jeo-code 0.7.51 → 0.7.54

package/CHANGELOG.md

@@ -6,6 +6,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.54] - 2026-07-06
+_Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead._
+
+### Fixed
+- **`streamMaxMs()`/`callTimeoutMs()` shared default raised 300s → 30min** (`src/ai/model-manager.ts`'s `DEFAULT_CALL_TIMEOUT_MS`) — rather than reverting to opt-in-off (which would reopen a real gap for direct non-turn-wrapped callers like `jeo chat`, since `JEO_TURN_MAX_MS`'s turn-level stall-budget backstop only wraps `runAgentLoop` steps), the shared ceiling now matches `turnMaxMs()`'s own already-vetted 30min default AND the OBSERVED ~20-30min infra-side connection-duration cap on OpenAI's Codex/ChatGPT backend (a real boundary already handled elsewhere in this file as a retryable mid-stream socket close) — a real, evidenced ceiling, not an arbitrary pick. `JEO_STREAM_MAX_MS`/`JEO_CALL_TIMEOUT_MS` env overrides (including `0` to disable the overall stream deadline) are unchanged. The per-chunk idle watchdog (`JEO_STREAM_IDLE_MS`, still 300s) is untouched — this fix only raises the OVERALL ceiling that fires despite continuous activity, not the dead-stream detector.
+- **`friendlyProviderError` now names the exact env var to raise** for both failure surfaces instead of a bare timeout string — a non-streaming `TimeoutError`/`"the operation timed out"` DOMException points at `JEO_CALL_TIMEOUT_MS`, and the stream overall-deadline message points at `JEO_STREAM_MAX_MS` (mentioning `0` disables it), both noting this is expected behavior for a deliberately long HIGH/XHIGH reasoning completion rather than an opaque failure.
+
+### Verified
+- `bun run typecheck` clean; targeted suite (`round-b`, `provider-error`, `provider-error-taxonomy`, `cycle-and-turn-budget`, `retry`, `engine`, `transient-network-recovery`, `refusal-recovery`) 119/119 pass; full suite 2665/2665 pass across 280 files.
+- `test/round-b.test.ts`: new regression test proves an ACTIVELY-emitting stream running past the OLD 300s threshold completes normally instead of being force-aborted (compressed-timescale reproduction of the exact reported failure mode); `streamMaxMs`/`callTimeoutMs` default-value tests updated to the new 30min figure; existing keepalive-forever-stream and healthy-stream tests re-confirmed unaffected.
+- `test/provider-error.test.ts` (+2): a bare `TimeoutError` DOMException maps to `JEO_CALL_TIMEOUT_MS` guidance (raw DOMException text replaced); the stream overall-deadline message maps to `JEO_STREAM_MAX_MS` guidance including the disable-via-0 hint.
+- `docs/deep-dive-stream-idle.md` gained a follow-up section documenting this regression's exact causal chain against the original (now partially superseded) investigation, so the "why not an overall cap" reasoning that got silently reversed in v0.7.42 stays discoverable.
+
+## [0.7.53] - 2026-07-06
+_Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time._
+
+### Added
+- **`jeo doctor` proactive routing-credential diagnostic** (`src/commands/doctor.ts`) — for every tier PromptRouter could actually route to (`routing.tiers.trivial.model` or `roles.smol`, `routing.tiers.standard.model` when explicitly set, `routing.tiers.complex.model` or `roles.slow`), doctor now resolves the model's provider and checks credential readiness with the SAME `describeProvider` call `launch.ts`'s runtime gate uses — surfacing "routing.tiers.\<tier\> resolves to '\<model\>' (\<provider\>) which has no usable credential" at `jeo doctor` time instead of only reactively mid-session on the first qualifying turn. `standard` is only checked when explicitly configured, since its unconfigured fallback is `defaultModel`, already covered by the existing provider-connectivity probes.
+
+### Changed
+- **`jeo doctor --json`'s `routing` block: singular `note` → `notes` array** — the prior shape could only ever represent the one "roles.smol unconfigured" case; the new `notes: string[]` (omitted when empty, same as before) represents zero, one, or several simultaneous routing diagnostics (e.g. `roles.smol` set to an uncredentialed provider AND `routing.tiers.complex` also uncredentialed) without collapsing them into one string. Purely additive to `jeo doctor`'s informational output — never affects the `ready`/`--strict` exit code, matching the existing routing-diagnostic contract.
+
+## [0.7.52] - 2026-07-06
+_Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code._
+
+### Added
+- **Persistent routed-tier marker in the status bar** (`src/tui/components/status.ts`'s `StatusBarData.routedTier`/`renderStatusBar`, threaded through `LaunchTuiOptions`/`LaunchTui` in `src/tui/app.ts` and `src/commands/launch.ts`'s `runTurn`) — when PromptRouter picks THIS turn's model, a `⚡tier` marker (`~tier` in ASCII mode) renders right after the model name in the always-visible model bar, e.g. `claude-haiku-4-5 ⚡trivial`. Unlike the existing `[route] …` console notice (which intentionally stays silent for routine tier resolutions and only fires for interesting/escalated cases), the status-bar marker is unconditional whenever routing actually chose the model this turn — omitted when routing is off, the model is pinned, or the v0.7.51 credential-readiness gate vetoed the routed decision back to the default.
+- **Subagent thinking visibility** (`TaskSubEvent`'s new `"thinking"` kind in `src/agent/task-tool.ts`, wired through `runSubagentOnce`'s `onReasoningStream` callback and handled in `LaunchTui.onSubagentEvent`) — a delegated subagent's own native extended-thinking stream now surfaces as a live, per-slot preview in the TUI (mirrors the main turn's dimmed "Thinking" block, scoped to that subagent's row instead of a single shared region), tail-sliced and whitespace-collapsed the same way tool/step previews already are. Transient only: never persisted to the ledger/scrollback (matches how the main turn's live reasoning preview also never appears in the final record), and the non-TTY streaming log (`formatTaskSubEvent` in `src/commands/launch/stream.ts`) explicitly no-ops on `"thinking"` instead of falling through to a bogus `"ROLE done: <reasoning text>"` line.
+
+### Fixed
+- **`retry.failFastStatuses`/`retry.failFastPatterns` silently stripped from every saved config** (`src/agent/config-schema.ts`) — both fields existed on `Config.retry` (`state.ts`) and were actively read by `src/ai/model-manager.ts` to decide non-retryable errors, but were never declared on the NESTED `retry` `z.object`. Only the outer `ConfigSchema` calls `.passthrough()`; Zod's default strip-unknown-keys behavior silently dropped both fields on every config read/write that round-tripped through `parseConfig`, even though `config.json` faithfully stored them on disk — a user-configured fail-fast rule would quietly stop applying the moment anything else touched the config file. Fixed by declaring both fields on the nested object directly.
+- **Ponytail-mode dead-code sweep** (six files, five independent findings, all confirmed zero-call-site via `grep` before deletion): `src/agent/output-util.ts` lost `TOOL_SPILL_THRESHOLD`, `truncateToolOutput`, `spillToolResult`, and `logPerformanceMetric` (the last of these means `.jeo/state/performance-metrics.json` is never actually written by anything in this codebase — `PerfMetric`'s read-side in `dev/self-analysis.ts` is kept as the interface contract, but the writer was dead weight, not a working feature); `src/agent/ts-language-service.ts` lost `resetLanguageServiceCache` (no caller); `src/agent/task-tool.ts` lost the `@deprecated` `TASK_TOOL_PROTOCOL_LINE` static snapshot (superseded by `taskToolProtocolLine(config)`); `src/agent/step-budget.ts` simplified a no-op `key.replace(/^JEO_/, "JEO_")` (replacing a prefix with itself) in both `envNum` and `envSet` to a plain lookup; `src/agent/opik-tracer.ts` removed a `try/finally` around `onStep` whose `finally` block was an empty comment with no actual cleanup; `src/ai/model-manager.ts`'s `composeAbort` dropped an unreachable manual-polyfill branch for `AbortSignal.any` (native since Bun 1.1.13; `src/cli.ts` hard-enforces `engines.bun: ">=1.3.14"` at process start), cutting it from 17 lines to 2 with identical behavior for every real input.
+
+### Verified
+- `bun run typecheck` clean; `bun test` 2660 pass / 0 fail across 280 files on first run; a second full run reproduced 1 pre-existing flake (`test/hooks.test.ts`'s "disabled hooks never run", isolated-run-clean 3/3 — a cross-file `process.env.JEO_CONFIG_DIR` race under full-suite concurrency, not a regression from any change in this release).
+- `test/status-bar.test.ts` (+4 tests): `routedTier` renders the `⚡` marker right after the model and before thinking; omitted entirely when routing didn't engage; ASCII fallback uses `~`; all three tier values (`trivial`/`standard`/`complex`) render verbatim.
+- `test/tui-app.test.ts` (+3): `LaunchTui` threads `routedTier` into the persistent inline model bar and omits it when unset; `onSubagentEvent` with kind `"thinking"` drives the live per-slot preview but is never captured in the final scrollback record.
+- `test/task-tool.test.ts` (+2): a subagent whose mocked `callLlm` invokes `onReasoning` emits live `"thinking"` events tagged to its own slot/index; a subagent with no reasoning stream emits zero `"thinking"` events (no false positives).
+- `test/config-schema.test.ts` (+2, regression-focused): `retry.failFastStatuses`/`failFastPatterns` now survive `parseConfig` round-trip; a non-integer entry in `failFastStatuses` is rejected. The bug was confirmed empirically (bypassing the fix, both fields stripped silently) before applying it.
+- Every dead-code deletion re-verified zero call sites via `grep` across `src/` and `test/` immediately before removal; the env-signal-composition simplifications (`composeAbort`, `envNum`/`envSet`) are exercised indirectly through existing abort-signal tests (`test/engine.test.ts`, `test/retry.test.ts`, `test/transient-network-recovery.test.ts`) and env-override tests (`test/step-budget.test.ts`), all passing unchanged — proving each simplification is behavior-preserving, not just "looks safe."
+
 ## [0.7.51] - 2026-07-06
 _Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole._
 

package/README.ja.md

@@ -78,8 +78,8 @@ jeo --tmux               # 独立した tmux セッションで実行
 | `/model` · `/provider` | モデル/プロバイダ選択; `/model` でデフォルト/ロールバッジ、Ralph 風の入れ子ロール・thinking 選択、OpenAI Codex ロールプリセットを一つの流れで設定 |
 | `/provider login <name>` · `/logout` | 入力欄から OAuth ログイン/ログアウト |
 | `/agents [role]` · `/subagent` | ロール別(executor/planner/architect/critic)モデル・thinking・ステップ設定 |
-| `/thinking [level]` | デフォルト推論予算(minimal…xhigh)の表示/設定 |
-| `/fast [on|off|status]` | 現在のモデルが minimal/low 推論をサポートする場合に fast thinking モードを切替 |
+| `/thinking [level]` | デフォルト推論予算(low…xhigh)の表示/設定 |
+| `/fast [on|off|status]` | 現在のモデルが low 推論をサポートする場合に fast thinking モードを切替 |
 | `/skill` · `$<skill> [intent]` | ワークフロースキルの一覧/実行(`$team "task"` 形式) |
 | `/view` · `/diff` · `/find` · `/search` | コード表示、git diff、ファイル/パターン検索 |
 | `/new` · `/resume` · `/sessions` | セッション管理 |
@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -79,8 +79,8 @@ jeo --tmux               # 독립 tmux 세션에서 실행
 | `/model` · `/provider` | 모델/프로바이더 선택; `/model`에서 기본/역할 배지, Ralph식 하위 리스트 역할·thinking 선택, OpenAI Codex 역할 프리셋을 한 흐름으로 설정 |
 | `/provider login <name>` · `/logout` | 입력창에서 OAuth 로그인/로그아웃 |
 | `/agents [role]` · `/subagent` | 역할별(executor/planner/architect/critic) 모델·thinking·스텝 구성 |
-| `/thinking [level]` | 기본 추론 예산(minimal…xhigh) 조회/설정 |
-| `/fast [on|off|status]` | 현재 모델이 minimal/low 추론을 지원하면 fast thinking 모드를 켜고 끔 |
+| `/thinking [level]` | 기본 추론 예산(low…xhigh) 조회/설정 |
+| `/fast [on|off|status]` | 현재 모델이 low 추론을 지원하면 fast thinking 모드를 켜고 끔 |
 | `/skill` · `$<skill> [intent]` | 워크플로 스킬 목록/실행(`$team "작업"` 스타일) |
 | `/view` · `/diff` · `/find` · `/search` | 코드 보기, git diff, 파일/패턴 검색 |
 | `/new` · `/resume` · `/sessions` | 세션 관리 |
@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -79,8 +79,8 @@ Inside the `jeo` REPL (Tab autocompletes; `/` opens the palette).
 | `/model` · `/provider` | Pick model/provider; `/model` shows default/role badges, Ralph-style nested Set-as-role thinking choices, and the OpenAI Codex role preset in one flow |
 | `/provider login <name>` · `/logout` | OAuth login/logout from the input box |
 | `/agents [role]` · `/subagent` | Per-role (executor/planner/architect/critic) model · thinking · step config |
-| `/thinking [level]` | Show/set default reasoning budget (minimal…xhigh) |
-| `/fast [on|off|status]` | Toggle fast thinking mode when the active model advertises minimal/low reasoning |
+| `/thinking [level]` | Show/set default reasoning budget (low…xhigh) |
+| `/fast [on|off|status]` | Toggle fast thinking mode when the active model advertises low reasoning |
 | `/skill` · `$<skill> [intent]` | List/run workflow skills (`$team "task"` style) |
 | `/view` · `/diff` · `/find` · `/search` | Code view, git diff, file/pattern search |
 | `/new` · `/resume` · `/sessions` | Session management |
@@ -214,8 +214,10 @@ JEO_TUI_THEME=cosmic            # cosmic/matrix/solar/red-claw/blue-crab/mono/au
 JEO_TUI_ALT_SCREEN=1            # legacy alt-screen turn (default: inline scrollback)
 JEO_STEP_BASE=24                # dynamic step budget: rolling base
 JEO_STEP_HARD_CAP=600           # absolute termination guarantee
-JEO_STREAM_MAX_MS=300000        # opt-in overall stream deadline (default off; bounds slow-drip streams)
+JEO_STREAM_MAX_MS=1800000       # overall stream deadline (default 30min; bounds slow-drip streams, not active ones); 0 disables
 JEO_STREAM_IDLE_MS=300000       # per-chunk idle cap (default 300s); raise for slow/local backends silent before first token
+JEO_CALL_TIMEOUT_MS=1800000     # non-streaming call wall cap (default 30min; compaction/subagents/goal-verify)
+JEO_TURN_MAX_MS=1800000         # turn stall budget: max time WITHOUT tool progress (default 30min); 0 disables
 JEO_TOOL_OUTPUT_MAX=4000        # model-visible tool output cap (full output spills to artifacts)
 ```
 
@@ -262,11 +264,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -78,8 +78,8 @@ jeo --tmux               # 在独立 tmux 会话中运行
 | `/model` · `/provider` | 选择模型/提供商；`/model` 在一个流程内显示默认/角色徽章、Ralph 风格嵌套角色·thinking 选择与 OpenAI Codex 角色预设 |
 | `/provider login <name>` · `/logout` | 在输入框内 OAuth 登录/登出 |
 | `/agents [role]` · `/subagent` | 按角色(executor/planner/architect/critic)配置模型·thinking·步数 |
-| `/thinking [level]` | 查看/设置默认推理预算(minimal…xhigh) |
-| `/fast [on|off|status]` | 当前模型支持 minimal/low 推理时切换 fast thinking 模式 |
+| `/thinking [level]` | 查看/设置默认推理预算(low…xhigh) |
+| `/fast [on|off|status]` | 当前模型支持 low 推理时切换 fast thinking 模式 |
 | `/skill` · `$<skill> [intent]` | 列出/运行工作流技能(`$team "任务"` 风格) |
 | `/view` · `/diff` · `/find` · `/search` | 代码查看、git diff、文件/模式搜索 |
 | `/new` · `/resume` · `/sessions` | 会话管理 |
@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
+- **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
-- **[0.7.47]** (2026-07-06) — PromptRouter (gjc-inspired, jeo-native design — NOT a port of katanemo/plano, whose always-on proxy-orchestrator architecture doesn't fit an interactive CLI's per-turn latency budget): jeo already had static, role-based model mapping (`resolveSubagentModel`/`resolveRoleModel`) but zero logic that varied the model by what THIS turn's prompt actually asks for. Adds an opt-in (default OFF), heuristic-first, fail-open per-turn router: a bilingual regex classifier scores a prompt into trivial/standard/complex, escalating to one cheap LLM call ONLY when the heuristic is genuinely ambiguous (confidence below a configurable threshold — most turns never escalate), and an explicit `/model` pin always wins over routing. No new plumbing: reuses `resolveRoleModel`, `callLlm`, `jsonMode`, `catalogMetadata`, `tryExtractJsonObject`, and the existing `onNotice` transparency pattern.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.51",
+  "version": "0.7.54",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -122,7 +122,7 @@ export const ConfigSchema = z
      *  regardless of project/cwd. A leading `~` is expanded; env `JEO_WIKI_ROOT`
      *  overrides. Consumed by `resolveWikiRoot` and injected into the prompt. */
     wikiRoot: z.string().optional(),
-    thinkingLevel: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
+    thinkingLevel: z.enum(["low", "medium", "high", "xhigh"]).optional(),
     modelAliases: z.record(z.string()).optional(),
     /** Most-recently-selected models, newest first (drives the default + pickers). */
     recentModels: z.array(z.string()).optional(),
@@ -140,6 +140,18 @@ export const ConfigSchema = z
         rateLimitRetries: z.number().int().min(0).optional(),
         rateLimitMinDelayMs: z.number().int().min(0).optional(),
         rateLimitMaxServerDelayMs: z.number().int().min(0).optional(),
+        /** HTTP statuses to treat as NON-retryable even when defaultRetryable would
+         *  retry them (e.g. pin 503 to fail fast instead of riding the backoff ladder).
+         *  Bug fix: this field (and failFastPatterns below) existed on Config.retry in
+         *  state.ts and was actively read by model-manager.ts, but was never declared
+         *  on THIS nested z.object — since only the OUTER ConfigSchema calls
+         *  `.passthrough()`, Zod's default strip-unknown-keys behavior silently dropped
+         *  both fields on every config read/write that round-tripped through this
+         *  schema, even though the user's config.json faithfully stored them on disk. */
+        failFastStatuses: z.array(z.number().int()).optional(),
+        /** Case-insensitive substrings; an error whose message matches any of these
+         *  fails fast (non-retryable) even when the chosen predicate would retry it. */
+        failFastPatterns: z.array(z.string()).optional(),
       })
       .optional(),
     /**
@@ -155,7 +167,7 @@ export const ConfigSchema = z
           provider: z.enum(["anthropic", "openai", "gemini", "antigravity", "ollama"]).optional(),
           maxSteps: z.number().int().min(1).optional(),
           /** Per-role reasoning budget; absent = inherit the global thinkingLevel. */
-          thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
+          thinking: z.enum(["low", "medium", "high", "xhigh"]).optional(),
           // ─── Custom-role declaration (SYSTEM-driven registry) ───
           // An entry under a NON-bundled id that sets any of these becomes a
           // first-class subagent role at runtime — no code change required.
@@ -189,9 +201,9 @@ export const ConfigSchema = z
         confidenceThreshold: z.number().min(0).max(1).optional(),
         tiers: z
           .object({
-            trivial: z.object({ model: z.string().optional(), thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional() }).optional(),
-            standard: z.object({ model: z.string().optional(), thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional() }).optional(),
-            complex: z.object({ model: z.string().optional(), thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional() }).optional(),
+            trivial: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
+            standard: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
+            complex: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
           })
           .optional(),
       })
@@ -250,8 +262,52 @@ function normalizeModelId(id: string | undefined, aliases: Record<string, string
   return trimmed;
 }
 
+/** Migrate the retired "minimal" thinking level to "low" on every field that could carry
+ *  it, BEFORE schema validation. Without this, a config.json persisted while "minimal"
+ *  was still valid (thinkingLevel, any subagents.*.thinking, any routing.tiers.*.thinking)
+ *  would fail the tightened enum and readGlobalConfig's schema-invalid path resets the
+ *  ENTIRE config to defaults (modelAliases/subagents/routing/retry/hooks/notifications
+ *  all silently lost, not just the one bad field) — see state.ts's salvageCredentials doc
+ *  comment for why only oauth/providers survive that path. Mutates a shallow-cloned
+ *  object only where needed; non-object/malformed input passes through untouched so the
+ *  schema's own validation still reports the real error. */
+function migrateMinimalThinking(raw: unknown): unknown {
+  if (!raw || typeof raw !== "object") return raw;
+  const cfg = raw as Record<string, unknown>;
+  let changed = false;
+  const out: Record<string, unknown> = { ...cfg };
+  if (out.thinkingLevel === "minimal") { out.thinkingLevel = "low"; changed = true; }
+  if (out.subagents && typeof out.subagents === "object") {
+    const subs = out.subagents as Record<string, unknown>;
+    const nextSubs: Record<string, unknown> = { ...subs };
+    for (const [roleId, role] of Object.entries(subs)) {
+      if (role && typeof role === "object" && (role as Record<string, unknown>).thinking === "minimal") {
+        nextSubs[roleId] = { ...(role as Record<string, unknown>), thinking: "low" };
+        changed = true;
+      }
+    }
+    if (changed) out.subagents = nextSubs;
+  }
+  if (out.routing && typeof out.routing === "object") {
+    const routing = out.routing as Record<string, unknown>;
+    if (routing.tiers && typeof routing.tiers === "object") {
+      const tiers = routing.tiers as Record<string, unknown>;
+      const nextTiers: Record<string, unknown> = { ...tiers };
+      let tiersChanged = false;
+      for (const [tierId, tier] of Object.entries(tiers)) {
+        if (tier && typeof tier === "object" && (tier as Record<string, unknown>).thinking === "minimal") {
+          nextTiers[tierId] = { ...(tier as Record<string, unknown>), thinking: "low" };
+          tiersChanged = true;
+        }
+      }
+      if (tiersChanged) { out.routing = { ...routing, tiers: nextTiers }; changed = true; }
+    }
+  }
+  return changed ? out : raw;
+}
+
 export function parseConfig(raw: unknown): { ok: true; config: ValidatedConfig } | { ok: false; message: string } {
-  const result = ConfigSchema.safeParse(raw);
+  const result = ConfigSchema.safeParse(migrateMinimalThinking(raw));
   if (result.success) {
     const config = result.data;
     const aliases = config.modelAliases || {};

package/src/agent/opik-tracer.ts

@@ -337,7 +337,7 @@ export function wrapEvents(events: AgentLoopEvents | undefined, tracer: OpikTrac
     onStep(step: number) {
       currentStep = step;
       stepStartedAt = Date.now();
-      try { base.onStep?.(step); } finally { /* tracer has no per-onStep write */ }
+      base.onStep?.(step);
     },
     onAssistant(raw: string, invocation: ToolInvocation | null) {
       base.onAssistant?.(raw, invocation);

package/src/agent/output-util.ts

@@ -1,64 +1,9 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-
-export const TOOL_SPILL_THRESHOLD = 32_000;
-
-export function truncateToolOutput(output: string, limit = 8000): string {
-  if (output.length <= limit) return output;
-  const half = Math.floor(limit / 2);
-  return output.slice(0, half) + "\n\n... (elided " + (output.length - limit) + " chars) ...\n\n" + output.slice(-half);
-}
-
-export async function spillToolResult(tool: string, output: string, cwd: string): Promise<string> {
-  const artifactsDir = path.join(cwd, ".jeo", "artifacts");
-  await fs.mkdir(artifactsDir, { recursive: true });
-
-  const ts = new Date().toISOString().replace(/[:.]/g, "-");
-  const filename = "result-" + tool + "-" + ts + ".txt";
-  const fullPath = path.join(artifactsDir, filename);
-
-  await fs.writeFile(fullPath, output, "utf-8");
-  return path.relative(cwd, fullPath);
-}
-
-/** One tool execution's performance record (consumed by dev self-analysis). */
+/** One tool execution's performance record (consumed by dev self-analysis's read
+ *  path — `.jeo/state/performance-metrics.json`, currently never populated by
+ *  any writer in this codebase; the shape is kept as the read-side contract). */
 export interface PerfMetric {
   tool: string;
   duration: number;
   success: boolean;
   error?: string;
 }
-
-/** Append a tool performance metric to `.jeo/state/performance-metrics.json`
- *  (bounded to the most recent 200 records). Best-effort: failures are ignored
- *  so metrics can never break an agent turn. */
-export async function logPerformanceMetric(cwd: string, metric: PerfMetric): Promise<void> {
-  try {
-    const dir = path.join(cwd, ".jeo", "state");
-    const file = path.join(dir, "performance-metrics.json");
-    await fs.mkdir(dir, { recursive: true });
-    let records: PerfMetric[] = [];
-    try {
-      const parsed = JSON.parse(await fs.readFile(file, "utf-8"));
-      if (Array.isArray(parsed)) records = parsed;
-    } catch { /* first write or corrupt file → start fresh */ }
-    records.push(metric);
-    if (records.length > 200) records = records.slice(-200);
-    await fs.writeFile(file, JSON.stringify(records), "utf-8");
-  } catch { /* best-effort */ }
-}
-
-/** Read spec-kit project context (`.specify/memory/constitution.md`) when the repo
- *  was initialized with GitHub spec-kit, so the agent honors the project
- *  constitution. Returns null when absent/unreadable; content is capped. */
-export async function loadSpecKitContext(cwd: string): Promise<string | null> {
-  try {
-    const file = path.join(cwd, ".specify", "memory", "constitution.md");
-    const content = (await fs.readFile(file, "utf-8")).trim();
-    if (!content) return null;
-    const capped = content.length > 4000 ? content.slice(0, 4000) + "…" : content;
-    return "\n\n<spec-kit-constitution>\n" + capped + "\n</spec-kit-constitution>";
-  } catch {
-    return null;
-  }
-}

package/src/agent/state.ts

@@ -76,7 +76,7 @@ export interface Config {
     };
   };
 
-  thinkingLevel?: "minimal" | "low" | "medium" | "high" | "xhigh";
+  thinkingLevel?: "low" | "medium" | "high" | "xhigh";
   /** Friendly model aliases, e.g. { fast: "ollama/qwen2.5:0.5b" }. Override built-ins. */
   modelAliases?: { [alias: string]: string };
   /** Most-recently-selected models, newest first (MRU; head == defaultModel). */
@@ -119,7 +119,7 @@ export interface Config {
     [roleId: string]: {
       model?: string;
       maxSteps?: number;
-      thinking?: "minimal" | "low" | "medium" | "high" | "xhigh";
+      thinking?: "low" | "medium" | "high" | "xhigh";
       title?: string;
       description?: string;
       prompt?: string;
@@ -137,9 +137,9 @@ export interface Config {
     enabled?: boolean;
     confidenceThreshold?: number;
     tiers?: {
-      trivial?: { model?: string; thinking?: "minimal" | "low" | "medium" | "high" | "xhigh" };
-      standard?: { model?: string; thinking?: "minimal" | "low" | "medium" | "high" | "xhigh" };
-      complex?: { model?: string; thinking?: "minimal" | "low" | "medium" | "high" | "xhigh" };
+      trivial?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
+      standard?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
+      complex?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
     };
   };
   gitAutoCommit?: boolean;

package/src/agent/step-budget.ts

@@ -41,8 +41,7 @@ export interface ExtensionDecision {
 type EnvLike = Record<string, string | undefined>;
 
 function envNum(env: EnvLike, key: string, dflt: number, min: number, max: number): number {
-  // `key` is the legacy JEO_* name; the JEO_* spelling is preferred when both are set.
-  const raw = env[key.replace(/^JEO_/, "JEO_")] ?? env[key];
+  const raw = env[key];
   if (raw === undefined || raw === "") return dflt;
   const n = Number(raw);
   if (!Number.isFinite(n)) return dflt;
@@ -82,7 +81,7 @@ export function resolveStepBudgetConfig(
 
 /** True when `key` carries a non-empty value in `env`. */
 function envSet(env: EnvLike, key: string): boolean {
-  const raw = env[key.replace(/^JEO_/, "JEO_")] ?? env[key];
+  const raw = env[key];
   return raw !== undefined && raw !== "";
 }
 

package/src/agent/subagents.ts

@@ -298,7 +298,7 @@ export function parseMaxSteps(input: string | undefined): number | undefined {
  * maxSteps). Pure — does not mutate `config`. Unknown roles are rejected by the
  * caller via `getSubagentRole`; this helper trusts the id it is given.
  */
-export type ThinkLevelValue = "minimal" | "low" | "medium" | "high" | "xhigh";
+export type ThinkLevelValue = "low" | "medium" | "high" | "xhigh";
 
 /** Per-role reasoning level → explicit role override, else undefined (= INHERIT
  *  the global thinkingLevel at call time — gjc's "(inherit)" semantics). */

package/src/agent/task-tool.ts

@@ -35,7 +35,11 @@ import { ensureSessionNotifyEndpoint, type SessionNotifyEndpoint } from "./notif
 /** Lifecycle event emitted while a delegated subagent runs. */
 export interface TaskSubEvent {
   role: string;
-  kind: "start" | "step" | "tool" | "done" | "error";
+  /** `"thinking"` streams the subagent's live reasoning/thought text (native
+   *  extended-thinking models) — a transient live-preview beat, not persisted to
+   *  the ledger (mirrors the main turn's dimmed "Thinking" block, scoped per
+   *  subagent slot instead of a single shared region). */
+  kind: "start" | "step" | "tool" | "done" | "error" | "thinking";
   detail?: string;
   success?: boolean;
   /** Current nested subagent step, when known. */
@@ -142,9 +146,6 @@ export function taskToolProtocolLine(config?: Pick<Config, "subagents">): string
   );
 }
 
-/** @deprecated static snapshot (bundled roles only) — prefer taskToolProtocolLine(config). */
-export const TASK_TOOL_PROTOCOL_LINE = taskToolProtocolLine();
-
 /**
  * A concise, gjc-style label for a subagent's tool call — the actual TARGET (file / command /
  * glob), not just the bare tool name — so the parent's live monitor shows "read src/x.ts" or
@@ -300,6 +301,17 @@ export async function runSubagentOnce(
     tools: subagentToolset(role),
     events: {
       onStep: n => { currentStep = n; },
+      // Live reasoning preview (native extended-thinking models only — the JSON-protocol
+      // "reasoning" field the main turn also extracts from onModelStream is intentionally
+      // NOT wired here: a subagent's forming tool-call JSON is rarely useful mid-stream and
+      // doubling the stream sinks would double emit() calls for the same underlying delta).
+      // Tail-sliced + whitespace-collapsed to a compact one-line preview — the ledger never
+      // records this (see the `kind` doc comment); it only drives the live per-slot status.
+      onReasoningStream: textSoFar => {
+        const tail = textSoFar.length > 200 ? textSoFar.slice(textSoFar.length - 200) : textSoFar;
+        const preview = tail.replace(/\s+/g, " ").trim();
+        if (preview) emit({ role: role.id, kind: "thinking", detail: preview, step: currentStep, maxSteps, model });
+      },
       onAssistant: (_raw, invocation) => {
         if (invocation && invocation.tool && invocation.tool !== "done") {
           lastTarget = toolTarget(invocation.tool, invocation.arguments);

package/src/agent/ts-language-service.ts

@@ -108,13 +108,6 @@ export async function languageServiceFor(cwd: string, absPath: string): Promise<
   return cached.service;
 }
 
-/** Drop a cached language service (tests / long-running sessions that need a
- *  clean project graph after large structural changes). */
-export function resetLanguageServiceCache(cwd?: string): void {
-  if (cwd) serviceCache.delete(cwd);
-  else serviceCache.clear();
-}
-
 export interface SymbolSelector { text: string; occurrence: number }
 
 /** Parse a loose `"name"` or `"name#N"` selector (1-indexed occurrence, default 1). */

package/src/ai/model-catalog.ts

@@ -9,9 +9,9 @@
 import type { ProviderName } from "./types";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
-export type ThinkLevel = "minimal" | "low" | "medium" | "high" | "xhigh";
+export type ThinkLevel = "low" | "medium" | "high" | "xhigh";
 
-export const THINK_LEVELS: readonly ThinkLevel[] = ["minimal", "low", "medium", "high", "xhigh"];
+export const THINK_LEVELS: readonly ThinkLevel[] = ["low", "medium", "high", "xhigh"];
 
 export interface CatalogModel {
   /** jeo-facing canonical id (what a user types). */
@@ -31,8 +31,8 @@ export interface CatalogModel {
   company?: string;
 }
 
-const FULL: ThinkLevel[] = ["minimal", "low", "medium", "high", "xhigh"];
-const STD: ThinkLevel[] = ["minimal", "low", "medium", "high"];
+const FULL: ThinkLevel[] = ["low", "medium", "high", "xhigh"];
+const STD: ThinkLevel[] = ["low", "medium", "high"];
 
 export const ANTIGRAVITY_MODELS = [
   "claude-opus-4-6-thinking",

package/src/ai/model-manager.ts

@@ -92,8 +92,7 @@ export function providerModelFor(model: string): string {
 }
 
 /** Map the configured thinking level to a default max-token budget. */
-export function thinkingMaxTokens(level?: "minimal" | "low" | "medium" | "high" | "xhigh"): number {
-  if (level === "minimal") return 4000;
+export function thinkingMaxTokens(level?: "low" | "medium" | "high" | "xhigh"): number {
   if (level === "low") return 8000;
   if (level === "high") return 24000;
   if (level === "xhigh") return 31999;
@@ -117,7 +116,7 @@ const DEFAULT_MAX_OUTPUT_CAP = 64_000;
  *  Uncatalogued models (local/live ids) keep the legacy thinking-table budget. */
 export function resolveMaxOutputTokens(
   model?: string,
-  level?: "minimal" | "low" | "medium" | "high" | "xhigh",
+  level?: "low" | "medium" | "high" | "xhigh",
 ): number {
   const meta = model ? findCatalogEntry(expandAlias(model, ALIAS_DEFAULTS)) : undefined;
   if (!meta) return thinkingMaxTokens(level);
@@ -126,13 +125,13 @@ export function resolveMaxOutputTokens(
   return Math.min(findCatalogModel(meta.id)?.maxOutputTokens ?? cap, cap);
 }
 
-/** Map the thinking level to an OpenAI reasoning-effort tier. minimal/low/medium/high pass
+/** Map the thinking level to an OpenAI reasoning-effort tier. low/medium/high pass
  *  through unchanged and xhigh folds to high (the deepest tier the provider APIs accept), so
- *  reasoning works at EVERY thinking level (gajae parity: minimal is a real effort). Only an
- *  unset level returns undefined (reasoning off — the explicit /fast path). */
+ *  reasoning works at EVERY thinking level (gajae parity). Only an unset level returns
+ *  undefined (reasoning off — the explicit /fast path). */
 export function thinkingToReasoningEffort(
-  level?: "minimal" | "low" | "medium" | "high" | "xhigh",
-): "minimal" | "low" | "medium" | "high" | undefined {
+  level?: "low" | "medium" | "high" | "xhigh",
+): "low" | "medium" | "high" | undefined {
   if (!level) return undefined;
   return level === "xhigh" ? "high" : level;
 }
@@ -450,13 +449,18 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
  *  streaming idle watchdog, this path collects an opaque buffered body (`response.json()`,
  *  or an internally-streamed collect in codexResponsesCall / antigravity.call) and exposes
  *  no per-chunk signal — so a wall clock is the only lever and a wire heartbeat cannot help.
- *  Raised to 300s to match STREAM_IDLE_TIMEOUT_MS: non-interactive turns (callLlm WITHOUT
- *  onToken — compaction, ralplan, deep-interview, memory distill, goal-verify, and subagent/
- *  autopilot engine steps) route here, and a long reasoning completion legitimately exceeds
- *  120s; too-tight, it aborts an alive call, retries re-incur the same slow request, the
- *  attempt budget exhausts, and the turn STOPS — the same false-failure the streaming
- *  watchdog guards, on the path the wire heartbeat never reaches. */
-const DEFAULT_CALL_TIMEOUT_MS = 300_000;
+ *  Raised 120s → 300s → 30min across two rounds of the SAME false-failure: non-interactive
+ *  turns (callLlm WITHOUT onToken — compaction, ralplan, deep-interview, memory distill,
+ *  goal-verify, and subagent/autopilot engine steps) route here, and a HIGH/XHIGH reasoning
+ *  effort completion (GPT-5.5/o3-class) legitimately exceeds 300s — OpenAI's own guidance is
+ *  that xhigh trades latency for depth deliberately. Too-tight, it aborts an alive call, the
+ *  attempt budget exhausts, and the turn STOPS — exactly the false-failure the streaming
+ *  watchdog guards, on the path the wire heartbeat never reaches. 30min matches both
+ *  `turnMaxMs()`'s own vetted stall-budget default AND the OBSERVED ~20-30min infra-side
+ *  connection-duration cap on OpenAI's Codex/ChatGPT backend (see socket-closed handling
+ *  above) — genuinely dead connections still fail fast via TCP/TLS errors well before this;
+ *  this wall clock exists only for the "server accepted the request and went silent" case. */
+const DEFAULT_CALL_TIMEOUT_MS = 30 * 60_000;
 
 /** Per-chunk idle cap for streaming: a stream that emits NOTHING for this long is
  *  aborted, but a healthy long generation (chunks keep arriving) runs unbounded —
@@ -472,25 +476,12 @@ const DEFAULT_CALL_TIMEOUT_MS = 300_000;
  *  phase runs longer still; Ctrl-C remains the interactive escape for a truly dead one. */
 const STREAM_IDLE_TIMEOUT_MS = 300_000;
 
-/** Combine two abort signals into one. Preserves BOTH even when `AbortSignal.any`
- *  is unavailable (manual fallback), so neither the caller's cancel nor the timeout
- *  is silently dropped. */
+/** Combine two abort signals into one — neither the caller's cancel nor the timeout
+ *  is ever silently dropped. `AbortSignal.any` is native on every Bun this CLI runs on
+ *  (shipped in Bun 1.1.13; `src/cli.ts` hard-enforces `engines.bun: ">=1.3.14"` at
+ *  process start, so a manual polyfill fallback would be permanently unreachable). */
 function composeAbort(a: AbortSignal | undefined, b: AbortSignal): AbortSignal {
-  if (!a) return b;
-  if (typeof AbortSignal.any === "function") return AbortSignal.any([a, b]);
-  if (a.aborted || b.aborted) return AbortSignal.abort();
-  const ctrl = new AbortController();
-  // Memory hygiene: `a` is typically the TURN-long abort signal — a once-listener
-  // per model call would otherwise accumulate on it for the whole turn. Detach
-  // BOTH listeners as soon as either side fires.
-  const onAbort = () => {
-    a.removeEventListener("abort", onAbort);
-    b.removeEventListener("abort", onAbort);
-    ctrl.abort();
-  };
-  a.addEventListener("abort", onAbort, { once: true });
-  b.addEventListener("abort", onAbort, { once: true });
-  return ctrl.signal;
+  return a ? AbortSignal.any([a, b]) : b;
 }
 
 /** Compose the caller's signal (if any) with a fresh per-attempt timeout. */
@@ -577,13 +568,17 @@ async function nextMaybeIdle(iter: AsyncIterator<string>, watchdog?: Promise<nev
 }
 
 /** Overall stream wall-clock from the environment. Defaults to the same hard bound as
- *  callTimeoutMs() (DEFAULT_CALL_TIMEOUT_MS) so the streaming path has parity with the
- *  non-streaming call()/fallback path — a stream that stays connected and keeps emitting
- *  SOMETHING (SSE keepalives, reasoning deltas) re-arms the per-chunk idle watchdog
- *  forever and would otherwise never resolve or reject. JEO_STREAM_MAX_MS explicitly set
- *  to a positive number overrides the default; explicitly set to 0 disables the overall
- *  deadline entirely (mirrors JEO_TURN_MAX_MS's own 0-disables convention) for advanced
- *  users with genuinely long-running legitimate reasoning models. */
+ *  callTimeoutMs() (DEFAULT_CALL_TIMEOUT_MS, 30min) so the streaming path has parity with
+ *  the non-streaming call()/fallback path — a stream that stays connected and keeps
+ *  emitting SOMETHING (SSE keepalives, reasoning deltas) re-arms the per-chunk idle
+ *  watchdog forever and would otherwise never resolve or reject. Bug fix: this previously
+ *  defaulted to 300s (DEFAULT_CALL_TIMEOUT_MS's OLD value, before it too was raised) —
+ *  that false-failed any HIGH/XHIGH-reasoning-effort model (GPT-5.5/o3-class) whose
+ *  ACTIVELY-emitting completion legitimately ran past 5 minutes, killing a healthy
+ *  generation with "stream exceeded the overall deadline" despite continuous activity.
+ *  JEO_STREAM_MAX_MS explicitly set to a positive number overrides the default; explicitly
+ *  set to 0 disables the overall deadline entirely (mirrors JEO_TURN_MAX_MS's own
+ *  0-disables convention) for advanced users with genuinely long-running reasoning models. */
 export function streamMaxMs(env?: Record<string, string | undefined>): number | undefined {
   const raw = jeoEnv("STREAM_MAX_MS", env);
   if (raw === undefined || raw === "") return DEFAULT_CALL_TIMEOUT_MS;

package/src/ai/providers/anthropic.ts

@@ -99,14 +99,13 @@ function anthropicSystemBlocks(
 }
 
 /** Anthropic extended-thinking budget by reasoning effort (kept under max_tokens). Tiers match
- *  gjc's ANTHROPIC_THINKING table: minimal/low/medium/high ALL enable thinking with scaling
- *  depth — reasoning works at every thinking level (gajae parity: Minimal is a real effort).
+ *  gjc's ANTHROPIC_THINKING table: low/medium/high ALL enable thinking with scaling
+ *  depth — reasoning works at every thinking level (gajae parity).
  *  Only an UNSET effort stays non-thinking (the explicit /fast off path). The "xhigh" row is
  *  correct-by-table even though upstream currently folds xhigh→high before it arrives. */
 function anthropicThinkingBudget(effort: CallOptions["reasoningEffort"] | "xhigh", maxTokens: number): number | undefined {
   let budget: number;
   switch (effort) {
-    case "minimal": budget = 1024; break;
     case "low": budget = 4096; break;
     case "medium": budget = 8192; break;
     case "high": budget = 16384; break;
@@ -161,10 +160,9 @@ function anthropicThinkingMode(model: string): AnthropicThinkingMode {
 }
 
 /** Map jeo's reasoning effort to Anthropic's adaptive/output_config effort literal. jeo folds
- *  xhigh→high upstream, so only minimal/low/medium/high arrive here. (gjc: mapEffortToAnthropicAdaptiveEffort) */
+ *  xhigh→high upstream, so only low/medium/high arrive here. (gjc: mapEffortToAnthropicAdaptiveEffort) */
 function anthropicAdaptiveEffort(effort: NonNullable<CallOptions["reasoningEffort"]>): "low" | "medium" | "high" {
   switch (effort) {
-    case "minimal":
     case "low": return "low";
     case "medium": return "medium";
     case "high": return "high";

package/src/ai/providers/antigravity.ts

@@ -14,11 +14,10 @@ const ANTIGRAVITY_SANDBOX_ENDPOINT = "https://daily-cloudcode-pa.sandbox.googlea
 /** Anthropic-style thinking budget for Claude served via CCA. gemini's budget fn
  *  returns undefined for claude ids, which left antigravity Claude with NO thinking
  *  requested (the opus "no reasoning" gap). Mirrors anthropic's effort→budget tiers —
- *  minimal/low/medium/high ALL think (gajae parity: reasoning at every level); only an
+ *  low/medium/high ALL think (gajae parity: reasoning at every level); only an
  *  UNSET effort stays non-thinking. */
 function antigravityClaudeThinkingBudget(effort: CallOptions["reasoningEffort"]): number | undefined {
   switch (effort) {
-    case "minimal": return 2000;
     case "low": return 4000;
     case "medium": return 10000;
     case "high": return 24000;

package/src/ai/providers/gemini.ts

@@ -26,11 +26,10 @@ export function geminiThinkingBudget(model: string, effort?: CallOptions["reason
   const effectiveEffort = effort ?? geminiNamedEffort(m);
   let budget: number;
   switch (effectiveEffort) {
-    // minimal/low/medium/high ALL enable thinking with scaling depth — reasoning works at
-    // every thinking level (gajae parity: Minimal is a real effort). Only an UNSET effort
+    // low/medium/high ALL enable thinking with scaling depth — reasoning works at
+    // every thinking level (gajae parity). Only an UNSET effort
     // (and no in-name depth marker) falls through to the floor.
     // Tier values mirror gjc's GOOGLE_THINKING table (stream.ts).
-    case "minimal": budget = Math.max(floor, 1024); break;
     case "low": budget = 4096; break;
     case "medium": budget = 8192; break;
     case "high": budget = 16384; break;
@@ -63,10 +62,9 @@ export function geminiUsesThinkingLevel(model: string): boolean {
 }
 
 /** Effort → Google `thinkingLevel` enum value (gjc mapEffortToGoogleThinkingLevel):
- *  minimal→MINIMAL, low→LOW, medium→MEDIUM, high/xhigh→HIGH. */
-export function geminiThinkingLevel(effort: NonNullable<CallOptions["reasoningEffort"]> | "xhigh"): "MINIMAL" | "LOW" | "MEDIUM" | "HIGH" {
+ *  low→LOW, medium→MEDIUM, high/xhigh→HIGH. */
+export function geminiThinkingLevel(effort: NonNullable<CallOptions["reasoningEffort"]> | "xhigh"): "LOW" | "MEDIUM" | "HIGH" {
   switch (effort) {
-    case "minimal": return "MINIMAL";
     case "low": return "LOW";
     case "medium": return "MEDIUM";
     case "high":
@@ -80,7 +78,7 @@ export function geminiThinkingLevel(effort: NonNullable<CallOptions["reasoningEf
  *  omitted so the model keeps its default (gjc parity: thinking not enabled → no config).
  *  Other thinking-capable models → numeric thinkingBudget; pre-2.5 → undefined. */
 export type GeminiThinkingConfig =
-  | { includeThoughts: true; thinkingLevel: "MINIMAL" | "LOW" | "MEDIUM" | "HIGH" }
+  | { includeThoughts: true; thinkingLevel: "LOW" | "MEDIUM" | "HIGH" }
   | { includeThoughts: true; thinkingBudget: number };
 
 export function geminiThinkingConfig(model: string, effort?: CallOptions["reasoningEffort"], maxTokens?: number): GeminiThinkingConfig | undefined {

package/src/ai/providers/openai-responses.ts

@@ -21,7 +21,7 @@ import pkg from "../../../package.json";
 
 export const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 
-export const VALID_REASONING_EFFORTS = new Set(["minimal", "low", "medium", "high"]);
+export const VALID_REASONING_EFFORTS = new Set(["low", "medium", "high"]);
 
 const CODEX_ORIGINATOR = "codex_cli_rs";
 

package/src/ai/types.ts

@@ -107,7 +107,7 @@ export interface CallOptions {
   /** Abort in-flight provider requests (Ctrl-C / timeout / supersede). */
   signal?: AbortSignal;
   /** Reasoning effort for reasoning models (o-series / gpt-5), mapped from thinkingLevel. */
-  reasoningEffort?: "minimal" | "low" | "medium" | "high";
+  reasoningEffort?: "low" | "medium" | "high";
   /** How an OpenAI-compatible backend enables/streams native reasoning (gjc parity):
    *  "openai" → `reasoning_effort`; "openrouter" → `reasoning: {effort}`; "qwen" →
    *  `enable_thinking: true`; "zai" → `thinking: {type:"enabled"}`. Set per provider by

package/src/cli/runner.ts

@@ -331,7 +331,7 @@ export function renderHelp(ctx: DispatchContext): string {
   lines.push("      --model <id>             Use a session model for launch/one-shot.");
   lines.push("      --provider <name>        Start launch on a provider default (anthropic/openai/gemini/antigravity/ollama).");
   lines.push("      --smol|--slow|--plan     Start launch with the configured model role tier.");
-  lines.push("      --thinking <level>       Set thinking budget (minimal/low/medium/high/xhigh).");
+  lines.push("      --thinking <level>       Set thinking budget (low/medium/high/xhigh).");
   lines.push("");
   return lines.join("\n");
 }

package/src/commands/chat.ts

@@ -46,8 +46,8 @@ export async function runChatCommand(args: string[] = []): Promise<void> {
   let any = false;
   let usage: { inputTokens?: number; outputTokens?: number; durationMs?: number } | undefined;
   try {
-    const effort = (thinking === "xhigh" ? "high" : thinking) as "minimal" | "low" | "medium" | "high" | undefined;
-    const maxTokens = explicitMaxTokens ?? (thinking ? thinkingMaxTokens(thinking as "minimal" | "low" | "medium" | "high" | "xhigh") : undefined);
+    const effort = (thinking === "xhigh" ? "high" : thinking) as "low" | "medium" | "high" | undefined;
+    const maxTokens = explicitMaxTokens ?? (thinking ? thinkingMaxTokens(thinking as "low" | "medium" | "high" | "xhigh") : undefined);
     for await (const chunk of manager.stream([{ role: "user", content: message }], { model, maxTokens, reasoningEffort: effort, onUsage: u => { usage = u; } })) {
       process.stdout.write(chunk);
       any = true;

package/src/commands/doctor.ts

@@ -1,6 +1,7 @@
 import { readGlobalConfig } from "../agent/state";
 import { resolveCredential, snapshotProvider, type AuthProvider, type Credential } from "../auth";
-import { resolveProvider } from "../ai";
+import { resolveProvider, describeProvider } from "../ai";
+
 import { effectiveCredentialForProvider } from "../ai/model-manager";
 import { resolveModelId } from "../ai/model-registry";
 import { meter } from "../tui/components/meter";
@@ -179,9 +180,37 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
   // turn.
   const routingEnabled = !!config.routing?.enabled;
   const smolConfigured = !!config.roles?.smol;
-  const routingNote = routingEnabled && !smolConfigured
-    ? "routing is enabled but roles.smol is unset — LLM escalation for ambiguous prompts will never fire; heuristic-only tier resolution applies every turn. Set roles.smol to enable escalation."
-    : undefined;
+  const routingNotes: string[] = [];
+  if (routingEnabled && !smolConfigured) {
+    routingNotes.push(
+      "routing is enabled but roles.smol is unset — LLM escalation for ambiguous prompts will never fire; heuristic-only tier resolution applies every turn. Set roles.smol to enable escalation.",
+    );
+  }
+  // Proactive credential-readiness check for every model routing could actually pick —
+  // mirrors launch.ts's runTurn per-turn veto gate (v0.7.51) but surfaced at onboarding/
+  // doctor time instead of only reactively on a session's first qualifying turn. Catches
+  // `roles.smol`/`roles.slow`/`routing.tiers.*.model` pointed at a provider the user never
+  // logged into (or whose credential was since removed). `standard` only checked when
+  // explicitly configured — its unconfigured fallback is `defaultModel`, already covered
+  // by the provider-connectivity probes above.
+  if (routingEnabled) {
+    const tierCandidates: { tier: string; model: string | undefined }[] = [
+      { tier: "trivial", model: config.routing?.tiers?.trivial?.model || config.roles?.smol },
+      { tier: "standard", model: config.routing?.tiers?.standard?.model },
+      { tier: "complex", model: config.routing?.tiers?.complex?.model || config.roles?.slow },
+    ];
+    for (const { tier, model } of tierCandidates) {
+      if (!model) continue;
+      const provider = resolveProvider(model);
+      const status = await describeProvider(provider, config);
+      if (!status.ready) {
+        routingNotes.push(
+          `routing.tiers.${tier} resolves to '${model}' (${provider}) which has no usable credential — run 'jeo auth login ${provider}' or reconfigure that tier/role for a provider you're logged into.`,
+        );
+      }
+    }
+  }
+
 
   // --- Gather (probes run concurrently → ~1× the slowest timeout, not N×) ---
   const probes: { name: string; credKind: string; result: ProbeResult }[] = [];
@@ -248,7 +277,8 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
       })),
       oauth: oauthHealth,
       ready,
-      ...(routingEnabled ? { routing: { enabled: true, smolConfigured, ...(routingNote ? { note: routingNote } : {}) } } : {}),
+      ...(routingEnabled ? { routing: { enabled: true, smolConfigured, ...(routingNotes.length ? { notes: routingNotes } : {}) } } : {}),
+
     };
     console.log(JSON.stringify(report, null, 2));
     if (strict && !ready) process.exit(1);
@@ -292,11 +322,12 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
   }
   // Routing diagnostic: informational only — never affects ready/strict exit logic.
   if (routingEnabled) {
-    if (routingNote) {
-      console.log(`${chalk.yellow("[routing]")} ${routingNote}`);
+    if (routingNotes.length) {
+      for (const note of routingNotes) console.log(`${chalk.yellow("[routing]")} ${note}`);
     } else {
       console.log(`${chalk.green("[routing]")} enabled, roles.smol configured — LLM escalation available on ambiguous prompts.`);
     }
+
     console.log("");
   }
 

package/src/commands/launch/agents-slash.ts

@@ -478,12 +478,12 @@ export async function runThinkingSlash(input: string, ctx: AgentsSlashCtx): Prom
     console.log(`Thinking level: ${sessionThinking ?? "medium"} (~${thinkingMaxTokens(sessionThinking)} max tokens/step)`);
     return result();
   }
-  if (arg === "minimal" || arg === "low" || arg === "medium" || arg === "high" || arg === "xhigh") {
+  if (arg === "low" || arg === "medium" || arg === "high" || arg === "xhigh") {
     sessionThinking = arg;
     sessionThinkingChanged = true;
     console.log(`Thinking set to ${arg} (~${thinkingMaxTokens(arg)} max tokens/step)`);
   } else {
-    console.log(`Invalid level '${arg}'. Use: minimal | low | medium | high | xhigh.`);
+    console.log(`Invalid level '${arg}'. Use: low | medium | high | xhigh.`);
   }
   return result();
 }

package/src/commands/launch/flags.ts

@@ -49,19 +49,18 @@ export function isProviderName(input: string | undefined): input is ProviderName
 }
 
 export function isThinkingLevel(input: string | undefined): input is ThinkLevel {
-  return input === "minimal" || input === "low" || input === "medium" || input === "high" || input === "xhigh";
+  return input === "low" || input === "medium" || input === "high" || input === "xhigh";
 }
 
 
 export function fastThinkingLevelForModel(modelId: string): ThinkLevel | undefined {
   const supported = catalogMetadata(modelId)?.thinking ?? [];
-  if (supported.includes("minimal")) return "minimal";
   if (supported.includes("low")) return "low";
   // Digit-count agnostic (gemini-10+ / 2.6+ stay reasoning) — mirrors the gates in
   // gemini.ts and inferCatalogMetadata. Last resort for prefixed ids (models/gemini-…)
   // the catalog lookup above misses; catalogued ids already returned via thinking caps.
   const g = modelId.toLowerCase().match(/gemini-(\d+)(?:\.(\d+))?/);
-  if (g && (Number(g[1]) >= 3 || (Number(g[1]) === 2 && Number(g[2] ?? 0) >= 5))) return "minimal";
+  if (g && (Number(g[1]) >= 3 || (Number(g[1]) === 2 && Number(g[2] ?? 0) >= 5))) return "low";
   return undefined;
 }
 
@@ -114,7 +113,7 @@ export function parseFlags(args: string[], cwd: string = process.cwd()): LaunchF
       const { value, nextIndex } = takeValue(args, i, "--thinking=");
       const normalized = value?.toLowerCase();
       if (isThinkingLevel(normalized)) flags.thinking = normalized;
-      else flags.errors.push("--thinking must be one of: minimal, low, medium, high, xhigh");
+      else flags.errors.push("--thinking must be one of: low, medium, high, xhigh");
       i = nextIndex;
     } else if (a === "--smol" || a === "--slow" || a === "--plan") {
       flags.modelRole = a.slice(2) as ModelRole;

package/src/commands/launch/model-slash.ts

@@ -124,7 +124,7 @@ export async function runModelSlash(input: string, ctx: ModelSlashCtx): Promise<
   if (modelThinking) {
     const level = (modelThinking[1] ?? "").toLowerCase();
     if (!isThinkingLevel(level)) {
-      console.log("Usage: /model thinking <minimal|low|medium|high|xhigh>");
+      console.log("Usage: /model thinking <low|medium|high|xhigh>");
       return result();
     }
     sessionThinking = level;

package/src/commands/launch/stream.ts

@@ -53,11 +53,18 @@ export function formatTaskSubEvent(e: TaskSubEvent): string {
   if (e.kind === "step") return `  ${badge} ${chalk.cyan(`├─ ${roleLabel}`)} · ${detail || "working"}`;
   if (e.kind === "tool") return `  ${badge} ${e.success === false ? chalk.red("├─") : chalk.green("├─")} ${roleLabel} ${e.success === false ? chalk.red("✗") : chalk.green("✓")} ${detail || "tool"}${summary}`;
   if (e.kind === "error") return `  ${badge} ${chalk.red("├─")} ${roleLabel} ${chalk.red("✗")} ${detail || "error"}`;
+  // "thinking" is a live-only TUI preview (never persisted to the ledger — see
+  // TaskSubEvent.kind's doc comment) and has no place in an append-only, non-TTY
+  // log stream: a reasoning delta stream would otherwise fall through to the
+  // "done" branch below and print a bogus "ROLE done: <reasoning text>" line for
+  // every emitted preview. Empty string signals the caller to skip the line.
+  if (e.kind === "thinking") return "";
   return `${badge} ${e.success === false ? chalk.red("└─") : chalk.green("└─")} ${roleLabel} done${tokTag}${e.success === false ? " (incomplete)" : ""}${detail ? `: ${detail}` : ""}`;
 }
 
 export function logTaskSubEvent(e: TaskSubEvent, log: (line: string) => void = (s: string) => console.log(s)): void {
-  log(formatTaskSubEvent(e));
+  const line = formatTaskSubEvent(e);
+  if (line) log(line);
 }
 
 export function createStreamEvents(

package/src/commands/launch.ts

@@ -648,7 +648,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   };
   let sessionModel: string | undefined = initialSessionModel;
   // Session thinking-level override (`/thinking`); falls back to the config level.
-  let sessionThinking: "minimal" | "low" | "medium" | "high" | "xhigh" | undefined = flags.thinking ?? cfg.thinkingLevel;
+  let sessionThinking: "low" | "medium" | "high" | "xhigh" | undefined = flags.thinking ?? cfg.thinkingLevel;
   // PromptRouter session override: undefined = follow config.routing.enabled, true/false = /route on|off wins this session.
   let sessionRouteOverride: boolean | undefined;
   // Last routing decision (or the reason none applied) — /route why reads this.
@@ -937,7 +937,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // config file. (gjc parity P1.B5: dirty count per-turn, not per-render.)
     const { provider: activeProvider } = await describeModel(activeModel, turnConfig);
     const turnDirtyCount = branch ? gitDirtyCount(cwd) : undefined;
-    const tui = useTui ? new LaunchTui({ model: activeModel, provider: activeProvider, sessionId, maxSteps: initialStepLimit, cwd, branch, dirtyCount: turnDirtyCount, thinking: activeThinking }) : null;
+    const tui = useTui ? new LaunchTui({ model: activeModel, provider: activeProvider, sessionId, maxSteps: initialStepLimit, cwd, branch, dirtyCount: turnDirtyCount, thinking: activeThinking, routedTier: routed?.tier }) : null;
     if (routeCredentialNotice) {
       if (tui) tui.events().onNotice?.(routeCredentialNotice);
       else console.log(routeCredentialNotice);
@@ -2832,7 +2832,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   ): Promise<ThinkLevel | "inherit" | undefined> => {
     const levels = buildThinkingLevelChoices(current, {
       inheritLabel,
-      tokenHint: lvl => (lvl === "minimal" ? undefined : `~${Math.round(thinkingMaxTokens(lvl as ThinkLevel) / 1000)}k tokens`),
+      tokenHint: lvl => `~${Math.round(thinkingMaxTokens(lvl as ThinkLevel) / 1000)}k tokens`,
     });
     const picked = await pickFromOptions(title, levels);
     return picked === "inherit" || isThinkingLevel(picked) ? picked : undefined;
@@ -2849,7 +2849,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       return true;
     }
     if (!isThinkingLevel(level)) {
-      console.log(`Usage: /model subagent ${role.id} thinking <inherit|minimal|low|medium|high|xhigh>`);
+      console.log(`Usage: /model subagent ${role.id} thinking <inherit|low|medium|high|xhigh>`);
       return true;
     }
     await saveConfigPatch(raw => ({ subagents: withSubagentSetting(raw, role.id, { thinking: level }) }));

package/src/tui/app.ts

@@ -68,6 +68,12 @@ export interface LaunchTuiOptions {
   dirtyCount?: number;
   /** Thinking-level label ("high", …) for the gjc-style model status bar. */
   thinking?: string;
+  /** PromptRouter's resolved tier when routing chose THIS turn's `model` (undefined
+   *  when routing didn't engage — pinned model, routing off, or the credential
+   *  gate fell back). Renders a persistent `⚡tier` marker in the status bar so the
+   *  routed model stays visible without depending on the transient `[route]`
+   *  console notice. See `StatusBarData.routedTier` in components/status.ts. */
+  routedTier?: "trivial" | "standard" | "complex";
 }
 
 export interface AgentEventsLike {
@@ -361,6 +367,9 @@ export class LaunchTui {
   private readonly inline: boolean;
   // Thinking-level label for the gjc-style model status bar.
   private readonly thinkingLevel?: string;
+  // PromptRouter's resolved tier when routing chose this turn's model; undefined when
+  // routing didn't engage. Renders the persistent `⚡tier` marker in the status bar.
+  private readonly routedTier?: "trivial" | "standard" | "complex";
 
   constructor(opts: LaunchTuiOptions) {
     // Backpressure-aware wrapper around the underlying writer (real stdout, or the
@@ -383,6 +392,7 @@ export class LaunchTui {
     this.renderer = new Renderer(this.write, undefined, { reserve: this.inline });
     this.spinner = new Spinner(undefined, { unicode: this.unicode });
     this.thinkingLevel = opts.thinking;
+    this.routedTier = opts.routedTier;
     this.footer = {
       model: opts.model,
       provider: opts.provider,
@@ -1041,6 +1051,11 @@ export class LaunchTui {
         touchSlot(`${roleLabel} ${bad} ${detail || "error"}`);
         this.appendLedger(`  ${badge} ${branch} ${roleLabel} ${bad} ${detail || "error"}\n`, "subagent");
         break;
+      case "thinking":
+        // Live-only preview (mirrors the main turn's dimmed "Thinking" block) — never
+        // persisted to the ledger; see TaskSubEvent.kind's doc comment for why.
+        touchSlot(`${roleLabel} ${this.unicode ? "…" : "..."} ${detail || "thinking"}`);
+        break;
       case "done":
         // Clear ONLY this slot — a fan-out batch where one worker finishes early
         // must keep showing its still-running siblings, not drop the `(sub)`
@@ -1632,6 +1647,7 @@ export class LaunchTui {
     return renderStatusBar({
       model: `${this.footer.model}${this.footer.provider ? ` (${this.footer.provider})` : ""}`,
       thinking: this.thinkingLevel,
+      routedTier: this.routedTier,
       branch: this.footer.branch,
       dirtyCount: this.footer.dirtyCount,
       cwd: this.footer.cwd,

package/src/tui/components/autocomplete.ts

@@ -6,7 +6,7 @@
  *  - `/model gpt`      → live (logged-in) model ids + aliases + catalog ids
  *  - `/provider an`    → provider names; second arg → that provider's live models
  *  - `/agents exec`    → subagent role ids; second arg → live model ids
- *  - `/thinking h`     → minimal/low/medium/high/xhigh
+ *  - `/thinking h`     → low/medium/high/xhigh
  *
  * Pure + synchronous: the dynamic data (live models from the OAuth-authenticated
  * accounts, alias snapshot) is passed in via `CompletionContext`, so the readline
@@ -59,7 +59,7 @@ const PREVIEW_LABEL: Record<string, string> = {
   path: "Paths",
 };
 const MAX_COMPLETIONS = 50;
-const THINKING_LEVELS = ["minimal", "low", "medium", "high", "xhigh"];
+const THINKING_LEVELS = ["low", "medium", "high", "xhigh"];
 
 /** Static half of a completion context (no network/config needed). */
 export function staticCompletionContext(): Omit<CompletionContext, "liveModels" | "aliases" | "modelsForProvider"> {

package/src/tui/components/live-model-picker.ts

@@ -107,11 +107,10 @@ export function renderLiveModelPicker(list: SelectList<PickEntry>, opts: RenderS
   return renderSelectList(list, { title: "Select a live model", rows: 12, showTabs: true, ...opts });
 }
 
-/** The five reasoning levels in display order, lightest → heaviest. */
-export const THINKING_LEVEL_ORDER = ["minimal", "low", "medium", "high", "xhigh"] as const;
+/** The four reasoning levels in display order, lightest → heaviest. */
+export const THINKING_LEVEL_ORDER = ["low", "medium", "high", "xhigh"] as const;
 
 const THINKING_LEVEL_DESCRIPTION: Record<string, string> = {
-  minimal: "lightest reasoning",
   low: "light reasoning",
   medium: "moderate reasoning",
   high: "deep reasoning",

package/src/tui/components/slash.ts

@@ -42,7 +42,7 @@ export const SLASH_COMMAND_DETAILS: readonly SlashCommandInfo[] = [
   { command: "/login", usage: "/login [provider]", description: "OAuth login — opens a provider picker showing live login status (account · expiry) for each provider (alias of /provider login)", group: "models" },
   { command: "/logout", usage: "/logout <anthropic|openai|gemini|antigravity>", description: "Remove the stored OAuth token for a provider", group: "models" },
   { command: "/roles", usage: "/roles [tier model]", description: "Show or set model role tiers (smol/slow/plan)", group: "models" },
-  { command: "/thinking", usage: "/thinking [level]", description: "Show or set thinking budget (minimal/low/medium/high/xhigh)", group: "models" },
+  { command: "/thinking", usage: "/thinking [level]", description: "Show or set thinking budget (low/medium/high/xhigh)", group: "models" },
   { command: "/route", usage: "/route [on|off|why]", description: "Show/toggle prompt-based model routing for this session, or explain the last routing decision", group: "models" },
   { command: "/agents", usage: "/agents [edit|role] [model|#N|thinking L|maxSteps N|reset]", description: "List subagent roles; use /agents edit for the interactive picker or pin role model/settings", group: "subagents" },
   { command: "/subagent", usage: "/subagent [role]", description: "Show the current subagent composition (per-role model · thinking · steps); alias of /agents", group: "subagents" },

package/src/tui/components/status.ts

@@ -17,6 +17,14 @@ export interface StatusBarData {
   model: string;
   /** Thinking level label ("high", …); omitted when unset. */
   thinking?: string;
+  /** PromptRouter's resolved tier ("trivial"/"standard"/"complex") when THIS turn's
+   *  model was chosen by routing rather than the session/default model directly —
+   *  omitted when routing didn't engage this turn (pinned model, routing off, or
+   *  the credential-readiness gate fell back). Renders as a persistent `⚡tier`
+   *  marker so the routed model stays visible without depending on the transient
+   *  `[route] …` console notice, which intentionally stays silent for routine
+   *  unescalated `standard`-tier turns. */
+  routedTier?: "trivial" | "standard" | "complex";
   branch?: string;
   /** Uncommitted-change count for the `?N` dirty flag; omit/0 = clean. */
   dirtyCount?: number;
@@ -81,6 +89,7 @@ export function renderStatusBar(d: StatusBarData): string {
   // Left identity segment (plain text; painted as one bg block at the end).
   const bits: string[] = [];
   let modelBit = `${unicode ? "⬢" : "*"} ${d.model}`;
+  if (d.routedTier) modelBit += ` ${unicode ? "⚡" : "~"}${d.routedTier}`;
   if (d.thinking) modelBit += ` · ${unicode ? "◔" : "@"} ${d.thinking}`;
   bits.push(modelBit);
   if (d.branch) {

package/src/util/provider-error.ts

@@ -57,6 +57,12 @@ export function friendlyProviderError(err: unknown): string {
   if (status === 401 || status === 403 || /\b40[13]\b/.test(msg)) {
     return `${provider} rejected the credential (HTTP ${status ?? "401/403"}). Run 'jeo auth status', re-login with /provider login <name>, and for Antigravity prefer '/provider login antigravity' (gemini login only works when the Cloud Code Assist backend authorizes that token).`;
   }
+  if ((err as { name?: string })?.name === "TimeoutError" || /the operation timed out/i.test(msg)) {
+    return `${provider} did not complete the request within the call timeout (default 30min). This is expected for a HIGH/XHIGH-reasoning-effort completion that legitimately runs long on a hard problem — raise JEO_CALL_TIMEOUT_MS (ms) if this recurs, or lower the thinking level with /model.`;
+  }
+  if (/exceeded the overall deadline \(JEO_STREAM_MAX_MS\)/i.test(msg)) {
+    return `${provider}'s stream hit the overall deadline (default 30min; JEO_STREAM_MAX_MS) despite staying active. Raise JEO_STREAM_MAX_MS (ms), set it to 0 to disable the overall cap, or lower the thinking level with /model.`;
+  }
   if (isContextOverflowError(err)) {
     return `${provider} rejected the request: the conversation no longer fits the model's context window. Run /compact, drop large attachments, or start a fresh session.`;
   }