jeo-code 0.7.52 → 0.7.54

package/CHANGELOG.md

@@ -6,6 +6,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.54] - 2026-07-06
+_Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead._
+
+### Fixed
+- **`streamMaxMs()`/`callTimeoutMs()` shared default raised 300s → 30min** (`src/ai/model-manager.ts`'s `DEFAULT_CALL_TIMEOUT_MS`) — rather than reverting to opt-in-off (which would reopen a real gap for direct non-turn-wrapped callers like `jeo chat`, since `JEO_TURN_MAX_MS`'s turn-level stall-budget backstop only wraps `runAgentLoop` steps), the shared ceiling now matches `turnMaxMs()`'s own already-vetted 30min default AND the OBSERVED ~20-30min infra-side connection-duration cap on OpenAI's Codex/ChatGPT backend (a real boundary already handled elsewhere in this file as a retryable mid-stream socket close) — a real, evidenced ceiling, not an arbitrary pick. `JEO_STREAM_MAX_MS`/`JEO_CALL_TIMEOUT_MS` env overrides (including `0` to disable the overall stream deadline) are unchanged. The per-chunk idle watchdog (`JEO_STREAM_IDLE_MS`, still 300s) is untouched — this fix only raises the OVERALL ceiling that fires despite continuous activity, not the dead-stream detector.
+- **`friendlyProviderError` now names the exact env var to raise** for both failure surfaces instead of a bare timeout string — a non-streaming `TimeoutError`/`"the operation timed out"` DOMException points at `JEO_CALL_TIMEOUT_MS`, and the stream overall-deadline message points at `JEO_STREAM_MAX_MS` (mentioning `0` disables it), both noting this is expected behavior for a deliberately long HIGH/XHIGH reasoning completion rather than an opaque failure.
+
+### Verified
+- `bun run typecheck` clean; targeted suite (`round-b`, `provider-error`, `provider-error-taxonomy`, `cycle-and-turn-budget`, `retry`, `engine`, `transient-network-recovery`, `refusal-recovery`) 119/119 pass; full suite 2665/2665 pass across 280 files.
+- `test/round-b.test.ts`: new regression test proves an ACTIVELY-emitting stream running past the OLD 300s threshold completes normally instead of being force-aborted (compressed-timescale reproduction of the exact reported failure mode); `streamMaxMs`/`callTimeoutMs` default-value tests updated to the new 30min figure; existing keepalive-forever-stream and healthy-stream tests re-confirmed unaffected.
+- `test/provider-error.test.ts` (+2): a bare `TimeoutError` DOMException maps to `JEO_CALL_TIMEOUT_MS` guidance (raw DOMException text replaced); the stream overall-deadline message maps to `JEO_STREAM_MAX_MS` guidance including the disable-via-0 hint.
+- `docs/deep-dive-stream-idle.md` gained a follow-up section documenting this regression's exact causal chain against the original (now partially superseded) investigation, so the "why not an overall cap" reasoning that got silently reversed in v0.7.42 stays discoverable.
+
+## [0.7.53] - 2026-07-06
+_Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time._
+
+### Added
+- **`jeo doctor` proactive routing-credential diagnostic** (`src/commands/doctor.ts`) — for every tier PromptRouter could actually route to (`routing.tiers.trivial.model` or `roles.smol`, `routing.tiers.standard.model` when explicitly set, `routing.tiers.complex.model` or `roles.slow`), doctor now resolves the model's provider and checks credential readiness with the SAME `describeProvider` call `launch.ts`'s runtime gate uses — surfacing "routing.tiers.\<tier\> resolves to '\<model\>' (\<provider\>) which has no usable credential" at `jeo doctor` time instead of only reactively mid-session on the first qualifying turn. `standard` is only checked when explicitly configured, since its unconfigured fallback is `defaultModel`, already covered by the existing provider-connectivity probes.
+
+### Changed
+- **`jeo doctor --json`'s `routing` block: singular `note` → `notes` array** — the prior shape could only ever represent the one "roles.smol unconfigured" case; the new `notes: string[]` (omitted when empty, same as before) represents zero, one, or several simultaneous routing diagnostics (e.g. `roles.smol` set to an uncredentialed provider AND `routing.tiers.complex` also uncredentialed) without collapsing them into one string. Purely additive to `jeo doctor`'s informational output — never affects the `ready`/`--strict` exit code, matching the existing routing-diagnostic contract.
+
 ## [0.7.52] - 2026-07-06
 _Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code._
 

package/README.ja.md

@@ -78,8 +78,8 @@ jeo --tmux               # 独立した tmux セッションで実行
 | `/model` · `/provider` | モデル/プロバイダ選択; `/model` でデフォルト/ロールバッジ、Ralph 風の入れ子ロール・thinking 選択、OpenAI Codex ロールプリセットを一つの流れで設定 |
 | `/provider login <name>` · `/logout` | 入力欄から OAuth ログイン/ログアウト |
 | `/agents [role]` · `/subagent` | ロール別(executor/planner/architect/critic)モデル・thinking・ステップ設定 |
-| `/thinking [level]` | デフォルト推論予算(minimal…xhigh)の表示/設定 |
-| `/fast [on|off|status]` | 現在のモデルが minimal/low 推論をサポートする場合に fast thinking モードを切替 |
+| `/thinking [level]` | デフォルト推論予算(low…xhigh)の表示/設定 |
+| `/fast [on|off|status]` | 現在のモデルが low 推論をサポートする場合に fast thinking モードを切替 |
 | `/skill` · `$<skill> [intent]` | ワークフロースキルの一覧/実行(`$team "task"` 形式) |
 | `/view` · `/diff` · `/find` · `/search` | コード表示、git diff、ファイル/パターン検索 |
 | `/new` · `/resume` · `/sessions` | セッション管理 |
@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -79,8 +79,8 @@ jeo --tmux               # 독립 tmux 세션에서 실행
 | `/model` · `/provider` | 모델/프로바이더 선택; `/model`에서 기본/역할 배지, Ralph식 하위 리스트 역할·thinking 선택, OpenAI Codex 역할 프리셋을 한 흐름으로 설정 |
 | `/provider login <name>` · `/logout` | 입력창에서 OAuth 로그인/로그아웃 |
 | `/agents [role]` · `/subagent` | 역할별(executor/planner/architect/critic) 모델·thinking·스텝 구성 |
-| `/thinking [level]` | 기본 추론 예산(minimal…xhigh) 조회/설정 |
-| `/fast [on|off|status]` | 현재 모델이 minimal/low 추론을 지원하면 fast thinking 모드를 켜고 끔 |
+| `/thinking [level]` | 기본 추론 예산(low…xhigh) 조회/설정 |
+| `/fast [on|off|status]` | 현재 모델이 low 추론을 지원하면 fast thinking 모드를 켜고 끔 |
 | `/skill` · `$<skill> [intent]` | 워크플로 스킬 목록/실행(`$team "작업"` 스타일) |
 | `/view` · `/diff` · `/find` · `/search` | 코드 보기, git diff, 파일/패턴 검색 |
 | `/new` · `/resume` · `/sessions` | 세션 관리 |
@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -79,8 +79,8 @@ Inside the `jeo` REPL (Tab autocompletes; `/` opens the palette).
 | `/model` · `/provider` | Pick model/provider; `/model` shows default/role badges, Ralph-style nested Set-as-role thinking choices, and the OpenAI Codex role preset in one flow |
 | `/provider login <name>` · `/logout` | OAuth login/logout from the input box |
 | `/agents [role]` · `/subagent` | Per-role (executor/planner/architect/critic) model · thinking · step config |
-| `/thinking [level]` | Show/set default reasoning budget (minimal…xhigh) |
-| `/fast [on|off|status]` | Toggle fast thinking mode when the active model advertises minimal/low reasoning |
+| `/thinking [level]` | Show/set default reasoning budget (low…xhigh) |
+| `/fast [on|off|status]` | Toggle fast thinking mode when the active model advertises low reasoning |
 | `/skill` · `$<skill> [intent]` | List/run workflow skills (`$team "task"` style) |
 | `/view` · `/diff` · `/find` · `/search` | Code view, git diff, file/pattern search |
 | `/new` · `/resume` · `/sessions` | Session management |
@@ -214,8 +214,10 @@ JEO_TUI_THEME=cosmic            # cosmic/matrix/solar/red-claw/blue-crab/mono/au
 JEO_TUI_ALT_SCREEN=1            # legacy alt-screen turn (default: inline scrollback)
 JEO_STEP_BASE=24                # dynamic step budget: rolling base
 JEO_STEP_HARD_CAP=600           # absolute termination guarantee
-JEO_STREAM_MAX_MS=300000        # opt-in overall stream deadline (default off; bounds slow-drip streams)
+JEO_STREAM_MAX_MS=1800000       # overall stream deadline (default 30min; bounds slow-drip streams, not active ones); 0 disables
 JEO_STREAM_IDLE_MS=300000       # per-chunk idle cap (default 300s); raise for slow/local backends silent before first token
+JEO_CALL_TIMEOUT_MS=1800000     # non-streaming call wall cap (default 30min; compaction/subagents/goal-verify)
+JEO_TURN_MAX_MS=1800000         # turn stall budget: max time WITHOUT tool progress (default 30min); 0 disables
 JEO_TOOL_OUTPUT_MAX=4000        # model-visible tool output cap (full output spills to artifacts)
 ```
 
@@ -262,11 +264,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -78,8 +78,8 @@ jeo --tmux               # 在独立 tmux 会话中运行
 | `/model` · `/provider` | 选择模型/提供商；`/model` 在一个流程内显示默认/角色徽章、Ralph 风格嵌套角色·thinking 选择与 OpenAI Codex 角色预设 |
 | `/provider login <name>` · `/logout` | 在输入框内 OAuth 登录/登出 |
 | `/agents [role]` · `/subagent` | 按角色(executor/planner/architect/critic)配置模型·thinking·步数 |
-| `/thinking [level]` | 查看/设置默认推理预算(minimal…xhigh) |
-| `/fast [on|off|status]` | 当前模型支持 minimal/low 推理时切换 fast thinking 模式 |
+| `/thinking [level]` | 查看/设置默认推理预算(low…xhigh) |
+| `/fast [on|off|status]` | 当前模型支持 low 推理时切换 fast thinking 模式 |
 | `/skill` · `$<skill> [intent]` | 列出/运行工作流技能(`$team "任务"` 风格) |
 | `/view` · `/diff` · `/find` · `/search` | 代码查看、git diff、文件/模式搜索 |
 | `/new` · `/resume` · `/sessions` | 会话管理 |
@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
+- **[0.7.53]** (2026-07-06) — Verified PromptRouter end-to-end (63 pre-existing tests re-run, all passing; a live `jeo doctor --json`/human-output smoke test confirms real wiring, not just mocks) and closed the one genuine remaining gap: the v0.7.51 per-turn credential-readiness veto protected a running session reactively, but nothing caught a misconfigured `roles.smol`/`roles.slow`/`routing.tiers.*.model` proactively at setup time.
 - **[0.7.52]** (2026-07-06) — Two TUI visibility asks answered directly ("어느 모델이 라우팅됐는지 상시 표시" — persistently show which model routing picked, and "각 서브에이전트의 사고 과정도 보이게" — surface each subagent's own thinking) plus a Ponytail-mode minimal-code audit pass across six files that found one genuine correctness bug and five instances of dead/unreachable code.
 - **[0.7.51]** (2026-07-06) — Closes a real correctness gap the user directly identified by asking "does routing only ever pick from models the user can actually use?" — the honest answer at v0.7.50 was no: `routePrompt` resolves a tier's model purely from config (`routing.tiers`/`roles.smol`/`roles.slow`/`defaultModel`) and never checks whether that model's provider has a usable credential. A user could configure `roles.smol`/`roles.slow` to a provider they never logged into (or whose OAuth token expired since setup), and routing would silently turn a WORKING session into a FAILING turn — `resolveCall` throwing `"No credential for provider …"` — the instant it engaged, even though the turn would have succeeded unrouted. Routing is opt-in specifically so it can never make things worse than routing being off; this closes that hole.
 - **[0.7.50]** (2026-07-06) — Design-doc audit of v0.7.47's PromptRouter, dispatched as two parallel subagents (independent re-verification + gap implementation) against the original Korean-language design report. The core proposal was confirmed shipped correctly (heuristic classifier, escalation, `/model`-always-wins, tool-selection isolation — all independently re-derived from git history and grep evidence, not just re-read from the doc). Two gaps the design doc itself had flagged as open questions (§7 risks #2 and #4) were real and are fixed here; a third finding (an internal contradiction in the design doc's own §3.2 vs §3.4 text on image-attachment gating — the SHIPPED code was already correct, only the doc's prose disagreed with itself) required no code change.
-- **[0.7.49]** (2026-07-06) — gjc Telegram-daemon parity, Tier 2 (follow-up to 0.7.37/0.7.38/0.7.48's subagent-visibility-only daemon): adds a dynamic, PER-SESSION forum topic that mirrors that session's OWN activity — not just its subagents — and lets a Telegram reply steer it directly. Opt-in via `notifications.telegram.perSessionTopics`; the flat/global `topicId` path from 0.7.48 is UNCHANGED when it's off, so existing setups see zero regression.
-- **[0.7.48]** (2026-07-06) — gjc Telegram-daemon parity, phase 2 (follow-up to 0.7.37/0.7.38's baseline subagent-visibility daemon, which deliberately scoped OUT forum topics, inline keyboards, and image attachments — see that entry): the daemon now speaks gjc's richer notification surface instead of the plain-text-only baseline.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.52",
+  "version": "0.7.54",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -122,7 +122,7 @@ export const ConfigSchema = z
      *  regardless of project/cwd. A leading `~` is expanded; env `JEO_WIKI_ROOT`
      *  overrides. Consumed by `resolveWikiRoot` and injected into the prompt. */
     wikiRoot: z.string().optional(),
-    thinkingLevel: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
+    thinkingLevel: z.enum(["low", "medium", "high", "xhigh"]).optional(),
     modelAliases: z.record(z.string()).optional(),
     /** Most-recently-selected models, newest first (drives the default + pickers). */
     recentModels: z.array(z.string()).optional(),
@@ -167,7 +167,7 @@ export const ConfigSchema = z
           provider: z.enum(["anthropic", "openai", "gemini", "antigravity", "ollama"]).optional(),
           maxSteps: z.number().int().min(1).optional(),
           /** Per-role reasoning budget; absent = inherit the global thinkingLevel. */
-          thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
+          thinking: z.enum(["low", "medium", "high", "xhigh"]).optional(),
           // ─── Custom-role declaration (SYSTEM-driven registry) ───
           // An entry under a NON-bundled id that sets any of these becomes a
           // first-class subagent role at runtime — no code change required.
@@ -201,9 +201,9 @@ export const ConfigSchema = z
         confidenceThreshold: z.number().min(0).max(1).optional(),
         tiers: z
           .object({
-            trivial: z.object({ model: z.string().optional(), thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional() }).optional(),
-            standard: z.object({ model: z.string().optional(), thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional() }).optional(),
-            complex: z.object({ model: z.string().optional(), thinking: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional() }).optional(),
+            trivial: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
+            standard: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
+            complex: z.object({ model: z.string().optional(), thinking: z.enum(["low", "medium", "high", "xhigh"]).optional() }).optional(),
           })
           .optional(),
       })
@@ -262,8 +262,52 @@ function normalizeModelId(id: string | undefined, aliases: Record<string, string
   return trimmed;
 }
 
+/** Migrate the retired "minimal" thinking level to "low" on every field that could carry
+ *  it, BEFORE schema validation. Without this, a config.json persisted while "minimal"
+ *  was still valid (thinkingLevel, any subagents.*.thinking, any routing.tiers.*.thinking)
+ *  would fail the tightened enum and readGlobalConfig's schema-invalid path resets the
+ *  ENTIRE config to defaults (modelAliases/subagents/routing/retry/hooks/notifications
+ *  all silently lost, not just the one bad field) — see state.ts's salvageCredentials doc
+ *  comment for why only oauth/providers survive that path. Mutates a shallow-cloned
+ *  object only where needed; non-object/malformed input passes through untouched so the
+ *  schema's own validation still reports the real error. */
+function migrateMinimalThinking(raw: unknown): unknown {
+  if (!raw || typeof raw !== "object") return raw;
+  const cfg = raw as Record<string, unknown>;
+  let changed = false;
+  const out: Record<string, unknown> = { ...cfg };
+  if (out.thinkingLevel === "minimal") { out.thinkingLevel = "low"; changed = true; }
+  if (out.subagents && typeof out.subagents === "object") {
+    const subs = out.subagents as Record<string, unknown>;
+    const nextSubs: Record<string, unknown> = { ...subs };
+    for (const [roleId, role] of Object.entries(subs)) {
+      if (role && typeof role === "object" && (role as Record<string, unknown>).thinking === "minimal") {
+        nextSubs[roleId] = { ...(role as Record<string, unknown>), thinking: "low" };
+        changed = true;
+      }
+    }
+    if (changed) out.subagents = nextSubs;
+  }
+  if (out.routing && typeof out.routing === "object") {
+    const routing = out.routing as Record<string, unknown>;
+    if (routing.tiers && typeof routing.tiers === "object") {
+      const tiers = routing.tiers as Record<string, unknown>;
+      const nextTiers: Record<string, unknown> = { ...tiers };
+      let tiersChanged = false;
+      for (const [tierId, tier] of Object.entries(tiers)) {
+        if (tier && typeof tier === "object" && (tier as Record<string, unknown>).thinking === "minimal") {
+          nextTiers[tierId] = { ...(tier as Record<string, unknown>), thinking: "low" };
+          tiersChanged = true;
+        }
+      }
+      if (tiersChanged) { out.routing = { ...routing, tiers: nextTiers }; changed = true; }
+    }
+  }
+  return changed ? out : raw;
+}
+
 export function parseConfig(raw: unknown): { ok: true; config: ValidatedConfig } | { ok: false; message: string } {
-  const result = ConfigSchema.safeParse(raw);
+  const result = ConfigSchema.safeParse(migrateMinimalThinking(raw));
   if (result.success) {
     const config = result.data;
     const aliases = config.modelAliases || {};

package/src/agent/state.ts

@@ -76,7 +76,7 @@ export interface Config {
     };
   };
 
-  thinkingLevel?: "minimal" | "low" | "medium" | "high" | "xhigh";
+  thinkingLevel?: "low" | "medium" | "high" | "xhigh";
   /** Friendly model aliases, e.g. { fast: "ollama/qwen2.5:0.5b" }. Override built-ins. */
   modelAliases?: { [alias: string]: string };
   /** Most-recently-selected models, newest first (MRU; head == defaultModel). */
@@ -119,7 +119,7 @@ export interface Config {
     [roleId: string]: {
       model?: string;
       maxSteps?: number;
-      thinking?: "minimal" | "low" | "medium" | "high" | "xhigh";
+      thinking?: "low" | "medium" | "high" | "xhigh";
       title?: string;
       description?: string;
       prompt?: string;
@@ -137,9 +137,9 @@ export interface Config {
     enabled?: boolean;
     confidenceThreshold?: number;
     tiers?: {
-      trivial?: { model?: string; thinking?: "minimal" | "low" | "medium" | "high" | "xhigh" };
-      standard?: { model?: string; thinking?: "minimal" | "low" | "medium" | "high" | "xhigh" };
-      complex?: { model?: string; thinking?: "minimal" | "low" | "medium" | "high" | "xhigh" };
+      trivial?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
+      standard?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
+      complex?: { model?: string; thinking?: "low" | "medium" | "high" | "xhigh" };
     };
   };
   gitAutoCommit?: boolean;

package/src/agent/subagents.ts

@@ -298,7 +298,7 @@ export function parseMaxSteps(input: string | undefined): number | undefined {
  * maxSteps). Pure — does not mutate `config`. Unknown roles are rejected by the
  * caller via `getSubagentRole`; this helper trusts the id it is given.
  */
-export type ThinkLevelValue = "minimal" | "low" | "medium" | "high" | "xhigh";
+export type ThinkLevelValue = "low" | "medium" | "high" | "xhigh";
 
 /** Per-role reasoning level → explicit role override, else undefined (= INHERIT
  *  the global thinkingLevel at call time — gjc's "(inherit)" semantics). */

package/src/ai/model-catalog.ts

@@ -9,9 +9,9 @@
 import type { ProviderName } from "./types";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
-export type ThinkLevel = "minimal" | "low" | "medium" | "high" | "xhigh";
+export type ThinkLevel = "low" | "medium" | "high" | "xhigh";
 
-export const THINK_LEVELS: readonly ThinkLevel[] = ["minimal", "low", "medium", "high", "xhigh"];
+export const THINK_LEVELS: readonly ThinkLevel[] = ["low", "medium", "high", "xhigh"];
 
 export interface CatalogModel {
   /** jeo-facing canonical id (what a user types). */
@@ -31,8 +31,8 @@ export interface CatalogModel {
   company?: string;
 }
 
-const FULL: ThinkLevel[] = ["minimal", "low", "medium", "high", "xhigh"];
-const STD: ThinkLevel[] = ["minimal", "low", "medium", "high"];
+const FULL: ThinkLevel[] = ["low", "medium", "high", "xhigh"];
+const STD: ThinkLevel[] = ["low", "medium", "high"];
 
 export const ANTIGRAVITY_MODELS = [
   "claude-opus-4-6-thinking",

package/src/ai/model-manager.ts

@@ -92,8 +92,7 @@ export function providerModelFor(model: string): string {
 }
 
 /** Map the configured thinking level to a default max-token budget. */
-export function thinkingMaxTokens(level?: "minimal" | "low" | "medium" | "high" | "xhigh"): number {
-  if (level === "minimal") return 4000;
+export function thinkingMaxTokens(level?: "low" | "medium" | "high" | "xhigh"): number {
   if (level === "low") return 8000;
   if (level === "high") return 24000;
   if (level === "xhigh") return 31999;
@@ -117,7 +116,7 @@ const DEFAULT_MAX_OUTPUT_CAP = 64_000;
  *  Uncatalogued models (local/live ids) keep the legacy thinking-table budget. */
 export function resolveMaxOutputTokens(
   model?: string,
-  level?: "minimal" | "low" | "medium" | "high" | "xhigh",
+  level?: "low" | "medium" | "high" | "xhigh",
 ): number {
   const meta = model ? findCatalogEntry(expandAlias(model, ALIAS_DEFAULTS)) : undefined;
   if (!meta) return thinkingMaxTokens(level);
@@ -126,13 +125,13 @@ export function resolveMaxOutputTokens(
   return Math.min(findCatalogModel(meta.id)?.maxOutputTokens ?? cap, cap);
 }
 
-/** Map the thinking level to an OpenAI reasoning-effort tier. minimal/low/medium/high pass
+/** Map the thinking level to an OpenAI reasoning-effort tier. low/medium/high pass
  *  through unchanged and xhigh folds to high (the deepest tier the provider APIs accept), so
- *  reasoning works at EVERY thinking level (gajae parity: minimal is a real effort). Only an
- *  unset level returns undefined (reasoning off — the explicit /fast path). */
+ *  reasoning works at EVERY thinking level (gajae parity). Only an unset level returns
+ *  undefined (reasoning off — the explicit /fast path). */
 export function thinkingToReasoningEffort(
-  level?: "minimal" | "low" | "medium" | "high" | "xhigh",
-): "minimal" | "low" | "medium" | "high" | undefined {
+  level?: "low" | "medium" | "high" | "xhigh",
+): "low" | "medium" | "high" | undefined {
   if (!level) return undefined;
   return level === "xhigh" ? "high" : level;
 }
@@ -450,13 +449,18 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
  *  streaming idle watchdog, this path collects an opaque buffered body (`response.json()`,
  *  or an internally-streamed collect in codexResponsesCall / antigravity.call) and exposes
  *  no per-chunk signal — so a wall clock is the only lever and a wire heartbeat cannot help.
- *  Raised to 300s to match STREAM_IDLE_TIMEOUT_MS: non-interactive turns (callLlm WITHOUT
- *  onToken — compaction, ralplan, deep-interview, memory distill, goal-verify, and subagent/
- *  autopilot engine steps) route here, and a long reasoning completion legitimately exceeds
- *  120s; too-tight, it aborts an alive call, retries re-incur the same slow request, the
- *  attempt budget exhausts, and the turn STOPS — the same false-failure the streaming
- *  watchdog guards, on the path the wire heartbeat never reaches. */
-const DEFAULT_CALL_TIMEOUT_MS = 300_000;
+ *  Raised 120s → 300s → 30min across two rounds of the SAME false-failure: non-interactive
+ *  turns (callLlm WITHOUT onToken — compaction, ralplan, deep-interview, memory distill,
+ *  goal-verify, and subagent/autopilot engine steps) route here, and a HIGH/XHIGH reasoning
+ *  effort completion (GPT-5.5/o3-class) legitimately exceeds 300s — OpenAI's own guidance is
+ *  that xhigh trades latency for depth deliberately. Too-tight, it aborts an alive call, the
+ *  attempt budget exhausts, and the turn STOPS — exactly the false-failure the streaming
+ *  watchdog guards, on the path the wire heartbeat never reaches. 30min matches both
+ *  `turnMaxMs()`'s own vetted stall-budget default AND the OBSERVED ~20-30min infra-side
+ *  connection-duration cap on OpenAI's Codex/ChatGPT backend (see socket-closed handling
+ *  above) — genuinely dead connections still fail fast via TCP/TLS errors well before this;
+ *  this wall clock exists only for the "server accepted the request and went silent" case. */
+const DEFAULT_CALL_TIMEOUT_MS = 30 * 60_000;
 
 /** Per-chunk idle cap for streaming: a stream that emits NOTHING for this long is
  *  aborted, but a healthy long generation (chunks keep arriving) runs unbounded —
@@ -564,13 +568,17 @@ async function nextMaybeIdle(iter: AsyncIterator<string>, watchdog?: Promise<nev
 }
 
 /** Overall stream wall-clock from the environment. Defaults to the same hard bound as
- *  callTimeoutMs() (DEFAULT_CALL_TIMEOUT_MS) so the streaming path has parity with the
- *  non-streaming call()/fallback path — a stream that stays connected and keeps emitting
- *  SOMETHING (SSE keepalives, reasoning deltas) re-arms the per-chunk idle watchdog
- *  forever and would otherwise never resolve or reject. JEO_STREAM_MAX_MS explicitly set
- *  to a positive number overrides the default; explicitly set to 0 disables the overall
- *  deadline entirely (mirrors JEO_TURN_MAX_MS's own 0-disables convention) for advanced
- *  users with genuinely long-running legitimate reasoning models. */
+ *  callTimeoutMs() (DEFAULT_CALL_TIMEOUT_MS, 30min) so the streaming path has parity with
+ *  the non-streaming call()/fallback path — a stream that stays connected and keeps
+ *  emitting SOMETHING (SSE keepalives, reasoning deltas) re-arms the per-chunk idle
+ *  watchdog forever and would otherwise never resolve or reject. Bug fix: this previously
+ *  defaulted to 300s (DEFAULT_CALL_TIMEOUT_MS's OLD value, before it too was raised) —
+ *  that false-failed any HIGH/XHIGH-reasoning-effort model (GPT-5.5/o3-class) whose
+ *  ACTIVELY-emitting completion legitimately ran past 5 minutes, killing a healthy
+ *  generation with "stream exceeded the overall deadline" despite continuous activity.
+ *  JEO_STREAM_MAX_MS explicitly set to a positive number overrides the default; explicitly
+ *  set to 0 disables the overall deadline entirely (mirrors JEO_TURN_MAX_MS's own
+ *  0-disables convention) for advanced users with genuinely long-running reasoning models. */
 export function streamMaxMs(env?: Record<string, string | undefined>): number | undefined {
   const raw = jeoEnv("STREAM_MAX_MS", env);
   if (raw === undefined || raw === "") return DEFAULT_CALL_TIMEOUT_MS;

package/src/ai/providers/anthropic.ts

@@ -99,14 +99,13 @@ function anthropicSystemBlocks(
 }
 
 /** Anthropic extended-thinking budget by reasoning effort (kept under max_tokens). Tiers match
- *  gjc's ANTHROPIC_THINKING table: minimal/low/medium/high ALL enable thinking with scaling
- *  depth — reasoning works at every thinking level (gajae parity: Minimal is a real effort).
+ *  gjc's ANTHROPIC_THINKING table: low/medium/high ALL enable thinking with scaling
+ *  depth — reasoning works at every thinking level (gajae parity).
  *  Only an UNSET effort stays non-thinking (the explicit /fast off path). The "xhigh" row is
  *  correct-by-table even though upstream currently folds xhigh→high before it arrives. */
 function anthropicThinkingBudget(effort: CallOptions["reasoningEffort"] | "xhigh", maxTokens: number): number | undefined {
   let budget: number;
   switch (effort) {
-    case "minimal": budget = 1024; break;
     case "low": budget = 4096; break;
     case "medium": budget = 8192; break;
     case "high": budget = 16384; break;
@@ -161,10 +160,9 @@ function anthropicThinkingMode(model: string): AnthropicThinkingMode {
 }
 
 /** Map jeo's reasoning effort to Anthropic's adaptive/output_config effort literal. jeo folds
- *  xhigh→high upstream, so only minimal/low/medium/high arrive here. (gjc: mapEffortToAnthropicAdaptiveEffort) */
+ *  xhigh→high upstream, so only low/medium/high arrive here. (gjc: mapEffortToAnthropicAdaptiveEffort) */
 function anthropicAdaptiveEffort(effort: NonNullable<CallOptions["reasoningEffort"]>): "low" | "medium" | "high" {
   switch (effort) {
-    case "minimal":
     case "low": return "low";
     case "medium": return "medium";
     case "high": return "high";

package/src/ai/providers/antigravity.ts

@@ -14,11 +14,10 @@ const ANTIGRAVITY_SANDBOX_ENDPOINT = "https://daily-cloudcode-pa.sandbox.googlea
 /** Anthropic-style thinking budget for Claude served via CCA. gemini's budget fn
  *  returns undefined for claude ids, which left antigravity Claude with NO thinking
  *  requested (the opus "no reasoning" gap). Mirrors anthropic's effort→budget tiers —
- *  minimal/low/medium/high ALL think (gajae parity: reasoning at every level); only an
+ *  low/medium/high ALL think (gajae parity: reasoning at every level); only an
  *  UNSET effort stays non-thinking. */
 function antigravityClaudeThinkingBudget(effort: CallOptions["reasoningEffort"]): number | undefined {
   switch (effort) {
-    case "minimal": return 2000;
     case "low": return 4000;
     case "medium": return 10000;
     case "high": return 24000;

package/src/ai/providers/gemini.ts

@@ -26,11 +26,10 @@ export function geminiThinkingBudget(model: string, effort?: CallOptions["reason
   const effectiveEffort = effort ?? geminiNamedEffort(m);
   let budget: number;
   switch (effectiveEffort) {
-    // minimal/low/medium/high ALL enable thinking with scaling depth — reasoning works at
-    // every thinking level (gajae parity: Minimal is a real effort). Only an UNSET effort
+    // low/medium/high ALL enable thinking with scaling depth — reasoning works at
+    // every thinking level (gajae parity). Only an UNSET effort
     // (and no in-name depth marker) falls through to the floor.
     // Tier values mirror gjc's GOOGLE_THINKING table (stream.ts).
-    case "minimal": budget = Math.max(floor, 1024); break;
     case "low": budget = 4096; break;
     case "medium": budget = 8192; break;
     case "high": budget = 16384; break;
@@ -63,10 +62,9 @@ export function geminiUsesThinkingLevel(model: string): boolean {
 }
 
 /** Effort → Google `thinkingLevel` enum value (gjc mapEffortToGoogleThinkingLevel):
- *  minimal→MINIMAL, low→LOW, medium→MEDIUM, high/xhigh→HIGH. */
-export function geminiThinkingLevel(effort: NonNullable<CallOptions["reasoningEffort"]> | "xhigh"): "MINIMAL" | "LOW" | "MEDIUM" | "HIGH" {
+ *  low→LOW, medium→MEDIUM, high/xhigh→HIGH. */
+export function geminiThinkingLevel(effort: NonNullable<CallOptions["reasoningEffort"]> | "xhigh"): "LOW" | "MEDIUM" | "HIGH" {
   switch (effort) {
-    case "minimal": return "MINIMAL";
     case "low": return "LOW";
     case "medium": return "MEDIUM";
     case "high":
@@ -80,7 +78,7 @@ export function geminiThinkingLevel(effort: NonNullable<CallOptions["reasoningEf
  *  omitted so the model keeps its default (gjc parity: thinking not enabled → no config).
  *  Other thinking-capable models → numeric thinkingBudget; pre-2.5 → undefined. */
 export type GeminiThinkingConfig =
-  | { includeThoughts: true; thinkingLevel: "MINIMAL" | "LOW" | "MEDIUM" | "HIGH" }
+  | { includeThoughts: true; thinkingLevel: "LOW" | "MEDIUM" | "HIGH" }
   | { includeThoughts: true; thinkingBudget: number };
 
 export function geminiThinkingConfig(model: string, effort?: CallOptions["reasoningEffort"], maxTokens?: number): GeminiThinkingConfig | undefined {

package/src/ai/providers/openai-responses.ts

@@ -21,7 +21,7 @@ import pkg from "../../../package.json";
 
 export const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 
-export const VALID_REASONING_EFFORTS = new Set(["minimal", "low", "medium", "high"]);
+export const VALID_REASONING_EFFORTS = new Set(["low", "medium", "high"]);
 
 const CODEX_ORIGINATOR = "codex_cli_rs";
 

package/src/ai/types.ts

@@ -107,7 +107,7 @@ export interface CallOptions {
   /** Abort in-flight provider requests (Ctrl-C / timeout / supersede). */
   signal?: AbortSignal;
   /** Reasoning effort for reasoning models (o-series / gpt-5), mapped from thinkingLevel. */
-  reasoningEffort?: "minimal" | "low" | "medium" | "high";
+  reasoningEffort?: "low" | "medium" | "high";
   /** How an OpenAI-compatible backend enables/streams native reasoning (gjc parity):
    *  "openai" → `reasoning_effort`; "openrouter" → `reasoning: {effort}`; "qwen" →
    *  `enable_thinking: true`; "zai" → `thinking: {type:"enabled"}`. Set per provider by

package/src/cli/runner.ts

@@ -331,7 +331,7 @@ export function renderHelp(ctx: DispatchContext): string {
   lines.push("      --model <id>             Use a session model for launch/one-shot.");
   lines.push("      --provider <name>        Start launch on a provider default (anthropic/openai/gemini/antigravity/ollama).");
   lines.push("      --smol|--slow|--plan     Start launch with the configured model role tier.");
-  lines.push("      --thinking <level>       Set thinking budget (minimal/low/medium/high/xhigh).");
+  lines.push("      --thinking <level>       Set thinking budget (low/medium/high/xhigh).");
   lines.push("");
   return lines.join("\n");
 }

package/src/commands/chat.ts

@@ -46,8 +46,8 @@ export async function runChatCommand(args: string[] = []): Promise<void> {
   let any = false;
   let usage: { inputTokens?: number; outputTokens?: number; durationMs?: number } | undefined;
   try {
-    const effort = (thinking === "xhigh" ? "high" : thinking) as "minimal" | "low" | "medium" | "high" | undefined;
-    const maxTokens = explicitMaxTokens ?? (thinking ? thinkingMaxTokens(thinking as "minimal" | "low" | "medium" | "high" | "xhigh") : undefined);
+    const effort = (thinking === "xhigh" ? "high" : thinking) as "low" | "medium" | "high" | undefined;
+    const maxTokens = explicitMaxTokens ?? (thinking ? thinkingMaxTokens(thinking as "low" | "medium" | "high" | "xhigh") : undefined);
     for await (const chunk of manager.stream([{ role: "user", content: message }], { model, maxTokens, reasoningEffort: effort, onUsage: u => { usage = u; } })) {
       process.stdout.write(chunk);
       any = true;

package/src/commands/doctor.ts

@@ -1,6 +1,7 @@
 import { readGlobalConfig } from "../agent/state";
 import { resolveCredential, snapshotProvider, type AuthProvider, type Credential } from "../auth";
-import { resolveProvider } from "../ai";
+import { resolveProvider, describeProvider } from "../ai";
+
 import { effectiveCredentialForProvider } from "../ai/model-manager";
 import { resolveModelId } from "../ai/model-registry";
 import { meter } from "../tui/components/meter";
@@ -179,9 +180,37 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
   // turn.
   const routingEnabled = !!config.routing?.enabled;
   const smolConfigured = !!config.roles?.smol;
-  const routingNote = routingEnabled && !smolConfigured
-    ? "routing is enabled but roles.smol is unset — LLM escalation for ambiguous prompts will never fire; heuristic-only tier resolution applies every turn. Set roles.smol to enable escalation."
-    : undefined;
+  const routingNotes: string[] = [];
+  if (routingEnabled && !smolConfigured) {
+    routingNotes.push(
+      "routing is enabled but roles.smol is unset — LLM escalation for ambiguous prompts will never fire; heuristic-only tier resolution applies every turn. Set roles.smol to enable escalation.",
+    );
+  }
+  // Proactive credential-readiness check for every model routing could actually pick —
+  // mirrors launch.ts's runTurn per-turn veto gate (v0.7.51) but surfaced at onboarding/
+  // doctor time instead of only reactively on a session's first qualifying turn. Catches
+  // `roles.smol`/`roles.slow`/`routing.tiers.*.model` pointed at a provider the user never
+  // logged into (or whose credential was since removed). `standard` only checked when
+  // explicitly configured — its unconfigured fallback is `defaultModel`, already covered
+  // by the provider-connectivity probes above.
+  if (routingEnabled) {
+    const tierCandidates: { tier: string; model: string | undefined }[] = [
+      { tier: "trivial", model: config.routing?.tiers?.trivial?.model || config.roles?.smol },
+      { tier: "standard", model: config.routing?.tiers?.standard?.model },
+      { tier: "complex", model: config.routing?.tiers?.complex?.model || config.roles?.slow },
+    ];
+    for (const { tier, model } of tierCandidates) {
+      if (!model) continue;
+      const provider = resolveProvider(model);
+      const status = await describeProvider(provider, config);
+      if (!status.ready) {
+        routingNotes.push(
+          `routing.tiers.${tier} resolves to '${model}' (${provider}) which has no usable credential — run 'jeo auth login ${provider}' or reconfigure that tier/role for a provider you're logged into.`,
+        );
+      }
+    }
+  }
+
 
   // --- Gather (probes run concurrently → ~1× the slowest timeout, not N×) ---
   const probes: { name: string; credKind: string; result: ProbeResult }[] = [];
@@ -248,7 +277,8 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
       })),
       oauth: oauthHealth,
       ready,
-      ...(routingEnabled ? { routing: { enabled: true, smolConfigured, ...(routingNote ? { note: routingNote } : {}) } } : {}),
+      ...(routingEnabled ? { routing: { enabled: true, smolConfigured, ...(routingNotes.length ? { notes: routingNotes } : {}) } } : {}),
+
     };
     console.log(JSON.stringify(report, null, 2));
     if (strict && !ready) process.exit(1);
@@ -292,11 +322,12 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
   }
   // Routing diagnostic: informational only — never affects ready/strict exit logic.
   if (routingEnabled) {
-    if (routingNote) {
-      console.log(`${chalk.yellow("[routing]")} ${routingNote}`);
+    if (routingNotes.length) {
+      for (const note of routingNotes) console.log(`${chalk.yellow("[routing]")} ${note}`);
     } else {
       console.log(`${chalk.green("[routing]")} enabled, roles.smol configured — LLM escalation available on ambiguous prompts.`);
     }
+
     console.log("");
   }
 

package/src/commands/launch/agents-slash.ts

@@ -478,12 +478,12 @@ export async function runThinkingSlash(input: string, ctx: AgentsSlashCtx): Prom
     console.log(`Thinking level: ${sessionThinking ?? "medium"} (~${thinkingMaxTokens(sessionThinking)} max tokens/step)`);
     return result();
   }
-  if (arg === "minimal" || arg === "low" || arg === "medium" || arg === "high" || arg === "xhigh") {
+  if (arg === "low" || arg === "medium" || arg === "high" || arg === "xhigh") {
     sessionThinking = arg;
     sessionThinkingChanged = true;
     console.log(`Thinking set to ${arg} (~${thinkingMaxTokens(arg)} max tokens/step)`);
   } else {
-    console.log(`Invalid level '${arg}'. Use: minimal | low | medium | high | xhigh.`);
+    console.log(`Invalid level '${arg}'. Use: low | medium | high | xhigh.`);
   }
   return result();
 }

package/src/commands/launch/flags.ts

@@ -49,19 +49,18 @@ export function isProviderName(input: string | undefined): input is ProviderName
 }
 
 export function isThinkingLevel(input: string | undefined): input is ThinkLevel {
-  return input === "minimal" || input === "low" || input === "medium" || input === "high" || input === "xhigh";
+  return input === "low" || input === "medium" || input === "high" || input === "xhigh";
 }
 
 
 export function fastThinkingLevelForModel(modelId: string): ThinkLevel | undefined {
   const supported = catalogMetadata(modelId)?.thinking ?? [];
-  if (supported.includes("minimal")) return "minimal";
   if (supported.includes("low")) return "low";
   // Digit-count agnostic (gemini-10+ / 2.6+ stay reasoning) — mirrors the gates in
   // gemini.ts and inferCatalogMetadata. Last resort for prefixed ids (models/gemini-…)
   // the catalog lookup above misses; catalogued ids already returned via thinking caps.
   const g = modelId.toLowerCase().match(/gemini-(\d+)(?:\.(\d+))?/);
-  if (g && (Number(g[1]) >= 3 || (Number(g[1]) === 2 && Number(g[2] ?? 0) >= 5))) return "minimal";
+  if (g && (Number(g[1]) >= 3 || (Number(g[1]) === 2 && Number(g[2] ?? 0) >= 5))) return "low";
   return undefined;
 }
 
@@ -114,7 +113,7 @@ export function parseFlags(args: string[], cwd: string = process.cwd()): LaunchF
       const { value, nextIndex } = takeValue(args, i, "--thinking=");
       const normalized = value?.toLowerCase();
       if (isThinkingLevel(normalized)) flags.thinking = normalized;
-      else flags.errors.push("--thinking must be one of: minimal, low, medium, high, xhigh");
+      else flags.errors.push("--thinking must be one of: low, medium, high, xhigh");
       i = nextIndex;
     } else if (a === "--smol" || a === "--slow" || a === "--plan") {
       flags.modelRole = a.slice(2) as ModelRole;

package/src/commands/launch/model-slash.ts

@@ -124,7 +124,7 @@ export async function runModelSlash(input: string, ctx: ModelSlashCtx): Promise<
   if (modelThinking) {
     const level = (modelThinking[1] ?? "").toLowerCase();
     if (!isThinkingLevel(level)) {
-      console.log("Usage: /model thinking <minimal|low|medium|high|xhigh>");
+      console.log("Usage: /model thinking <low|medium|high|xhigh>");
       return result();
     }
     sessionThinking = level;

package/src/commands/launch.ts

@@ -648,7 +648,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   };
   let sessionModel: string | undefined = initialSessionModel;
   // Session thinking-level override (`/thinking`); falls back to the config level.
-  let sessionThinking: "minimal" | "low" | "medium" | "high" | "xhigh" | undefined = flags.thinking ?? cfg.thinkingLevel;
+  let sessionThinking: "low" | "medium" | "high" | "xhigh" | undefined = flags.thinking ?? cfg.thinkingLevel;
   // PromptRouter session override: undefined = follow config.routing.enabled, true/false = /route on|off wins this session.
   let sessionRouteOverride: boolean | undefined;
   // Last routing decision (or the reason none applied) — /route why reads this.
@@ -2832,7 +2832,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   ): Promise<ThinkLevel | "inherit" | undefined> => {
     const levels = buildThinkingLevelChoices(current, {
       inheritLabel,
-      tokenHint: lvl => (lvl === "minimal" ? undefined : `~${Math.round(thinkingMaxTokens(lvl as ThinkLevel) / 1000)}k tokens`),
+      tokenHint: lvl => `~${Math.round(thinkingMaxTokens(lvl as ThinkLevel) / 1000)}k tokens`,
     });
     const picked = await pickFromOptions(title, levels);
     return picked === "inherit" || isThinkingLevel(picked) ? picked : undefined;
@@ -2849,7 +2849,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       return true;
     }
     if (!isThinkingLevel(level)) {
-      console.log(`Usage: /model subagent ${role.id} thinking <inherit|minimal|low|medium|high|xhigh>`);
+      console.log(`Usage: /model subagent ${role.id} thinking <inherit|low|medium|high|xhigh>`);
       return true;
     }
     await saveConfigPatch(raw => ({ subagents: withSubagentSetting(raw, role.id, { thinking: level }) }));

package/src/tui/components/autocomplete.ts

@@ -6,7 +6,7 @@
  *  - `/model gpt`      → live (logged-in) model ids + aliases + catalog ids
  *  - `/provider an`    → provider names; second arg → that provider's live models
  *  - `/agents exec`    → subagent role ids; second arg → live model ids
- *  - `/thinking h`     → minimal/low/medium/high/xhigh
+ *  - `/thinking h`     → low/medium/high/xhigh
  *
  * Pure + synchronous: the dynamic data (live models from the OAuth-authenticated
  * accounts, alias snapshot) is passed in via `CompletionContext`, so the readline
@@ -59,7 +59,7 @@ const PREVIEW_LABEL: Record<string, string> = {
   path: "Paths",
 };
 const MAX_COMPLETIONS = 50;
-const THINKING_LEVELS = ["minimal", "low", "medium", "high", "xhigh"];
+const THINKING_LEVELS = ["low", "medium", "high", "xhigh"];
 
 /** Static half of a completion context (no network/config needed). */
 export function staticCompletionContext(): Omit<CompletionContext, "liveModels" | "aliases" | "modelsForProvider"> {

package/src/tui/components/live-model-picker.ts

@@ -107,11 +107,10 @@ export function renderLiveModelPicker(list: SelectList<PickEntry>, opts: RenderS
   return renderSelectList(list, { title: "Select a live model", rows: 12, showTabs: true, ...opts });
 }
 
-/** The five reasoning levels in display order, lightest → heaviest. */
-export const THINKING_LEVEL_ORDER = ["minimal", "low", "medium", "high", "xhigh"] as const;
+/** The four reasoning levels in display order, lightest → heaviest. */
+export const THINKING_LEVEL_ORDER = ["low", "medium", "high", "xhigh"] as const;
 
 const THINKING_LEVEL_DESCRIPTION: Record<string, string> = {
-  minimal: "lightest reasoning",
   low: "light reasoning",
   medium: "moderate reasoning",
   high: "deep reasoning",

package/src/tui/components/slash.ts

@@ -42,7 +42,7 @@ export const SLASH_COMMAND_DETAILS: readonly SlashCommandInfo[] = [
   { command: "/login", usage: "/login [provider]", description: "OAuth login — opens a provider picker showing live login status (account · expiry) for each provider (alias of /provider login)", group: "models" },
   { command: "/logout", usage: "/logout <anthropic|openai|gemini|antigravity>", description: "Remove the stored OAuth token for a provider", group: "models" },
   { command: "/roles", usage: "/roles [tier model]", description: "Show or set model role tiers (smol/slow/plan)", group: "models" },
-  { command: "/thinking", usage: "/thinking [level]", description: "Show or set thinking budget (minimal/low/medium/high/xhigh)", group: "models" },
+  { command: "/thinking", usage: "/thinking [level]", description: "Show or set thinking budget (low/medium/high/xhigh)", group: "models" },
   { command: "/route", usage: "/route [on|off|why]", description: "Show/toggle prompt-based model routing for this session, or explain the last routing decision", group: "models" },
   { command: "/agents", usage: "/agents [edit|role] [model|#N|thinking L|maxSteps N|reset]", description: "List subagent roles; use /agents edit for the interactive picker or pin role model/settings", group: "subagents" },
   { command: "/subagent", usage: "/subagent [role]", description: "Show the current subagent composition (per-role model · thinking · steps); alias of /agents", group: "subagents" },

package/src/util/provider-error.ts

@@ -57,6 +57,12 @@ export function friendlyProviderError(err: unknown): string {
   if (status === 401 || status === 403 || /\b40[13]\b/.test(msg)) {
     return `${provider} rejected the credential (HTTP ${status ?? "401/403"}). Run 'jeo auth status', re-login with /provider login <name>, and for Antigravity prefer '/provider login antigravity' (gemini login only works when the Cloud Code Assist backend authorizes that token).`;
   }
+  if ((err as { name?: string })?.name === "TimeoutError" || /the operation timed out/i.test(msg)) {
+    return `${provider} did not complete the request within the call timeout (default 30min). This is expected for a HIGH/XHIGH-reasoning-effort completion that legitimately runs long on a hard problem — raise JEO_CALL_TIMEOUT_MS (ms) if this recurs, or lower the thinking level with /model.`;
+  }
+  if (/exceeded the overall deadline \(JEO_STREAM_MAX_MS\)/i.test(msg)) {
+    return `${provider}'s stream hit the overall deadline (default 30min; JEO_STREAM_MAX_MS) despite staying active. Raise JEO_STREAM_MAX_MS (ms), set it to 0 to disable the overall cap, or lower the thinking level with /model.`;
+  }
   if (isContextOverflowError(err)) {
     return `${provider} rejected the request: the conversation no longer fits the model's context window. Run /compact, drop large attachments, or start a fresh session.`;
   }