jeo-code 0.7.6 → 0.7.8

package/CHANGELOG.md

@@ -6,6 +6,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.8] - 2026-06-24
+_Long-session performance & resource hygiene: the detached memory-distill worker now always terminates itself (closing the `jeo memory-distill` orphan pileup that pinned each session's transcript in RSS), the live reasoning/output block re-wraps only its trailing window (O(tail) per frame instead of O(len²) over a long stream), the team loop stops reprinting the todo guide every iteration, and the readline caret stays aligned after an image attach._
+
+### Fixed
+- **The detached memory-distill worker always terminates itself.** `runMemoryDistillCommand` now wraps its work in `try/finally` and calls an injected `exit` (defaulting to `process.exit`) on every path — success, broken payload, and missing payload. `distillSessionMemory` caps the LLM call with a `Promise.race` timeout, but the race only *rejects*; it never aborts the underlying fetch, so a stalled provider socket kept the child's event loop alive and the `jeo memory-distill` worker lingered forever — one orphan per session, each pinning the full transcript in RSS (the observed "jeo bun" CPU/memory creep). An explicit exit closes the socket and reclaims the process.
+- **The live reasoning/output block re-wraps only its trailing window.** The wrap memo in `app.ts` keyed on the full (up-to-hundreds-of-KB) buffer, so every 120 ms tick and every stream delta copied + compared the whole growing string — O(len) per frame, O(len²) over a long reasoning/tool stream (the streaming slowdown). `liveBlockWrapKey` now slices the ≤16 KB tail first, then keys + wraps that: identical visible output, O(tail) per frame regardless of total size.
+- **The team loop no longer reprints the todo guide every iteration.** `runTeamEngine` printed `formatRalphTodoGuide` once per task — O(N²) lines that climbed the embedded-terminal renderer's CPU on a long task list. The guide prints once up front; per-task progress lines carry the rest.
+- **The readline caret stays aligned after an image attach.** Both the paste and Ctrl+V image-attach paths now call readline's internal `_refreshLine()` after swapping the `[image #n]` tag in (mirroring the slash/tab-completion accept paths), so the stale row/cursor model no longer offsets the real caret several columns on the next keystroke.
+
+### Verified
+- `bun run typecheck` clean; full suite green — 1914 pass / 0 fail across 229 files — including the new `runMemoryDistillCommand` always-exits assertions (success + no-payload paths) and the `liveBlockWrapKey` bounded-key / tail-collision tests.
+
+
+## [0.7.7] - 2026-06-23
+_Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers._
+
+### Added
+- **Process-group reaper for backgrounded subprocesses (`src/agent/process-reaper.ts`).** `bashTool` now spawns each command as its own process-group leader (`Bun.spawn` `detached:true` on POSIX), so a backgrounded grandchild — `npm run dev &`, `next dev &`, a daemon, `nohup …` — joins that group and the whole subtree is reaped with a single `process.kill(-pgid)` at the turn boundary, **without ever touching jeo's own group**. This closes the leak where a reparented `next-server` survived every turn and the resident set climbed monotonically across a session. Reaping is precise (only groups jeo spawned, never a name-based `pkill`), O(1) (one group signal, no process-table scan), and deterministic (closed at the exact turn that creates it). A `unref`'d periodic sweep is a belt-and-suspenders net for turns that abort before cleanup; opt out with `JEO_KEEP_BACKGROUND=1`, tune the sweep with `JEO_REAP_INTERVAL_MS`.
+- **Recursive fuzzy `@path` mention search (`src/commands/launch/mentions.ts`).** A bare `@frag` now walks the project tree (bounded by depth/scan/result caps, skipping `node_modules`/`.git`/build/VCS dirs) and ranks hits basename-prefix → substring → subsequence, then shallowest/shortest/alphabetical; a `@dir/` prefix lists that single directory. Autocomplete returns the matcher's pool as-is instead of re-filtering by strict prefix.
+
+### Changed
+- **ralplan draft passes route to their per-role configured model.** `runRalplanEngine` now resolves `planner`/`architect`/`critic` subagent models from config and threads each through `callRole`, so the Planner/Architect/Critic drafting + revision calls use their own model; the consensus critic gate continues to resolve its model independently.
+- **OSC 52 clipboard copy exposes a configurable size cap and honest skip signal.** `copyTextToClipboard` reads `JEO_OSC52_MAX` for the base64 payload cap and returns `osc52SkippedTooLarge` when the remote (SSH/tmux) clipboard was skipped for an oversized payload, so the caller can warn instead of silently dropping the remote path; tmux DCS passthrough wrapping is documented.
+
+### Fixed
+- **Salvaged answers and `done` reasons strip leaked reasoning/tool-call markup.** `stripLeakedReasoningTags` (`src/ai/think-tags.ts`) removes `<think>…</think>` blocks, an unmatched `</think>` reasoning prefix, stray `<tool_call>`/`<parameter>`/`antml:*` scaffolding, and Harmony `<|channel|>` markers from a model's final visible text, so API-entered models that emit inline scaffolding no longer surface raw tags in the salvaged prose answer or the `done` reason.
+- **Bracketed paste is ANSI-safe and idle-merged.** Pasted ANSI-colored terminal output is stripped of escape sequences and stray C0 control bytes across every paste path (`stripPasteEscapes`/`pasteEscapeLength`) so it no longer corrupts the input box; a partial paste marker split across stdin chunks is carried (`pasteMarkerTailLength`/`endsInPaste`); and the dropped-end-marker fallback is now **idle-based** (`pasteIdleDecision`, 250ms since the last buffered line) so a large paste streaming in over >250ms is never cut mid-paste.
+
+### Verified
+- `bun run typecheck` clean; touched suites pass — `test/process-reaper.test.ts`, `test/ralplan-draft-model.test.ts`, `test/prompt-key-filter.test.ts`, `test/launch-mentions.test.ts`, `test/clipboard.test.ts`, `test/think-tags.test.ts`, `test/engine-salvage.test.ts` (90 pass / 0 fail) covering group-kill target selection, alive/grace-window reaping, recursive fuzzy mention ranking, escaped-pipe-free paste sanitizing + partial-marker carry + idle merge, the OSC 52 cap/skip signal, per-role ralplan routing, and leaked-tag stripping on salvaged output.
+
 ## [0.7.6] - 2026-06-23
 _Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release._
 

package/README.ja.md

@@ -193,11 +193,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.8]** (2026-06-24) — Long-session performance & resource hygiene: the detached memory-distill worker now always terminates itself (closing the `jeo memory-distill` orphan pileup that pinned each session's transcript in RSS), the live reasoning/output block re-wraps only its trailing window (O(tail) per frame instead of O(len²) over a long stream), the team loop stops reprinting the todo guide every iteration, and the readline caret stays aligned after an image attach.
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
 - **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
-- **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -193,11 +193,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.8]** (2026-06-24) — Long-session performance & resource hygiene: the detached memory-distill worker now always terminates itself (closing the `jeo memory-distill` orphan pileup that pinned each session's transcript in RSS), the live reasoning/output block re-wraps only its trailing window (O(tail) per frame instead of O(len²) over a long stream), the team loop stops reprinting the todo guide every iteration, and the readline caret stays aligned after an image attach.
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
 - **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
-- **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -195,11 +195,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.8]** (2026-06-24) — Long-session performance & resource hygiene: the detached memory-distill worker now always terminates itself (closing the `jeo memory-distill` orphan pileup that pinned each session's transcript in RSS), the live reasoning/output block re-wraps only its trailing window (O(tail) per frame instead of O(len²) over a long stream), the team loop stops reprinting the todo guide every iteration, and the readline caret stays aligned after an image attach.
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
 - **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
-- **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -193,11 +193,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.8]** (2026-06-24) — Long-session performance & resource hygiene: the detached memory-distill worker now always terminates itself (closing the `jeo memory-distill` orphan pileup that pinned each session's transcript in RSS), the live reasoning/output block re-wraps only its trailing window (O(tail) per frame instead of O(len²) over a long stream), the team loop stops reprinting the todo guide every iteration, and the readline caret stays aligned after an image attach.
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
 - **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
-- **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",
@@ -64,5 +64,6 @@
     "playwright": "^1.61.0",
     "typescript": "^5.6.3",
     "ws": "^8.21.0"
-  }
+  },
+  "packageManager": "pnpm@10.33.4+sha512.1c67b3b359b2d408119ba1ed289f34b8fc3c6873412bec6fd264fbdc82489e510fcbecb9ce9d22dae7f3b76269d8441046014bdca53b9979cd7a561ad631b800"
 }

package/src/agent/AGENTS.md

@@ -25,6 +25,7 @@ The core runtime loop, tool registry, session management, and state persistence
 | `output-minimizer.ts` | Brief description of purpose |
 | `output-util.ts` | Brief description of purpose |
 | `plan.ts` | Subagent planning structures and validation |
+| `process-reaper.ts` | Background-process reaper: spawns bash in its own process group (POSIX detached) so backgrounded grandchildren (`next dev &`, daemons) are reaped by group at turn end instead of orphaning and accumulating (`JEO_KEEP_BACKGROUND=1` opts out, `JEO_REAP_INTERVAL_MS` tunes the periodic safety-net sweep) |
 | `seed.ts` | Brief description of purpose |
 | `session.ts` | Session context building, compaction, and history management |
 | `state.ts` | File-backed state and session persistence (`.jeo/state/`) |

package/src/agent/engine.ts

@@ -24,6 +24,7 @@ import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSigna
 import { historyTokens, trimToolResultsInPlace } from "./compaction";
 import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, repeatHint, classifyDoneGate } from "./loop-guards";
+import { stripLeakedReasoningTags } from "../ai/think-tags";
 
 
 async function invokeCallLlm(history: Message[], options: {
@@ -644,7 +645,9 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       parseFailures++;
       if (trimmed && (!trimmed.includes("{") || parseFailures > MAX_PARSE_BOUNCES)) {
         pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-        return finish({ done: true, steps: step, doneReason: trimmed });
+        // Strip leaked <think>/<parameter>/Harmony scaffolding some API-entered
+        // models emit inline so the salvaged answer doesn't surface raw tags.
+        return finish({ done: true, steps: step, doneReason: stripLeakedReasoningTags(trimmed) || trimmed });
       }
       pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
       history.push({
@@ -760,7 +763,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           continue;
         }
       }
-      return finish({ done: true, steps: step, doneReason: (toolCalls[0].arguments?.reason as string) ?? "" });
+      return finish({ done: true, steps: step, doneReason: stripLeakedReasoningTags((toolCalls[0].arguments?.reason as string) ?? "") });
     }
 
     // Anti-spin guard, checked BEFORE execution: a repeated identical step must

package/src/agent/memory.ts

@@ -876,21 +876,37 @@ export async function spawnDetachedDistill(
 }
 
 /** CLI worker for the detached child: payload → distill → cleanup. Silent by design. */
-export async function runMemoryDistillCommand(args: string[]): Promise<void> {
-  const payloadPath = (args[0] ?? "").trim();
-  if (!payloadPath) return;
+export async function runMemoryDistillCommand(
+  args: string[],
+  // Injected for tests; the REAL detached worker must terminate ITSELF. distillSessionMemory
+  // caps the LLM call with a Promise.race timeout, but the race only REJECTS — it never aborts
+  // the underlying fetch. A stalled provider socket therefore stays open, the worker's event
+  // loop never drains, and the `jeo memory-distill` child lingers forever — one orphan per
+  // session, each pinning the full transcript in RSS. That is the observed "jeo bun" pileup
+  // (CPU/memory creeping up over time). An explicit exit closes the socket and reclaims it.
+  exit: (code: number) => void = (code) => process.exit(code),
+): Promise<void> {
   try {
-    const payloadContent = await fs.readFile(payloadPath, "utf-8");
-    const payload = JSON.parse(payloadContent) as { model?: string; messages?: Message[] };
-    const bundleDir = path.join(process.cwd(), ".jeo", "memory");
-    await saveRawPayload(bundleDir, payload);
-    if (Array.isArray(payload.messages)) {
-      await distillSessionMemory(payload.messages, process.cwd(), { model: payload.model });
+    const payloadPath = (args[0] ?? "").trim();
+    if (!payloadPath) return;
+    try {
+      const payloadContent = await fs.readFile(payloadPath, "utf-8");
+      const payload = JSON.parse(payloadContent) as { model?: string; messages?: Message[] };
+      const bundleDir = path.join(process.cwd(), ".jeo", "memory");
+      await saveRawPayload(bundleDir, payload);
+      if (Array.isArray(payload.messages)) {
+        await distillSessionMemory(payload.messages, process.cwd(), { model: payload.model });
+      }
+    } catch {
+      // best-effort — a broken payload must not leave error noise in a detached child
+    } finally {
+      await fs.unlink(payloadPath).catch(() => {});
     }
-  } catch {
-    // best-effort — a broken payload must not leave error noise in a detached child
   } finally {
-    await fs.unlink(payloadPath).catch(() => {});
+    // Guaranteed on every path (incl. the no-payload early return and a distill timeout):
+    // never leave the detached worker alive waiting on a dangling fetch.
+    exit(0);
   }
 }
 
+

package/src/agent/process-reaper.ts

@@ -0,0 +1,200 @@
+/**
+ * Background-process reaper for the bash tool (src/agent/tools.ts:bashTool).
+ *
+ * THE LEAK IT CLOSES
+ * ------------------
+ * When a model command backgrounds a long-lived grandchild — `npm run dev &`,
+ * `next dev &`, a daemon, `nohup …` — the bash SHELL exits immediately but the
+ * grandchild is reparented to init (PID 1) and keeps running. jeo's bash tool
+ * kills the shell, not the subtree, so on Linux that grandchild survives every
+ * turn. Each `next dev` restart that doesn't kill its predecessor leaves another
+ * live `next-server` holding hundreds of MB; across a session the resident set
+ * climbs monotonically — the reported "next-server 메모리 점유율이 점점 높아진다".
+ *
+ * THE FIX (more efficient than name-based periodic `pkill`)
+ * --------------------------------------------------------
+ * bashTool now spawns each command as its OWN process-group leader (Bun.spawn
+ * `detached:true` ⇒ pgid == shell pid on POSIX). A backgrounded grandchild joins
+ * that group, so the whole subtree is reachable by a single `process.kill(-pgid)`
+ * WITHOUT touching jeo (which lives in a different group). Reaping is therefore:
+ *   - PRECISE   — only groups jeo itself spawned, never a `pkill -f next-server`
+ *                 that could nuke a dev server the user runs in another terminal;
+ *   - O(1)      — one group signal, no full process-table scan per sweep;
+ *   - DETERMINISTIC — the leak is closed at the exact turn boundary that creates
+ *                 it, so steady-state cost is zero (the periodic sweep below is a
+ *                 belt-and-suspenders net for turns that abort before cleanup).
+ *
+ * This module is the pure, injectable core: `killSpec` decides the signal target
+ * and `BackgroundReaper` tracks groups + reaps the orphaned ones. All OS effects
+ * (`kill`, the clock) are injected so the selection logic is unit-testable.
+ */
+
+import { jeoEnv } from "../util/env";
+
+export type KillFn = (pid: number, signal?: string | number) => void;
+
+/** A spawned shell tracked for reaping. `grouped` is true when it leads its own
+ *  process group (POSIX detached spawn) and can be signalled as `-pid`. */
+export interface ReapTarget {
+  /** Shell pid; equals the process-group id when `grouped` (detached) is true. */
+  pid: number;
+  /** Spawned as a process-group leader (POSIX detached) — group-killable. */
+  grouped: boolean;
+}
+
+/**
+ * The argument to pass to `process.kill`: the NEGATED pgid to signal the whole
+ * group (reaping backgrounded grandchildren) when the shell leads its own group,
+ * or the bare pid otherwise. A group-kill is only safe when `grouped` — signalling
+ * `-pid` of a non-leader would hit jeo's own group and self-terminate the agent;
+ * Windows has no POSIX process groups, so it always falls back to the bare pid.
+ */
+export function killSpec(target: ReapTarget, platform: NodeJS.Platform = process.platform): number {
+  if (target.grouped && platform !== "win32") return -target.pid;
+  return target.pid;
+}
+
+interface GroupRecord extends ReapTarget {
+  /** Short human label (the command head) for diagnostics. */
+  label: string;
+  registeredAt: number;
+}
+
+export interface ReaperDeps {
+  /** Inject for tests; defaults to process.kill. Signal `0` is a liveness probe. */
+  kill?: KillFn;
+  now?: () => number;
+  platform?: NodeJS.Platform;
+}
+
+/**
+ * Tracks process groups jeo's bash tool spawned and reaps the ones still alive.
+ * Registration happens when a command leaves a lingering background grandchild;
+ * `reap()` SIGKILLs each registered group that is still alive and forgets it.
+ */
+export class BackgroundReaper {
+  private groups = new Map<number, GroupRecord>();
+  private readonly kill: KillFn;
+  private readonly now: () => number;
+  private readonly platform: NodeJS.Platform;
+
+  constructor(deps: ReaperDeps = {}) {
+    this.kill = deps.kill ?? ((pid, signal) => process.kill(pid, signal as NodeJS.Signals));
+    this.now = deps.now ?? Date.now;
+    this.platform = deps.platform ?? process.platform;
+  }
+
+  get size(): number {
+    return this.groups.size;
+  }
+
+  /** Track a spawned shell's group as a reap candidate (idempotent per pid). */
+  register(target: ReapTarget, label = ""): void {
+    if (!Number.isInteger(target.pid) || target.pid <= 1) return; // never 0/-1/1 (init)
+    this.groups.set(target.pid, { ...target, label: label.slice(0, 80), registeredAt: this.now() });
+  }
+
+  /** Forget a group (e.g. the command cleaned itself up). */
+  unregister(pid: number): void {
+    this.groups.delete(pid);
+  }
+
+  /** True if any process in the target's group is still alive (signal-0 probe). */
+  private isAlive(rec: ReapTarget): boolean {
+    try {
+      this.kill(killSpec(rec, this.platform), 0);
+      return true;
+    } catch {
+      return false; // ESRCH ⇒ nothing left in the group
+    }
+  }
+
+  /** Best-effort SIGKILL of one tracked group; returns true if a signal landed. */
+  reapOne(pid: number): boolean {
+    const rec = this.groups.get(pid);
+    if (!rec) return false;
+    this.groups.delete(pid);
+    if (!this.isAlive(rec)) return false;
+    try {
+      this.kill(killSpec(rec, this.platform), "SIGKILL");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Reap tracked groups. Default: only groups still alive (the leaked orphans).
+   * `olderThanMs` limits reaping to groups registered before now-olderThanMs, so a
+   * brand-new turn's background child gets a grace window before the periodic sweep
+   * claims it. Returns the pids that received a kill.
+   */
+  reap(opts: { olderThanMs?: number } = {}): number[] {
+    const reaped: number[] = [];
+    const cutoff = opts.olderThanMs != null ? this.now() - opts.olderThanMs : Infinity;
+    for (const [pid, rec] of [...this.groups]) {
+      if (rec.registeredAt > cutoff) continue;
+      this.groups.delete(pid);
+      if (!this.isAlive(rec)) continue;
+      try {
+        this.kill(killSpec(rec, this.platform), "SIGKILL");
+        reaped.push(pid);
+      } catch {
+        /* group vanished between probe and kill — fine */
+      }
+    }
+    return reaped;
+  }
+
+  /** Drop all tracking without signalling (used when reaping is disabled). */
+  clear(): void {
+    this.groups.clear();
+  }
+}
+
+/** Process-group spawning + background reaping are on unless opted out. */
+export function isBackgroundReapEnabled(env: Record<string, string | undefined> = process.env): boolean {
+  return jeoEnv("KEEP_BACKGROUND", env) !== "1";
+}
+
+/** Periodic-sweep cadence; 0/invalid disables the timer (deterministic reap still runs). */
+export function reapIntervalMs(env: Record<string, string | undefined> = process.env): number {
+  const raw = jeoEnv("REAP_INTERVAL_MS", env);
+  if (raw == null) return 30_000;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : 30_000;
+}
+
+/** Shared session-scoped reaper used by the bash tool. */
+export const backgroundReaper = new BackgroundReaper();
+
+let sweeper: ReturnType<typeof setInterval> | undefined;
+
+/**
+ * Lazily start the periodic safety-net sweep (idempotent). It reaps any tracked
+ * group that outlived a grace window — covering turns that abort before their
+ * deterministic finally-block reap runs. The timer is `unref`'d so it never keeps
+ * the process alive, and a 0 interval (or KEEP_BACKGROUND=1) skips it entirely.
+ */
+export function ensureBackgroundSweeper(
+  reaper: BackgroundReaper = backgroundReaper,
+  env: Record<string, string | undefined> = process.env,
+): void {
+  if (sweeper || !isBackgroundReapEnabled(env)) return;
+  const interval = reapIntervalMs(env);
+  if (interval <= 0) return;
+  sweeper = setInterval(() => {
+    // Grace = one interval: a background child younger than this is left for its
+    // own turn's finally-block to reap, so the sweep only claims true orphans.
+    reaper.reap({ olderThanMs: interval });
+  }, interval);
+  (sweeper as { unref?: () => void }).unref?.();
+}
+
+/** Stop the periodic sweep (tests / shutdown). */
+export function stopBackgroundSweeper(): void {
+  if (sweeper) {
+    clearInterval(sweeper);
+    sweeper = undefined;
+  }
+}

package/src/agent/tools.ts

@@ -4,6 +4,13 @@ import * as path from "node:path";
 import { readWorkflowStateStrict, type WorkflowState } from "./state";
 import { jeoEnv } from "../util/env";
 import { READ_OUTPUT_MAX } from "./tool-output";
+import {
+  backgroundReaper,
+  ensureBackgroundSweeper,
+  isBackgroundReapEnabled,
+  killSpec,
+  type ReapTarget,
+} from "./process-reaper";
 
 /** Read the deep-interview lock; on corrupt state fail CLOSED (treat as active lock). */
 async function readMutationLock(cwd: string): Promise<WorkflowState | null> {
@@ -634,7 +641,13 @@ export async function bashTool(
     const safeEnv = env && !Array.isArray(env)
       ? Object.fromEntries(Object.entries(env).filter(([, v]) => typeof v === "string")) as Record<string, string>
       : undefined;
-    // Run the command using Bun's native spawn
+    // Run the command using Bun's native spawn. When background reaping is on
+    // (default, POSIX), spawn the shell as its OWN process-group leader so a
+    // backgrounded grandchild (`next dev &`, a daemon) joins that group and the
+    // whole subtree is reapable via `process.kill(-pid)` without hitting jeo.
+    const reapBackground = isBackgroundReapEnabled();
+    const grouped = reapBackground && process.platform !== "win32";
+    if (grouped) ensureBackgroundSweeper();
     const proc = Bun.spawn(["bash", "-c", command], {
       cwd: runCwd,
       // Detach stdin (no inherited TTY): a command that reads stdin (`cat`, `read`,
@@ -643,9 +656,21 @@ export async function bashTool(
       stdin: "ignore",
       stdout: "pipe",
       stderr: "pipe",
+      // Own process group ⇒ group-killable subtree (reaps backgrounded grandchildren).
+      ...(grouped ? { detached: true } : {}),
       // Inherit the parent env; merge caller-supplied (sanitized) vars on top.
       ...(safeEnv && Object.keys(safeEnv).length ? { env: { ...process.env, ...safeEnv } } : {}),
     });
+    const reapTarget: ReapTarget = { pid: proc.pid, grouped };
+    // Signal the whole process group when grouped (so a `cmd &` grandchild dies
+    // too), else fall back to the bare shell pid. `force` ⇒ SIGKILL, else SIGTERM.
+    const killTree = (force: boolean): void => {
+      const sig = force ? "SIGKILL" : "SIGTERM";
+      if (grouped) {
+        try { process.kill(killSpec(reapTarget), sig); return; } catch { /* fall through */ }
+      }
+      try { force ? proc.kill(9) : proc.kill(); } catch {}
+    };
 
     let timedOut = false;
     let aborted = false;
@@ -674,14 +699,14 @@ export async function bashTool(
       // SIGKILL step ALSO cut the readers: the old code killed the shell but never
       // cancelled the readers, so an orphan-held pipe outlived the deadline and the
       // turn hung forever (the reported freeze).
-      try { proc.kill(); } catch {}
-      killTimer = setTimeout(() => { try { proc.kill(9); } catch {} cancelReaders(); }, 3_000);
+      killTree(false);
+      killTimer = setTimeout(() => { killTree(true); cancelReaders(); }, 3_000);
     }, TIMEOUT_MS);
     // Abort wiring: if the turn is cancelled, SIGKILL the child immediately AND cancel
     // both pipe readers so the drain loops unwind at once.
     const onAbort = () => {
       aborted = true;
-      try { proc.kill(9); } catch {}
+      killTree(true);
       cancelReaders();
     };
     if (signal) {
@@ -728,10 +753,17 @@ export async function bashTool(
       clearTimeout(timer);
       if (killTimer) clearTimeout(killTimer);
       if (signal) signal.removeEventListener("abort", onAbort);
-      // Reap a still-alive child (normal exit, abort, or timeout) so no orphaned
-      // process survives, then force any pipe still held open (backgrounded
-      // grandchild) closed so the awaits below cannot hang.
-      if (proc.exitCode === null && proc.signalCode === null) { try { proc.kill(9); } catch {} }
+      // Reap a still-alive shell (abort/timeout) AND any backgrounded grandchild it
+      // left behind. A `next dev &` / daemon survives the shell's exit by reparenting
+      // to init and would otherwise accumulate every turn (rising next-server RSS);
+      // group-SIGKILL claims the whole subtree. Register first so the periodic sweep
+      // retries if this signal raced the reparent. Skipped when KEEP_BACKGROUND=1.
+      if (proc.exitCode === null && proc.signalCode === null) {
+        killTree(true);
+      } else if (grouped && reapBackground) {
+        backgroundReaper.register(reapTarget, command);
+        backgroundReaper.reapOne(proc.pid);
+      }
       cancelReaders();
     }
     const stdout = await stdoutPromise;

package/src/ai/think-tags.ts

@@ -82,3 +82,33 @@ export function createThinkSplitter(onReasoning?: (delta: string) => void): Thin
 
   return { push, flush };
 }
+
+/**
+ * Strip leaked reasoning / tool-call markup from a model's FINAL visible text
+ * (a salvaged prose answer or a `done` reason). Some API-entered models emit
+ * XML/Harmony-style scaffolding — `<think>…</think>`, `<parameter>…</parameter>`,
+ * `<tool_call>`, `<|channel|>` markers — inside their plain-text reply. The
+ * streaming {@link createThinkSplitter} only removes *matched* think pairs seen
+ * mid-stream; an unmatched `</think>` (a model that begins already "inside" its
+ * reasoning) or stray parameter tags leak through into the answer. This is a
+ * whole-text cleanup, safe to run once on the final string: text with no such
+ * markup is returned trimmed-but-otherwise-unchanged.
+ */
+export function stripLeakedReasoningTags(text: string): string {
+  let s = text;
+  // 1) Drop balanced <think>…</think> blocks.
+  s = s.replace(/<think\b[^>]*>[\s\S]*?<\/think>/gi, "");
+  // 2) An unmatched closing </think> implies an implicit reasoning prefix the
+  //    splitter never saw an opener for: drop everything up to and including the
+  //    LAST such close tag, keeping only the answer that follows it.
+  const lastClose = s.toLowerCase().lastIndexOf("</think>");
+  if (lastClose !== -1) s = s.slice(lastClose + "</think>".length);
+  // 3) Remove stray tool-call / parameter scaffolding tags (keep their inner text).
+  s = s.replace(
+    /<\/?(?:think|tool_call|tool_response|tool_result|parameter|invoke|function|function_call|antml:[a-z_]+)\b[^>]*>/gi,
+    "",
+  );
+  // 4) Remove Harmony channel markers like <|channel|>, <|message|>, <|end|>.
+  s = s.replace(/<\|[^|>]*\|>/g, "");
+  return s.trim();
+}

package/src/commands/launch/input.ts

@@ -231,6 +231,51 @@ export function rewriteCursorCombos(plain: string): string {
   return out;
 }
 
+/** Byte length of a terminal ESCAPE SEQUENCE beginning at `s[i]`, else 0 — used to STRIP
+ *  escapes embedded in PASTED text (copied colored terminal output carries `\x1b[31m`-style
+ *  SGR codes; left intact they reach readline as literal escapes that corrupt the input box,
+ *  or as leftover `[31m` garbage text). Covers CSI (`ESC [ … final-byte`), OSC/DCS/PM/APC/SOS
+ *  (`ESC ] | P | ^ | _ | X … ST|BEL`), and the two-byte `ESC <char>` form. A sequence split
+ *  across the end of the segment consumes the remaining tail. */
+export function pasteEscapeLength(s: string, i: number): number {
+  if (s[i] !== "\u001b") return 0;
+  const c = s[i + 1];
+  if (c === undefined) return 1; // lone trailing ESC
+  if (c === "[") { // CSI: params/intermediates until a final byte 0x40–0x7e
+    let j = i + 2;
+    while (j < s.length && !(s[j]! >= "\u0040" && s[j]! <= "\u007e")) j++;
+    return (j < s.length ? j + 1 : s.length) - i;
+  }
+  if (c === "]" || c === "P" || c === "^" || c === "_" || c === "X") { // OSC/DCS/PM/APC/SOS → ST or BEL
+    let j = i + 2;
+    while (j < s.length) {
+      if (s[j] === "\u0007") return j + 1 - i;                         // BEL
+      if (s[j] === "\u001b" && s[j + 1] === "\\") return j + 2 - i;    // ST
+      j++;
+    }
+    return s.length - i;
+  }
+  return 2; // two-byte ESC <char>
+}
+
+/** Remove every terminal escape sequence AND stray C0 control byte (except `\t`/`\n`/`\r`,
+ *  which carry layout meaning the caller handles) from a chunk of PASTED text, so copied
+ *  ANSI-colored output drops to its plain characters instead of corrupting the prompt.
+ *  Shared by every paste path (the idle key-filter, the live-turn drain, mid-turn capture)
+ *  so they sanitize identically. */
+export function stripPasteEscapes(s: string): string {
+  let out = "";
+  let i = 0;
+  while (i < s.length) {
+    const esc = pasteEscapeLength(s, i);
+    if (esc > 0) { i += esc; continue; }
+    const ch = s[i]!;
+    if (ch === "\n" || ch === "\r" || ch === "\t" || ch >= " ") out += ch;
+    i += 1;
+  }
+  return out;
+}
+
 export interface PromptInputQueue {
   pendingLines: string[];
   partial: string;
@@ -267,12 +312,13 @@ function feedTypedSegment(state: PromptInputQueue, segment: string): boolean {
 }
 
 /** Pasted body: pure DATA — newlines split commands into pastedLines, the trailing
- *  partial stays editable, and control bytes (incl. any stray ESC from copied ANSI
- *  text) are dropped instead of being interpreted as keystrokes. */
+ *  partial stays editable, and any ANSI escape sequence from copied terminal output is
+ *  STRIPPED (via `stripPasteEscapes`) instead of being interpreted/leaked as keystrokes.
+ *  Shares the sanitizer with the idle key-filter so every paste path behaves identically. */
 function feedPasteBody(state: PromptInputQueue, body: string): boolean {
   if (!body) return false;
   let accepted = false;
-  const normalized = body.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  const normalized = stripPasteEscapes(body).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
   for (const ch of Array.from(normalized)) {
     if (ch === "\n") {
       state.pastedLines.push(state.partial);
@@ -335,7 +381,7 @@ function feedLivePromptSegment(state: PromptInputQueue, segment: string): boolea
 
 function feedLivePromptPasteBody(state: PromptInputQueue, body: string): boolean {
   if (!body) return false;
-  const normalized = body.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  const normalized = stripPasteEscapes(body).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
   const flattened = normalized.split("\n").map(part => part.trim()).filter(Boolean).join(" ");
   if (!flattened) return false;
   state.partial = state.partial ? `${state.partial} ${flattened}` : flattened;
@@ -532,9 +578,46 @@ export interface PromptKeyFilterEnv {
 }
 
 /** Carried across chunks: a bracketed paste can span several stdin chunks, so the
- *  in-paste flag must survive between filter calls. */
+ *  in-paste flag must survive between filter calls. `carry` holds a trailing byte run
+ *  that MIGHT be the start of a split escape sequence — a bracketed-paste marker
+ *  (`\x1b[200~`/`\x1b[201~`) or a `\r` that could be the front of a `\r\n` — sliced off
+ *  the end of one chunk and re-prepended to the next so a marker straddling a stdin read
+ *  boundary is never half-interpreted (the "긴 텍스트 붙여넣으면 `00~`/`[201~` 쓰레기가
+ *  새거나 중간에 제출됨" corruption). Concatenation is always re-parsed, so carrying is
+ *  safe even when the tail turns out NOT to be a marker. */
 export interface PromptKeyFilterState {
   inPaste: boolean;
+  carry?: string;
+}
+
+/** Length of the longest trailing run of `data` that is a PROPER prefix of a
+ *  bracketed-paste marker (so it could be a marker split across a stdin chunk boundary).
+ *  Returns 0 when the tail cannot begin a marker. Both markers share the `\x1b[20` stem,
+ *  so e.g. a trailing `\x1b`, `\x1b[`, `\x1b[2`, `\x1b[20`, `\x1b[200`, or `\x1b[201` is
+ *  held back for the next chunk; a full marker (handled in the main loop) is not. */
+export function pasteMarkerTailLength(data: string): number {
+  const markers = [PASTE_START, PASTE_END] as const;
+  const max = Math.min(Math.max(PASTE_START.length, PASTE_END.length) - 1, data.length);
+  for (let k = max; k >= 1; k--) {
+    const tail = data.slice(data.length - k);
+    for (const m of markers) if (m.length > k && m.startsWith(tail)) return k;
+  }
+  return 0;
+}
+
+/** Whether `data` (already free of any trailing partial marker) leaves the filter INSIDE
+ *  a bracketed paste, given the entry state — by replaying only the paste toggles. Used to
+ *  decide if a trailing lone `\r` is a CRLF/CR split inside paste body (carry it) versus a
+ *  real Enter at the prompt (must NOT be carried). */
+export function endsInPaste(data: string, startInPaste: boolean): boolean {
+  let inPaste = startInPaste;
+  let i = 0;
+  while (i < data.length) {
+    if (!inPaste && data.startsWith(PASTE_START, i)) { inPaste = true; i += PASTE_START.length; continue; }
+    if (inPaste && data.startsWith(PASTE_END, i)) { inPaste = false; i += PASTE_END.length; continue; }
+    i += 1;
+  }
+  return inPaste;
 }
 
 export interface PromptKeyFilterResult {
@@ -561,6 +644,24 @@ export function filterPromptInputChunk(
   env: PromptKeyFilterEnv,
   state: PromptKeyFilterState,
 ): PromptKeyFilterResult {
+  // Re-attach any byte run carried from the previous chunk (a split paste marker or a
+  // dangling `\r`), then hold back a fresh trailing partial so a bracketed-paste marker —
+  // or a `\r\n` straddling this read boundary — is never half-interpreted. Carrying is
+  // safe: the concatenation is re-parsed next call, so a tail that turns out NOT to be a
+  // marker is simply emitted one chunk later.
+  data = (state.carry ?? "") + data;
+  state.carry = "";
+  const markerTail = pasteMarkerTailLength(data);
+  if (markerTail > 0) {
+    state.carry = data.slice(data.length - markerTail);
+    data = data.slice(0, data.length - markerTail);
+  } else if (data.endsWith("\r") && endsInPaste(data, state.inPaste)) {
+    // A lone trailing `\r` INSIDE a paste may be the front of a CRLF split across chunks —
+    // carry it so `\r\n` folds to ONE sentinel instead of two (no spurious blank line).
+    // Outside a paste a trailing `\r` is Enter (submit) and must pass through untouched.
+    state.carry = "\r";
+    data = data.slice(0, data.length - 1);
+  }
   // Empty-line Backspace guard: a standalone Backspace with an empty buffer is a no-op
   // that some Bun readline builds turn into a spurious `close` (hard exit) — drop it
   // before it reaches readline. Forwarded normally inside a paste or with text present.
@@ -575,7 +676,17 @@ export function filterPromptInputChunk(
     if (state.inPaste) {
       if (data.startsWith("\r\n", i)) { out += MULTILINE_SENTINEL; i += 2; continue; }
       if (data[i] === "\n" || data[i] === "\r") { out += MULTILINE_SENTINEL; i += 1; continue; }
-      out += data[i]; i += 1; continue;
+      // Pasted DATA: drop whole ANSI escape sequences (e.g. the `\x1b[31m` color codes in
+      // copied terminal output, which would otherwise reach readline as literal escapes —
+      // or leftover `[31m` text — and corrupt the box), then keep printable text + tabs and
+      // drop any remaining C0 control byte. Shares `pasteEscapeLength`/the same keep rule as
+      // `stripPasteEscapes` so every paste path sanitizes identically. Surrogate halves
+      // (emoji) are >= " " and pass through intact.
+      const esc = pasteEscapeLength(data, i);
+      if (esc > 0) { i += esc; continue; }
+      const ch = data[i]!;
+      if (ch === "\t" || ch >= " ") out += ch;
+      i += 1; continue;
     }
     const mouse = matchMouseReport(data, i);
     if (mouse > 0) { i += mouse; continue; }
@@ -611,4 +722,30 @@ export function filterPromptInputChunk(
     out += data[i]; i += 1;
   }
   return { out, drop: false };
+}
+
+// ── Paste-merge idle gate (large-paste truncation fix) ───────────────────────────
+/** Default idle window for the bracketed-paste merge fallback, in ms. */
+export const PASTE_MERGE_IDLE_MS = 250;
+
+/** Decide the paste-merge fallback when the `201~` end-marker may have been dropped.
+ *
+ *  A multi-line bracketed paste is buffered line-by-line and only flushed as ONE
+ *  message once paste-end arrives. Terminals occasionally drop the end-marker, so
+ *  `launch.ts` also arms an idle fallback. The OLD fallback was a single fixed
+ *  250ms timer measured from the FIRST line — a large paste streaming in over more
+ *  than 250ms tripped it mid-paste and got truncated (the rest leaked as separate
+ *  prompts). This is idle-based instead: `idleMs` is the gap since the LAST buffered
+ *  line, so a steadily-arriving paste keeps resetting the clock and is never cut;
+ *  the fallback fires only after the stream has genuinely gone quiet.
+ *
+ *  Returns `fire: true` when the idle gap has reached the threshold (flush now), else
+ *  `waitMs` = how long to wait before re-checking. Pure, so the timing policy is
+ *  unit-testable without a live readline/PTY. */
+export function pasteIdleDecision(
+  idleMs: number,
+  thresholdMs: number = PASTE_MERGE_IDLE_MS,
+): { fire: boolean; waitMs: number } {
+  if (idleMs >= thresholdMs) return { fire: true, waitMs: 0 };
+  return { fire: false, waitMs: thresholdMs - idleMs };
 }

package/src/commands/launch/mentions.ts

@@ -2,17 +2,103 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { tokenize } from "../../tui/components/autocomplete";
 
+/** Directories never descended into / surfaced by `@path` recursive search. */
+const IGNORE_DIRS = new Set([
+  "node_modules", ".git", "dist", "build", "out", "coverage",
+  ".next", ".cache", ".turbo", ".svelte-kit", "vendor", "target",
+  ".jeo", ".omc", ".omx", ".gjc",
+]);
+const MAX_RESULTS = 50;
+/** Hard cap on directory entries visited per query (keeps per-keystroke cost bounded). */
+const MAX_SCAN = 8000;
+/** Deepest directory level the recursive walk descends to. */
+const MAX_DEPTH = 10;
+
+/** Fuzzy match tier for `name` against an already-lowercased `frag`.
+ *  0 = prefix, 1 = substring, 2 = subsequence (chars in order), -1 = no match. */
+function fuzzyRank(name: string, fragLower: string): number {
+  if (!fragLower) return 0;
+  const n = name.toLowerCase();
+  if (n.startsWith(fragLower)) return 0;
+  if (n.includes(fragLower)) return 1;
+  let i = 0;
+  for (let j = 0; j < n.length && i < fragLower.length; j++) {
+    if (n[j] === fragLower[i]) i++;
+  }
+  return i === fragLower.length ? 2 : -1;
+}
+
+interface RecursiveHit {
+  rel: string;
+  isDir: boolean;
+  rank: number;
+  depth: number;
+}
+
+/** Recursively search the project tree under `cwd` for entries whose basename
+ *  fuzzy-matches `frag`. Ignores hidden entries and well-known build/VCS dirs,
+ *  bounded by depth / scan / result caps. Pure given the filesystem: never throws
+ *  (unreadable directories are skipped). Returns relative POSIX paths, directories
+ *  keeping a trailing `/`, ranked basename-prefix → substring → subsequence, then
+ *  shallowest / shortest / alphabetical. */
+function searchRecursive(cwd: string, frag: string): string[] {
+  const fragLower = frag.toLowerCase();
+  const hits: RecursiveHit[] = [];
+  let scanned = 0;
+  const stack: { abs: string; rel: string; depth: number }[] = [{ abs: cwd, rel: "", depth: 0 }];
+  while (stack.length > 0) {
+    const { abs, rel, depth } = stack.pop()!;
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (++scanned > MAX_SCAN) break;
+      if (entry.name.startsWith(".")) continue;
+      const isDir = entry.isDirectory();
+      if (isDir && IGNORE_DIRS.has(entry.name)) continue;
+      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+      const rank = fuzzyRank(entry.name, fragLower);
+      if (rank >= 0) hits.push({ rel: childRel, isDir, rank, depth });
+      if (isDir && depth + 1 <= MAX_DEPTH) {
+        stack.push({ abs: path.join(abs, entry.name), rel: childRel, depth: depth + 1 });
+      }
+    }
+    if (scanned > MAX_SCAN) break;
+  }
+  hits.sort((a, b) =>
+    a.rank - b.rank ||
+    a.depth - b.depth ||
+    a.rel.length - b.rel.length ||
+    a.rel.localeCompare(b.rel));
+  return hits.slice(0, MAX_RESULTS).map(h => (h.isDir ? `${h.rel}/` : h.rel));
+}
+
 /** Filesystem completion for an `@path` mention prefix, relative to `cwd`.
- *  Lists the directory the prefix points at, filtering by the basename fragment,
- *  directories first, hidden entries dropped, capped at 50 — directories keep a
- *  trailing `/` so the next Tab descends. Pure given `cwd`: never throws (an
- *  unreadable directory yields no matches). Extracted verbatim from the launch
- *  REPL so it can be unit-tested in isolation. */
+ *
+ *  - A bare fragment with no slash (e.g. `@loop`) triggers a recursive, fuzzy
+ *    project-wide search so nested files surface without typing each directory
+ *    level (`@loop` → `src/agent/loop.ts`).
+ *  - A path containing a slash (or ending in `/`) lists that one directory,
+ *    filtering the basename fragment fuzzily (prefix/substring/subsequence).
+ *
+ *  Directories keep a trailing `/` so the next Tab descends; hidden entries are
+ *  dropped; results are capped at 50. Pure given `cwd`: never throws (an
+ *  unreadable directory yields no matches). */
 export function mentionPaths(cwd: string, prefix: string): string[] {
   const norm = prefix.replace(/\\/g, "/");
   const wantsDirChildren = norm.endsWith("/");
+
+  // Bare non-empty fragment → recursive fuzzy search across the project.
+  if (!wantsDirChildren && norm.length > 0 && !norm.includes("/")) {
+    return searchRecursive(cwd, norm);
+  }
+
   const dirPart = wantsDirChildren ? norm.slice(0, -1) : path.posix.dirname(norm) === "." ? "" : path.posix.dirname(norm);
   const namePart = wantsDirChildren ? "" : path.posix.basename(norm);
+  const fragLower = namePart.toLowerCase();
   const absDir = path.resolve(cwd, dirPart || ".");
   let entries: fs.Dirent[] = [];
   try {
@@ -22,9 +108,12 @@ export function mentionPaths(cwd: string, prefix: string): string[] {
   }
   return entries
     .filter(entry => !entry.name.startsWith("."))
-    .filter(entry => !namePart || entry.name.toLowerCase().startsWith(namePart.toLowerCase()))
+    .filter(entry => fuzzyRank(entry.name, fragLower) >= 0)
     .sort((a, b) => {
       if (a.isDirectory() !== b.isDirectory()) return a.isDirectory() ? -1 : 1;
+      const ra = fuzzyRank(a.name, fragLower);
+      const rb = fuzzyRank(b.name, fragLower);
+      if (ra !== rb) return ra - rb;
       return a.name.localeCompare(b.name);
     })
     .slice(0, 50)

package/src/commands/launch.ts

@@ -149,6 +149,8 @@ import {
   classifyMidTurnLine,
   decideCtrlC,
   filterPromptInputChunk,
+  pasteIdleDecision,
+  PASTE_MERGE_IDLE_MS,
 } from "./launch/input";
 import {
   gatedStdout,
@@ -1556,12 +1558,14 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // PASTE-MERGE: a multi-line bracketed paste must arrive as ONE message, not split into
   // one command per line. Lines that fire WHILE a paste is open are buffered here instead
   // of run individually; promptInput joins them with the trailing residual on resolve.
-  // `endWaiters` wake that merge the moment the 201~ paste-end marker arrives.
-  const pasteMerge: { buf: string[]; endWaiters: Array<() => void> } = { buf: [], endWaiters: [] };
+  // `endWaiters` wake that merge the moment the 201~ paste-end marker arrives. `lastActivityAt`
+  // tracks the last buffered line so the dropped-marker fallback is IDLE-based (never cuts a
+  // large paste still streaming in — see pasteIdleDecision).
+  const pasteMerge: { buf: string[]; endWaiters: Array<() => void>; lastActivityAt: number } = { buf: [], endWaiters: [], lastActivityAt: 0 };
   let pasteLineFired = false; // the line that resolved rl.question came from inside a paste
   if (process.stdin.isTTY) {
     const pasteKeypressHandler = (_ch: string, key: { name?: string } | undefined) => {
-      if (key?.name === "paste-start") { promptPasteActive = true; pasteMerge.buf = []; }
+      if (key?.name === "paste-start") { promptPasteActive = true; pasteMerge.buf = []; pasteMerge.lastActivityAt = Date.now(); }
       else if (key?.name === "paste-end") {
         promptPasteActive = false;
         for (const w of pasteMerge.endWaiters.splice(0)) w();
@@ -1578,6 +1582,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     if (promptPasteActive) {
       // Inside a bracketed paste: buffer the line, never run it on its own.
       pasteMerge.buf.push(l);
+      pasteMerge.lastActivityAt = Date.now();
       pasteLineFired = true;
       return;
     }
@@ -1642,10 +1647,24 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         if (promptPasteActive) {
           await new Promise<void>(resolve => {
             if (!promptPasteActive) { resolve(); return; }
-            pasteMerge.endWaiters.push(resolve);
-            setTimeout(resolve, 250); // safety: never hang if the 201~ marker is dropped
+            let done = false;
+            const finish = () => { if (done) return; done = true; resolve(); };
+            // Woken immediately by the 201~ paste-end marker (endWaiters).
+            pasteMerge.endWaiters.push(finish);
+            // Fallback for a DROPPED end-marker: idle-based, so a large paste still
+            // streaming in keeps resetting the clock and is never truncated. Only a
+            // genuinely quiet stream (no new line for PASTE_MERGE_IDLE_MS) flushes.
+            const tick = () => {
+              if (done) return;
+              if (!promptPasteActive) { finish(); return; }
+              const { fire, waitMs } = pasteIdleDecision(Date.now() - pasteMerge.lastActivityAt);
+              if (fire) { finish(); return; }
+              setTimeout(tick, waitMs);
+            };
+            setTimeout(tick, PASTE_MERGE_IDLE_MS);
           });
         }
+
         const residual = (rl as unknown as { line?: string }).line ?? "";
         // Clear the residual so it does NOT prefill (and re-submit) the next prompt.
         try { rl.write(null, { ctrl: true, name: "u" }); } catch { /* best-effort */ }
@@ -2631,7 +2650,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         setImmediate(() => {
           void (async () => {
             try {
-              const rli = rl as unknown as { line: string; cursor: number };
+              const rli = rl as unknown as { line: string; cursor: number; _refreshLine?: () => void };
               const before = rli.line;
               const dropped = await attachImagePaths(before, pendingImages.length + 1);
               if (dropped.images.length === 0 || dropped.text === before) return;
@@ -2639,6 +2658,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
               rli.line = dropped.text;
               rli.cursor = dropped.text.length; // drop lands at the caret (line end in the common case)
               typedLine = dropped.text;
+              // Keep readline's internal screen model in step with the swapped-in tag so
+              // the caret is not offset on the next keystroke (mirrors the Ctrl+V path).
+              rli._refreshLine?.();
               if (previewArmed) drawFooter(previewLines(typedLine, navIdx));
             } finally {
               pasteInFlight = false;
@@ -2700,12 +2722,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             if (!img) return;
             pendingImages.push(img);
             const tag = `[image #${pendingImages.length}]`;
-            const rli = rl as unknown as { line: string; cursor: number };
+            const rli = rl as unknown as { line: string; cursor: number; _refreshLine?: () => void };
             const at = typeof rli.cursor === "number" ? rli.cursor : rli.line.length;
             const sep = rli.line.length > 0 && at > 0 && rli.line[at - 1] !== " " ? " " : "";
             rli.line = rli.line.slice(0, at) + sep + tag + " " + rli.line.slice(at);
             rli.cursor = at + sep.length + tag.length + 1;
             typedLine = rli.line;
+            // Sync readline's internal screen model to the injected tag (same as the
+            // slash/tab completion accept paths): without it readline's stale row/cursor
+            // model offsets the real caret several columns on the next keystroke — the
+            // "caret pushed past the tag after attaching an image" shift.
+            rli._refreshLine?.();
             if (previewArmed) drawFooter(previewLines(typedLine, navIdx));
           } finally {
             pasteInFlight = false;
@@ -3327,10 +3354,18 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           if (copied.osc52 || copied.local) {
             const via = [copied.local ? "system tool" : "", copied.osc52 ? "OSC52" : ""].filter(Boolean).join(" + ");
             console.log(`(transcript copied to clipboard via ${via} — ${text.length} chars)`);
+            // OSC52 is the only path that reaches the OUTER terminal over SSH/tmux. If it was
+            // skipped for size, a remote paste won't find the text — say so (and how to lift it).
+            if (copied.osc52SkippedTooLarge) {
+              console.log("(note: too large for the OSC52 remote-clipboard path — copied via the local tool only; over SSH/tmux this won't reach your machine. Set JEO_OSC52_MAX higher if your terminal accepts larger writes.)");
+            }
           } else {
             console.log(text);
-            console.log("(no clipboard path available — transcript printed above)");
+            console.log(copied.osc52SkippedTooLarge
+              ? "(transcript too large for OSC52 and no local clipboard tool — printed above)"
+              : "(no clipboard path available — transcript printed above)");
           }
+
         } catch (err) {
           console.log(`! dump failed: ${(err as Error).message}`);
         }

package/src/commands/ralplan.ts

@@ -148,9 +148,21 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
   const ARCHITECT = `You are the ARCHITECT. Review the Planner's draft for technical feasibility, correct file targets, directory structure, and any missing setup/wiring/test steps. Return an improved plan (same shape).\n` + SCHEMA_SPEC;
   const CRITIC = `You are the CRITIC. Finalize the plan: remove vague or redundant steps, make each step actionable and independently verifiable, and ensure the acceptance criteria are covered. Return the final plan (same shape).\n` + SCHEMA_SPEC;
 
+  // Drafting passes honor the SAME per-role model config the rest of jeo uses
+  // (resolveSubagentModel → config.subagents[role].model, else defaultModel).
+  // Previously every pass ran on the default/primary model, ignoring a user's
+  // configured planner/architect tiers; routing each pass to its role's model
+  // lets a cheaper/faster draft tier cut planning latency with NO default change
+  // (unset roles still resolve to defaultModel). The repo-grounded consensus gate
+  // (runConsensusCriticGate) resolves critic's model independently and is untouched.
+  const config = await readGlobalConfig();
+  const PLANNER_MODEL = resolveSubagentModel("planner", config);
+  const ARCHITECT_MODEL = resolveSubagentModel("architect", config);
+  const CRITIC_MODEL = resolveSubagentModel("critic", config);
+
   try {
-    const callRole = async (systemPrompt: string, userContent: string): Promise<string> => {
-      const raw = await callLlm([{ role: "user" as const, content: userContent }], { systemPrompt });
+    const callRole = async (systemPrompt: string, userContent: string, model?: string): Promise<string> => {
+      const raw = await callLlm([{ role: "user" as const, content: userContent }], { systemPrompt, model });
       return raw.replace(/```yaml|```/g, "").trim();
     };
     const isValidPlan = (yaml: string): boolean => {
@@ -175,7 +187,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     if (opts.onProgress) {
       opts.onProgress({ skill: "ralplan", phase: "planning", detail: "Planner drafting" });
     }
-    const draft = await callRole(PLANNER, `Crystallized spec (seed.yaml):\n\n${seedContent}`);
+    const draft = await callRole(PLANNER, `Crystallized spec (seed.yaml):\n\n${seedContent}`, PLANNER_MODEL);
 
     if (opts.signal?.aborted) {
       return { ok: false, reason: "aborted" };
@@ -185,7 +197,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     if (opts.onProgress) {
       opts.onProgress({ skill: "ralplan", phase: "planning", detail: "Architect reviewing" });
     }
-    const reviewed = await callRole(ARCHITECT, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nPlanner's draft plan:\n\n${draft}\n\nReturn the improved plan.`);
+    const reviewed = await callRole(ARCHITECT, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nPlanner's draft plan:\n\n${draft}\n\nReturn the improved plan.`, ARCHITECT_MODEL);
 
     if (opts.signal?.aborted) {
       return { ok: false, reason: "aborted" };
@@ -195,7 +207,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     if (opts.onProgress) {
       opts.onProgress({ skill: "ralplan", phase: "planning", detail: "Critic finalizing" });
     }
-    let cleanPlan = await callRole(CRITIC, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nArchitect's plan:\n\n${reviewed}\n\nReturn the final, critiqued plan.`);
+    let cleanPlan = await callRole(CRITIC, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nArchitect's plan:\n\n${reviewed}\n\nReturn the final, critiqued plan.`, CRITIC_MODEL);
 
     if (opts.signal?.aborted) {
       return { ok: false, reason: "aborted" };
@@ -209,7 +221,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     let planValid = true;
     if (!isValidPlan(cleanPlan)) {
       log("[ralplan] Final plan did not match the required shape; requesting a corrected plan…");
-      cleanPlan = await callRole(CRITIC, `Your previous output was not valid for the required schema. Fix it (roles MUST be one of executor|planner|architect|critic).\n\n${SCHEMA_SPEC}\n\nPlan to fix:\n\n${cleanPlan}`);
+      cleanPlan = await callRole(CRITIC, `Your previous output was not valid for the required schema. Fix it (roles MUST be one of executor|planner|architect|critic).\n\n${SCHEMA_SPEC}\n\nPlan to fix:\n\n${cleanPlan}`, CRITIC_MODEL);
       if (!isValidPlan(cleanPlan)) {
         const fallback = [reviewed, draft].find(isValidPlan);
         if (fallback) {
@@ -253,6 +265,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
         CRITIC,
         `The consensus critic returned [ITERATE] on the plan with this justification:\n\n${gate.detail}\n\n` +
         `Revise the plan to address every point.\n\n${SCHEMA_SPEC}\n\nCurrent plan:\n\n${cleanPlan}`,
+        CRITIC_MODEL,
       );
       if (isValidPlan(revised)) {
         cleanPlan = revised;

package/src/commands/team.ts

@@ -346,7 +346,8 @@ export async function runTeamEngine(opts: TeamEngineOptions = {}): Promise<{ ok:
       const currentTask = teamState.pending_tasks[0];
       log(`\n${categoryBadge("progress")} Current task: "${currentTask}"`);
       const activeIndex = activeStepIndex(tasks.length, teamState.pending_tasks);
-      for (const line of formatRalphTodoGuide(tasks, activeIndex, teamState.completed_tasks ?? [], renderOpts)) log(line);
+      // Guide printed once above; per-task lines convey progress. No per-iteration
+      // reprint — it was O(N²) lines, climbing the embedded-terminal renderer's CPU.
 
       if (opts.onProgress) {
         opts.onProgress({ skill: "team", phase: "executing", detail: `Current task: ${currentTask}` });

package/src/tui/app.ts

@@ -126,6 +126,15 @@ export function tailForWrap(text: string, maxChars = FRAME_WRAP_TAIL_CHARS): str
   return text.length > maxChars ? text.slice(text.length - maxChars) : text;
 }
 
+/** Memoization key for a live-block wrap (Thinking / tool Output). Derived from the
+ *  TRAILING window only (see `tailForWrap`): the rendered rows depend solely on the
+ *  tail, so keying on the full streamed buffer just made every 120ms tick and every
+ *  delta copy + compare the whole growing string — O(len) per frame, i.e. O(len²) over
+ *  a long stream. Bounding the key to the ≤16KB tail keeps per-frame cost O(window). */
+export function liveBlockWrapKey(wrapW: number, text: string): string {
+  return `${wrapW}\u0000${tailForWrap(text)}`;
+}
+
 /** Max lines of a committed reasoning block kept in scrollback (gjc-style collapse): a
  *  long chain-of-thought is clipped with a "+N more" hint so it never floods the ledger. */
 export const THINKING_COMMIT_MAX_LINES = 12;
@@ -1300,14 +1309,18 @@ export class LaunchTui {
     const dim = this.theme.color ? chalk.dim : (s: string) => s;
     if (!text.trim()) return [];
     const wrapW = Math.max(8, cols - 2);
-    // Memoize the wrap: only the spinner/clock change on most 120ms ticks, so re-wrapping
-    // this (up to 16KB) tail every frame just re-segments graphemes for no visible change.
-    // Per-label slot (Thinking / Output) keyed by wrap width + text — a real delta misses
-    // once and recomputes; an idle tick hits the cache. `rows` only gates the post-slice.
+    // Memoize the wrap on the TRAILING window only. The block displays just its last few
+    // wrapped rows, so wrap cost is already capped by `tailForWrap`. The cache KEY must be
+    // bounded too: keying on the full (up-to-hundreds-of-KB) `text` made every 120ms tick
+    // and every stream delta copy + compare the whole growing buffer — O(len) per frame, so
+    // O(len²) over a long reasoning/tool stream (the streaming slowdown). Slice first, then
+    // key + wrap the ≤16KB tail: identical visible output, O(tail) per frame regardless of
+    // total size. Per-label slot (Thinking / Output) keyed by wrap width + tail.
     let cache = this.liveBlockWrapCaches.get(cacheKey);
     if (!cache) { cache = lastValueCache<string[]>(); this.liveBlockWrapCaches.set(cacheKey, cache); }
-    const wrapped = cache(`${wrapW}\u0000${text}`, () =>
-      tailForWrap(text)
+    const tail = tailForWrap(text);
+    const wrapped = cache(liveBlockWrapKey(wrapW, text), () =>
+      tail
         .split("\n")
         .flatMap(l => wrapTextWithAnsi(l, wrapW))
         .filter(l => l.length > 0));

package/src/tui/clipboard.ts

@@ -27,6 +27,20 @@
  *  this we skip OSC 52 and rely on the local clipboard tool instead. */
 export const OSC52_MAX_BASE64 = 100_000;
 
+/** Resolve the effective OSC 52 base64-payload cap. `JEO_OSC52_MAX` overrides the
+ *  conservative {@link OSC52_MAX_BASE64} default for terminals/tmux configured to
+ *  accept larger clipboard writes (e.g. tmux `set -g set-clipboard on` with a raised
+ *  `buffer-limit`, or a terminal without xterm's ~100KB selection limit). A value
+ *  `<= 0` disables the cap entirely (Infinity); an unparseable value keeps the
+ *  default. Pure (env injected) so it is testable without touching the host. */
+export function osc52MaxBase64(env: Record<string, string | undefined> = process.env): number {
+  const raw = env.JEO_OSC52_MAX;
+  if (raw === undefined || raw.trim() === "") return OSC52_MAX_BASE64;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return OSC52_MAX_BASE64;
+  return n <= 0 ? Number.POSITIVE_INFINITY : n;
+}
+
 /**
  * Resolve the local system-clipboard WRITE command for a platform, or null when
  * no tool is available. Pure (the `which` probe is injected) so it is testable
@@ -69,18 +83,20 @@ export interface Osc52Options {
   tmux?: boolean;
   /** Clipboard selection: `c` = system clipboard (default), `p` = primary. */
   clipboard?: "c" | "p";
+  /** Max base64 payload to emit (default {@link OSC52_MAX_BASE64}); larger returns "". */
+  maxBase64?: number;
 }
 
 /**
  * Build the OSC 52 clipboard-SET escape for `text`, or "" when the base64 payload
- * exceeds {@link OSC52_MAX_BASE64} (caller falls back to a local tool). When
- * `tmux` is set the whole sequence is wrapped in DCS passthrough (`ESC P tmux ; …
- * ESC \`) with every inner ESC doubled, the tmux contract for forwarding an
- * escape to the terminal underneath it.
+ * exceeds the cap (default {@link OSC52_MAX_BASE64}, overridable via `maxBase64`; the
+ * caller falls back to a local tool). When `tmux` is set the whole sequence is wrapped
+ * in DCS passthrough (`ESC P tmux ; … ESC \`) with every inner ESC doubled, the tmux
+ * contract for forwarding an escape to the terminal underneath it.
  */
 export function osc52Sequence(text: string, opts: Osc52Options = {}): string {
   const b64 = Buffer.from(text, "utf8").toString("base64");
-  if (b64.length > OSC52_MAX_BASE64) return "";
+  if (b64.length > (opts.maxBase64 ?? OSC52_MAX_BASE64)) return "";
   const target = opts.clipboard ?? "c";
   const inner = `\x1b]52;${target};${b64}\x07`;
   if (!opts.tmux) return inner;
@@ -100,6 +116,8 @@ export interface CopyToClipboardDeps {
   platform?: NodeJS.Platform;
   /** True when running inside tmux (defaults to !!process.env.TMUX). */
   insideTmux?: boolean;
+  /** Environment for resolving the OSC 52 cap (`JEO_OSC52_MAX`); defaults to process.env. */
+  env?: Record<string, string | undefined>;
 }
 
 export interface CopyResult {
@@ -107,6 +125,10 @@ export interface CopyResult {
   osc52: boolean;
   /** A local clipboard subprocess accepted the text. */
   local: boolean;
+  /** OSC 52 was SKIPPED because the base64 payload exceeded the cap — the remote
+   *  (SSH/tmux) clipboard was NOT updated; only a local tool, if any, ran. Lets the
+   *  caller warn the user instead of silently dropping the remote path. */
+  osc52SkippedTooLarge: boolean;
 }
 
 /**
@@ -121,13 +143,17 @@ export async function copyTextToClipboard(text: string, deps: CopyToClipboardDep
   const insideTmux = deps.insideTmux ?? !!process.env.TMUX;
   const write = deps.write ?? ((s: string) => { try { process.stdout.write(s); } catch { /* terminal gone */ } });
   const spawn = deps.spawn ?? ((cmd, opts) => Bun.spawn(cmd, opts) as ReturnType<NonNullable<CopyToClipboardDeps["spawn"]>>);
+  const maxBase64 = osc52MaxBase64(deps.env ?? process.env);
 
-  const result: CopyResult = { osc52: false, local: false };
+  const result: CopyResult = { osc52: false, local: false, osc52SkippedTooLarge: false };
 
-  const seq = osc52Sequence(text, { tmux: insideTmux });
+  const seq = osc52Sequence(text, { tmux: insideTmux, maxBase64 });
   if (seq) {
     write(seq);
     result.osc52 = true;
+  } else {
+    // osc52Sequence only returns "" when the payload is over the cap.
+    result.osc52SkippedTooLarge = true;
   }
 
   const cmd = systemClipboardCopyCommand(platform, which);

package/src/tui/components/autocomplete.ts

@@ -114,8 +114,11 @@ export function complete(line: string, ctx: CompletionContext): CompletionResult
     const token = trailingSpace ? "" : tokens[tokens.length - 1] ?? "";
     if (token.startsWith("@")) {
       const prefix = token.slice(1);
+      // `mentionPaths` already does the matching (recursive fuzzy for a bare
+      // fragment, single-dir listing when the prefix has a slash), so the pool
+      // is returned as-is rather than re-filtered by strict prefix.
       const pool = (ctx.mentionPaths?.(prefix) ?? []).map(p => (p.startsWith("@") ? p : `@${p}`));
-      return { completions: dedupeCap(prefixHits(pool, token)), token, kind: "path" };
+      return { completions: dedupeCap(pool), token, kind: "path" };
     }
     // `$skill` mention completion at ANY position in the line (mention-style;
     // a leading `$name` is additionally the direct-invocation entrypoint).