? " (incomplete)" : ""}${detail ? `: ${detail}` : ""}`;
 }
 
 export function logTaskSubEvent(e: TaskSubEvent, log: (line: string) => void = (s: string) => console.log(s)): void {
-  log(formatTaskSubEvent(e));
+  const line = formatTaskSubEvent(e);
+  if (line) log(line);
 }
 
 export function createStreamEvents(

package/src/commands/launch.ts

@@ -937,7 +937,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // config file. (gjc parity P1.B5: dirty count per-turn, not per-render.)
     const { provider: activeProvider } = await describeModel(activeModel, turnConfig);
     const turnDirtyCount = branch ? gitDirtyCount(cwd) : undefined;
-    const tui = useTui ? new LaunchTui({ model: activeModel, provider: activeProvider, sessionId, maxSteps: initialStepLimit, cwd, branch, dirtyCount: turnDirtyCount, thinking: activeThinking }) : null;
+    const tui = useTui ? new LaunchTui({ model: activeModel, provider: activeProvider, sessionId, maxSteps: initialStepLimit, cwd, branch, dirtyCount: turnDirtyCount, thinking: activeThinking, routedTier: routed?.tier }) : null;
     if (routeCredentialNotice) {
       if (tui) tui.events().onNotice?.(routeCredentialNotice);
       else console.log(routeCredentialNotice);

package/src/tui/app.ts

@@ -68,6 +68,12 @@ export interface LaunchTuiOptions {
   dirtyCount?: number;
   /** Thinking-level label ("high", …) for the gjc-style model status bar. */
   thinking?: string;
+  /** PromptRouter's resolved tier when routing chose THIS turn's `model` (undefined
+   *  when routing didn't engage — pinned model, routing off, or the credential
+   *  gate fell back). Renders a persistent `⚡tier` marker in the status bar so the
+   *  routed model stays visible without depending on the transient `[route]`
+   *  console notice. See `StatusBarData.routedTier` in components/status.ts. */
+  routedTier?: "trivial" | "standard" | "complex";
 }
 
 export interface AgentEventsLike {
@@ -361,6 +367,9 @@ export class LaunchTui {
   private readonly inline: boolean;
   // Thinking-level label for the gjc-style model status bar.
   private readonly thinkingLevel?: string;
+  // PromptRouter's resolved tier when routing chose this turn's model; undefined when
+  // routing didn't engage. Renders the persistent `⚡tier` marker in the status bar.
+  private readonly routedTier?: "trivial" | "standard" | "complex";
 
   constructor(opts: LaunchTuiOptions) {
     // Backpressure-aware wrapper around the underlying writer (real stdout, or the
@@ -383,6 +392,7 @@ export class LaunchTui {
     this.renderer = new Renderer(this.write, undefined, { reserve: this.inline });
     this.spinner = new Spinner(undefined, { unicode: this.unicode });
     this.thinkingLevel = opts.thinking;
+    this.routedTier = opts.routedTier;
     this.footer = {
       model: opts.model,
       provider: opts.provider,
@@ -1041,6 +1051,11 @@ export class LaunchTui {
         touchSlot(`${roleLabel} ${bad} ${detail || "error"}`);
         this.appendLedger(`  ${badge} ${branch} ${roleLabel} ${bad} ${detail || "error"}\n`, "subagent");
         break;
+      case "thinking":
+        // Live-only preview (mirrors the main turn's dimmed "Thinking" block) — never
+        // persisted to the ledger; see TaskSubEvent.kind's doc comment for why.
+        touchSlot(`${roleLabel} ${this.unicode ? "…" : "..."} ${detail || "thinking"}`);
+        break;
       case "done":
         // Clear ONLY this slot — a fan-out batch where one worker finishes early
         // must keep showing its still-running siblings, not drop the `(sub)`
@@ -1632,6 +1647,7 @@ export class LaunchTui {
     return renderStatusBar({
       model: `${this.footer.model}${this.footer.provider ? ` (${this.footer.provider})` : ""}`,
       thinking: this.thinkingLevel,
+      routedTier: this.routedTier,
       branch: this.footer.branch,
       dirtyCount: this.footer.dirtyCount,
       cwd: this.footer.cwd,

package/src/tui/components/status.ts

@@ -17,6 +17,14 @@ export interface StatusBarData {
   model: string;
   /** Thinking level label ("high", …); omitted when unset. */
   thinking?: string;
+  /** PromptRouter's resolved tier ("trivial"/"standard"/"complex") when THIS turn's
+   *  model was chosen by routing rather than the session/default model directly —
+   *  omitted when routing didn't engage this turn (pinned model, routing off, or
+   *  the credential-readiness gate fell back). Renders as a persistent `⚡tier`
+   *  marker so the routed model stays visible without depending on the transient
+   *  `[route] …` console notice, which intentionally stays silent for routine
+   *  unescalated `standard`-tier turns. */
+  routedTier?: "trivial" | "standard" | "complex";
   branch?: string;
   /** Uncommitted-change count for the `?N` dirty flag; omit/0 = clean. */
   dirtyCount?: number;
@@ -81,6 +89,7 @@ export function renderStatusBar(d: StatusBarData): string {
   // Left identity segment (plain text; painted as one bg block at the end).
   const bits: string[] = [];
   let modelBit = `${unicode ? "⬢" : "*"} ${d.model}`;
+  if (d.routedTier) modelBit += ` ${unicode ? "⚡" : "~"}${d.routedTier}`;
   if (d.thinking) modelBit += ` · ${unicode ? "◔" : "@"} ${d.thinking}`;
   bits.push(modelBit);
   if (d.branch) {