jeo-code 0.7.58 → 0.8.1

package/CHANGELOG.md

@@ -6,6 +6,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.1] - 2026-07-08
+_Fix-forward for a functional regression this same session shipped in v0.8.0. This repo's working tree is shared with a concurrent interactive session; `git add`-ing `src/ai/provider-status.ts` for v0.8.0's routing-veto-gate fix also swept up that session's already-modified, uncommitted copy of the SAME file (containing an unrelated design change: gemini OAuth alone no longer serving `google/gemini-*` models) without its companion piece in `src/auth/flows/index.ts` — so v0.8.0 shipped with a test suite (`provider-status.test.ts`) asserting behavior whose supporting data flag never landed. CI caught this immediately post-release: 2 failing tests on the exact tagged commit. Investigated, confirmed the missing piece was real (and independently observable live via `jeo doctor` before this session had made ANY of its own edits — not a stray/speculative change), and completed it._
+
+### Fixed
+- **`OAUTH_FLOW_REGISTRY.gemini.verifiedEndToEnd` flipped `true` → `false`** (`src/auth/flows/index.ts`) — Google removed the gemini-cli/Cloud Code Assist masquerade that let a plain `jeo auth login gemini` OAuth token serve `google/gemini-*` calls directly; a `GEMINI_API_KEY` is now required (the same models remain OAuth-only reachable via `antigravity/*`). Without this flag, `effectiveCredentialForProvider`/`oauthServesModel` (`src/ai/model-manager.ts`) treated a gemini-OAuth-only credential as usable, so a real turn's API call hit Google's endpoint with a token it no longer accepts — a raw provider error instead of jeo's actionable "set GEMINI_API_KEY, or use antigravity/\*" message. Confirmed via live smoke test on the isolated fixed tree: `jeo doctor` now correctly reports `status: "fail"` with the full actionable hint for a gemini-OAuth-only config, instead of the false `"ok"` the stale flag produced.
+- **`test/launch-role-model.test.ts`'s antigravity-readiness test updated** to match the (already-shipped, correct) v0.8.0 behavior: a live gemini-fallback OAuth credential now makes `antigravity/*` genuinely `ready: true` (matching `model-manager.ts`'s real call-path fallback), not just catalog-listed-with-a-warning. Split into two tests — one asserting the new ready-via-fallback path, one preserving the original "genuinely no credential at all" not-ready/warned-not-refused coverage.
+- **`test/model-manager.test.ts`/`test/doctor.test.ts`** — updated the 2 tests whose expectations depended on the stale `verifiedEndToEnd` flag (gemini OAuth+key now correctly prefers the API key; gemini OAuth-only now correctly fails with the actionable hint instead of asserting the removed Cloud Code Assist probe response).
+
+### Verified
+Built a fully isolated tree (`git archive` of the tagged commit + only these 5 fix files copied in — zero contamination from the still-active concurrent session) and ran the complete suite there: `bun run typecheck` clean, **2712/2712 tests pass, 0 fail** (up from 2 failures on the as-shipped v0.8.0 tag, reproduced first to confirm they were real before fixing). Live end-to-end smoke test on that same isolated tree: `jeo doctor --json` against a gemini-OAuth-only config now correctly reports `"status": "fail"` with the actionable `GEMINI_API_KEY`/`antigravity` hint.
+
+## [0.8.0] - 2026-07-08
+_Root-caused a genuine reliability bug in the routing veto gate ("라우트가 동작후 api 키인증오류가나오는데 근본적인 원인 개선해"), then regenerated the animated README mascot to visualize the smart cross-provider routing this release cycle has been building: prompt routing that finds the cheapest usable path, with a "money saver" visual motif._
+
+### Fixed
+- **Routing veto gate's dead-OAuth blind spot** (`src/ai/provider-status.ts`) — `launch.ts`'s existing veto gate (which is supposed to catch "routed to a provider with no usable credential" before a turn runs) relied on `describeProvider().ready`, which only checked whether an OAuth credential OBJECT was present in config, never whether it was actually alive. A definitively dead OAuth token (expired, refresh token revoked or absent) reported `ready: true` anyway, so routing would commit a turn to that provider and the FIRST place the dead credential was ever noticed was a raw 401 from the real provider API — after routing had already discarded the working `defaultModel` fallback. Added `oauthEntryDead()`, a pure local check (expired AND no refresh token, no network call) wired into all three OAuth readiness branches (anthropic/openai/kimi, antigravity's own OAuth, antigravity's gemini fallback). An expired token WITH a refresh token is deliberately left alone — it self-heals via the existing `resolveCredential` auto-refresh on the real call path, confirmed live in this exact environment. Each newly-caught dead credential now surfaces an actionable label ("OAuth expired, no refresh token — run 'jeo auth login \<provider\>' to re-authenticate") instead of silently showing "OAuth" while quietly unusable.
+
+### Changed
+- **`assets/character.gif` regenerated** — the animated README mascot now depicts the jeo crayfish-wizard performing smart prompt routing: evaluating three provider paths on a holographic dispatch panel, selecting the cheapest/most-efficient one (highlighted green), gold coins streaming in as savings, settling into a satisfied glow. Same character identity (crimson shell, cyan-magenta gradient glasses, purple DNA-patterned robe, plush companions) and same dark-navy/cyan-grid backdrop as before — only the scene changed. Generated via the `god-tibo-imagen` skill (`gti` CLI, Codex/ChatGPT image backend, `gpt-5.4`) using the existing `character.png` as an identity reference, chained across 4 generations for pose-to-pose consistency, then assembled to 320×320 with a single shared color palette across all 4 frames (prevents the per-frame color flicker a naive per-frame quantization would produce in the loop).
+
 ## [0.7.58] - 2026-07-07
 _Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after._
 

package/README.ja.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <img src="assets/character.gif" alt="動く jeo-code 赤いザリガニマスコット" width="320" />
+  <img src="assets/character.gif" alt="最も安価なプロバイダーへプロンプトを賢くルーティングし、コインを稼ぐ動く jeo-code 赤いザリガニマスコット" width="320" />
 </p>
 
 <p align="center">
@@ -259,11 +259,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.1]** (2026-07-08) — Fix-forward for a functional regression this same session shipped in v0.8.0. This repo's working tree is shared with a concurrent interactive session; `git add`-ing `src/ai/provider-status.ts` for v0.8.0's routing-veto-gate fix also swept up that session's already-modified, uncommitted copy of the SAME file (containing an unrelated design change: gemini OAuth alone no longer serving `google/gemini-*` models) without its companion piece in `src/auth/flows/index.ts` — so v0.8.0 shipped with a test suite (`provider-status.test.ts`) asserting behavior whose supporting data flag never landed. CI caught this immediately post-release: 2 failing tests on the exact tagged commit. Investigated, confirmed the missing piece was real (and independently observable live via `jeo doctor` before this session had made ANY of its own edits — not a stray/speculative change), and completed it.
+- **[0.8.0]** (2026-07-08) — Root-caused a genuine reliability bug in the routing veto gate ("라우트가 동작후 api 키인증오류가나오는데 근본적인 원인 개선해"), then regenerated the animated README mascot to visualize the smart cross-provider routing this release cycle has been building: prompt routing that finds the cheapest usable path, with a "money saver" visual motif.
 - **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
 - **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
-- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
-- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <img src="assets/character.gif" alt="움직이는 jeo-code 붉은 가재 마스코트" width="320" />
+  <img src="assets/character.gif" alt="가장 저렴한 프로바이더로 프롬프트를 스마트하게 라우팅하며 동전을 모으는 움직이는 jeo-code 붉은 가재 마스코트" width="320" />
 </p>
 
 <p align="center">
@@ -260,11 +260,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.1]** (2026-07-08) — Fix-forward for a functional regression this same session shipped in v0.8.0. This repo's working tree is shared with a concurrent interactive session; `git add`-ing `src/ai/provider-status.ts` for v0.8.0's routing-veto-gate fix also swept up that session's already-modified, uncommitted copy of the SAME file (containing an unrelated design change: gemini OAuth alone no longer serving `google/gemini-*` models) without its companion piece in `src/auth/flows/index.ts` — so v0.8.0 shipped with a test suite (`provider-status.test.ts`) asserting behavior whose supporting data flag never landed. CI caught this immediately post-release: 2 failing tests on the exact tagged commit. Investigated, confirmed the missing piece was real (and independently observable live via `jeo doctor` before this session had made ANY of its own edits — not a stray/speculative change), and completed it.
+- **[0.8.0]** (2026-07-08) — Root-caused a genuine reliability bug in the routing veto gate ("라우트가 동작후 api 키인증오류가나오는데 근본적인 원인 개선해"), then regenerated the animated README mascot to visualize the smart cross-provider routing this release cycle has been building: prompt routing that finds the cheapest usable path, with a "money saver" visual motif.
 - **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
 - **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
-- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
-- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <img src="assets/character.gif" alt="animated jeo-code red crayfish mascot" width="320" />
+  <img src="assets/character.gif" alt="animated jeo-code red crayfish mascot smart-routing a prompt to the cheapest provider and saving coins" width="320" />
 </p>
 
 <p align="center">
@@ -264,11 +264,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.1]** (2026-07-08) — Fix-forward for a functional regression this same session shipped in v0.8.0. This repo's working tree is shared with a concurrent interactive session; `git add`-ing `src/ai/provider-status.ts` for v0.8.0's routing-veto-gate fix also swept up that session's already-modified, uncommitted copy of the SAME file (containing an unrelated design change: gemini OAuth alone no longer serving `google/gemini-*` models) without its companion piece in `src/auth/flows/index.ts` — so v0.8.0 shipped with a test suite (`provider-status.test.ts`) asserting behavior whose supporting data flag never landed. CI caught this immediately post-release: 2 failing tests on the exact tagged commit. Investigated, confirmed the missing piece was real (and independently observable live via `jeo doctor` before this session had made ANY of its own edits — not a stray/speculative change), and completed it.
+- **[0.8.0]** (2026-07-08) — Root-caused a genuine reliability bug in the routing veto gate ("라우트가 동작후 api 키인증오류가나오는데 근본적인 원인 개선해"), then regenerated the animated README mascot to visualize the smart cross-provider routing this release cycle has been building: prompt routing that finds the cheapest usable path, with a "money saver" visual motif.
 - **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
 - **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
-- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
-- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <img src="assets/character.gif" alt="动态 jeo-code 红色小龙虾吉祥物" width="320" />
+  <img src="assets/character.gif" alt="动态 jeo-code 红色小龙虾吉祥物智能路由到最便宜的提供商并赚取金币" width="320" />
 </p>
 
 <p align="center">
@@ -259,11 +259,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.1]** (2026-07-08) — Fix-forward for a functional regression this same session shipped in v0.8.0. This repo's working tree is shared with a concurrent interactive session; `git add`-ing `src/ai/provider-status.ts` for v0.8.0's routing-veto-gate fix also swept up that session's already-modified, uncommitted copy of the SAME file (containing an unrelated design change: gemini OAuth alone no longer serving `google/gemini-*` models) without its companion piece in `src/auth/flows/index.ts` — so v0.8.0 shipped with a test suite (`provider-status.test.ts`) asserting behavior whose supporting data flag never landed. CI caught this immediately post-release: 2 failing tests on the exact tagged commit. Investigated, confirmed the missing piece was real (and independently observable live via `jeo doctor` before this session had made ANY of its own edits — not a stray/speculative change), and completed it.
+- **[0.8.0]** (2026-07-08) — Root-caused a genuine reliability bug in the routing veto gate ("라우트가 동작후 api 키인증오류가나오는데 근본적인 원인 개선해"), then regenerated the animated README mascot to visualize the smart cross-provider routing this release cycle has been building: prompt routing that finds the cheapest usable path, with a "money saver" visual motif.
 - **[0.7.58]** (2026-07-07) — Applied the previous entry's `routing.crossProviderPool` to the real live session config, then deep-researched every catalogued model's actual public release date (2026-07 sourced, per-provider parallel research with citations) to answer "모델 설정은 2026년도 기준으로 딥서치해서 모델리스트 최신순으로 정렬" — while researching, found and fixed a genuine ranking bug this surfaced: `strongestCredentialed`'s tiebreak on a full capability tie (identical thinking/output/context) fell through to a raw alphabetical canonical-id compare, which silently picked the OLDEST model in a same-spec family (`claude-opus-4-6` over `claude-opus-4-7`/`4-8`, purely because `"4-6" < "4-8"` as a string) — confirmed reproducible before the fix, confirmed corrected after.
 - **[0.7.57]** (2026-07-07) — "동급모델간 크로스 프로바이더 라우팅이 동작하게 개선" — v0.7.56's tier auto-select was single-winner by design (always the one cheapest/strongest model), so a user with `roles.smol` pinned (or simply multiple credentialed providers) never saw actual distribution across equivalent-class models. Deep-research-informed redesign: production LLM routers (LiteLLM, Bifrost/VoidLLM) model this as a named "model group" spanning provider deployments with a distribution strategy, not a single deterministic pick — jeo now supports both, opt-in.
 - **[0.7.56]** (2026-07-07) — "서로다른 프로바이더로 급에 따라 나눠서 설정하도록 개선" — PromptRouter's `trivial`/`complex` tiers previously collapsed to `defaultModel` whenever `roles.smol`/`roles.slow`/`routing.tiers.*` were left unconfigured (the documented "safe no-op absent configuration" contract), which meant a user with multiple providers credentialed never actually got cross-provider routing without hand-picking a model per tier. Also the long-term ask: routing must stay correct as jeo's model catalog evolves, never a hand-maintained tier→model table that goes stale.
-- **[0.7.55]** (2026-07-07) — Cross-provider routing (PromptRouter, v0.7.47+) already named the routed tier in the status bar (v0.7.52), but nothing surfaced WHICH model/provider actually produced a turn's reasoning in the Thinking-block surfaces — a gap noticed while manually verifying the v0.7.52 status-bar work end-to-end.
-- **[0.7.54]** (2026-07-06) — Root-cause fix for a live-reported GPT-5.5 (Codex/ChatGPT OAuth backend) failure: "Error: stream exceeded the overall deadline (JEO_STREAM_MAX_MS) — slow-drip stream aborted". Deep-dive traced this to a REGRESSION in v0.7.42 — a separate, correct fix for a genuinely-different bug (a connected-but-never-terminating stream) silently flipped `streamMaxMs()`'s default from opt-in-off to an ALWAYS-ON 300s overall wall-clock cap, which then killed any HIGH/XHIGH-reasoning-effort completion (GPT-5.5/o3-class) whose ACTIVELY-emitting generation legitimately ran past 5 minutes — OpenAI's own guidance states xhigh trades latency for depth by design. The non-streaming `call()` path (used by every subagent, compaction, and goal-verify call, since none wire `onModelStream`) carried the IDENTICAL bug with zero idle/activity tracking at all, exposed under a different, unhelpful raw `DOMException: The operation timed out.` message instead.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.58",
+  "version": "0.8.1",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-manager.ts

@@ -299,9 +299,12 @@ export function resolveRetryOptions(retry: Config["retry"], kind: "request" | "s
  * OpenAI OAuth (ChatGPT/Codex) only serves Codex models, so any other OpenAI model
  * must use an API key. Kimi OAuth (Kimi Code subscription) only serves the Kimi Code
  * catalog (api.kimi.com/coding) — Moonshot API-platform ids (kimi-latest, moonshot-v1-*)
- * need a KIMI_API_KEY. A provider whose OAuth backend is not verified end-to-end
- * cannot serve any model over OAuth. Everything else (Anthropic Messages, Gemini /
- * Antigravity Cloud Code Assist) is served end-to-end.
+ * need a KIMI_API_KEY. Gemini OAuth no longer masquerades as gemini-cli against Cloud
+ * Code Assist, so it never serves google/gemini-* models on its own — a GEMINI_API_KEY
+ * is required (the SAME models remain OAuth-only reachable via antigravity/*). A
+ * provider whose OAuth backend is not verified end-to-end cannot serve any model over
+ * OAuth. Everything else (Anthropic Messages, Antigravity Cloud Code Assist) is served
+ * end-to-end.
  */
 function oauthServesModel(provider: AuthProvider, model: string): boolean {
   if (provider === "openai") return CODEX_MODELS.includes(model);
@@ -331,8 +334,11 @@ export function effectiveCredentialForProvider(
     const apiKey = config.providers[provider];
     if (apiKey) return { kind: "api_key", provider, token: apiKey };
     if (isOAuthProvider(provider) && OAUTH_FLOW_REGISTRY[provider].verifiedEndToEnd === false) {
+      const hint = provider === "gemini"
+        ? " Or use an antigravity/* model instead — the SAME Gemini models served OAuth-only via Cloud Code Assist (run 'jeo auth login antigravity')."
+        : "";
       throw new Error(
-        `Provider '${provider}' has only an OAuth token, but its OAuth backend is not compatible with the bundled adapter. Set ${provider.toUpperCase()}_API_KEY (or run 'jeo setup') to use ${model}.`,
+        `Provider '${provider}' has only an OAuth token, but its OAuth backend is not compatible with the bundled adapter. Set ${provider.toUpperCase()}_API_KEY (or run 'jeo setup') to use ${model}.${hint}`,
       );
     }
   }
@@ -425,8 +431,10 @@ async function resolveCall(options: Partial<CallOptions>, kind: "request" | "str
 
   if (provider === "antigravity") {
     // Prefer the dedicated Antigravity login (its client is what the agent
-    // backend authorizes); fall back to a gemini-cli OAuth token for users with
-    // their own project/permissions.
+    // backend authorizes); fall back to a plain gemini OAuth token for users with
+    // their own project/permissions — this is now the DEFAULT OAuth-served path for
+    // Gemini models (google/gemini-* itself requires GEMINI_API_KEY, see
+    // `oauthServesModel` above).
     let credential = await resolveCredential("antigravity");
     if (credential.kind !== "oauth") credential = await resolveCredential("gemini");
     if (credential.kind !== "oauth") {

package/src/ai/provider-status.ts

@@ -72,6 +72,21 @@ function oauthLoginInfo(stored: string | StoredOAuth | undefined): { loggedIn: b
   return { loggedIn: true, oauthEmail: stored.email, oauthExpires: stored.expires };
 }
 
+/** True when a stored OAuth entry is DEFINITIVELY unusable right now: its access
+ *  token is past expiry AND it has no refresh token to recover with. This is the
+ *  gap `ready` used to miss — checking only "is a credential object present",
+ *  never whether it's actually alive — so a session could route to a provider
+ *  whose OAuth died (refresh token revoked/missing) and only discover that via a
+ *  raw 401 from the real API call, after routing had already committed to it.
+ *  An expired token WITH a refresh token is NOT flagged dead: `resolveCredential`
+ *  (the real call path) auto-refreshes those before use, so a live refresh token
+ *  self-heals without ever reaching this check. Legacy string-only stored tokens
+ *  (no tracked expiry) are never flagged dead either — there's nothing to check. */
+function oauthEntryDead(stored: string | StoredOAuth | undefined): boolean {
+  if (!stored || typeof stored === "string") return false;
+  return !!stored.expires && stored.expires <= Date.now() && !stored.refresh;
+}
+
 function configuredCredential(provider: AuthProvider, cfg: Config): Credential {
   const stored = cfg.oauth?.[provider];
   const oauth = oauthAccess(stored);
@@ -118,29 +133,39 @@ export async function describeProvider(name: ProviderName, config?: Config): Pro
   }
   const ownProvider = name as AuthProvider;
   const ownCred = configuredCredential(ownProvider, cfg);
-  // Antigravity prefers its own login but accepts a gemini-cli OAuth fallback.
+  // Antigravity prefers its own login but accepts a gemini OAuth fallback (the
+  // DEFAULT OAuth-served path for Gemini models now that plain gemini/* requires
+  // an API key).
   const cred = name === "antigravity" && ownCred.kind === "none" ? configuredCredential("gemini", cfg) : ownCred;
   const credentialProvider: AuthProvider = name === "antigravity" && ownCred.kind === "none" ? "gemini" : ownProvider;
   const effective = name === "antigravity" ? cred : effectiveCredential(credentialProvider, cred, cfg);
   const kind: CredentialKind = effective.kind === "api_key" ? "api_key" : effective.kind === "oauth" ? "oauth" : "none";
   const baseUrl = name === "openai" && kind !== "oauth" ? cfg.openaiBaseUrl : undefined;
-  let ready = kind !== "none" || (name === "openai" && !!cfg.openaiBaseUrl);
+  let ready = kind === "api_key" || (kind === "oauth" && !oauthEntryDead(cfg.oauth?.[credentialProvider])) || (name === "openai" && !!cfg.openaiBaseUrl);
   let label = ready && kind === "none" ? "keyless (local base URL)" : credentialLabel(kind);
   if (name === "antigravity") {
-    const hasOwnOAuth = ownCred.kind === "oauth";
-    const hasGeminiFallback = !hasOwnOAuth && configuredCredential("gemini", cfg).kind === "oauth";
-    ready = hasOwnOAuth;
+    const hasOwnOAuth = ownCred.kind === "oauth" && !oauthEntryDead(cfg.oauth?.antigravity);
+    const hasGeminiFallback = !hasOwnOAuth && configuredCredential("gemini", cfg).kind === "oauth" && !oauthEntryDead(cfg.oauth?.gemini);
+    const ownDead = ownCred.kind === "oauth" && !hasOwnOAuth;
+    ready = hasOwnOAuth || hasGeminiFallback;
     label = hasOwnOAuth
       ? "OAuth (Antigravity Cloud Code Assist)"
       : hasGeminiFallback
-        ? "OAuth catalog via Gemini CLI; calls need 'jeo auth login antigravity'"
-        : "none (run 'jeo auth login antigravity')";
+        ? "OAuth (Cloud Code Assist via gemini login fallback)"
+        : ownDead
+          ? "OAuth expired, no refresh token — run 'jeo auth login antigravity' to re-authenticate"
+          : "none (run 'jeo auth login antigravity')";
+  } else if (name === "gemini" && kind === "oauth") {
+    // OAuth alone no longer serves google/gemini-* (the gemini-cli/Cloud Code Assist
+    // masquerade was removed) — GEMINI_API_KEY is required. The SAME models remain
+    // OAuth-only reachable via antigravity/*.
+    ready = false;
+    label = "OAuth catalog only; set GEMINI_API_KEY, or use antigravity/* models (Cloud Code Assist)";
   } else if (kind === "oauth" && isOAuthProvider(credentialProvider) && OAUTH_FLOW_REGISTRY[credentialProvider].verifiedEndToEnd === false) {
     ready = false;
     label = "OAuth (API key needed)";
-  } else if (name === "gemini" && kind === "oauth") {
-    // gemini-cli OAuth is served end-to-end via Cloud Code Assist — no API key.
-    label = "OAuth (Gemini CLI / Cloud Code Assist)";
+  } else if (kind === "oauth" && oauthEntryDead(cfg.oauth?.[credentialProvider])) {
+    label = `OAuth expired, no refresh token — run 'jeo auth login ${credentialProvider}' to re-authenticate`;
   }
   // Login status reflects the provider's OWN stored OAuth (e.g. "logged in to antigravity"),
   // independent of any cross-provider credential fallback used for readiness.

package/src/auth/flows/index.ts

@@ -39,11 +39,11 @@ export const OAUTH_FLOW_REGISTRY: Record<OAuthProvider, OAuthFlow> = {
   },
   gemini: {
     provider: "gemini",
-    label: "Google (Gemini CLI / Cloud Code Assist)",
+    label: "Google (Gemini API)",
     login: loginGoogle,
     refresh: refreshGoogleToken,
-    verifiedEndToEnd: true,
-    note: "Served via the Cloud Code Assist backend (cloudcode-pa.googleapis.com) with an auto-discovered project — gemini-cli parity, no API key needed. A GEMINI_API_KEY, when set, takes precedence and uses the public generativelanguage API.",
+    verifiedEndToEnd: false,
+    note: "This OAuth login alone no longer serves google/gemini-* models (the Cloud Code Assist / gemini-cli masquerade was removed) — set GEMINI_API_KEY to use them. The SAME Gemini models remain reachable OAuth-only via antigravity/* (run 'jeo auth login antigravity'; this gemini login also works as its fallback credential).",
   },
   antigravity: {
     provider: "antigravity",