jeo-code 0.8.10 → 0.8.12

package/CHANGELOG.md

@@ -6,6 +6,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.12] - 2026-07-08
+_"제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time._
+
+### Fixed
+- **Added the missing `gpt-5.4-mini` to the OAuth allow-list** (`src/ai/model-catalog.ts`) — immediate fix for the exact reported failure, with a full capability row (272K context, 128K max output, full thinking support, image input) added to `MODEL_CATALOG`.
+
+### Added
+- **Self-healing live Codex model gate** (`src/ai/model-catalog.ts`, `src/ai/model-discovery.ts`, `src/ai/model-manager.ts`, `src/commands/launch/model-slash.ts`) — new `isCodexModel()` checks the maintained `CODEX_MODELS` list PLUS any model id this session's OWN OAuth discovery call already observed live (`recordLiveCodexModels`, additive-only, session-lifetime). `listProviderModels` now records every `oauth`-sourced OpenAI model list on a successful call (picker open, `jeo doctor`, or any model resolution) — an `api_key`-sourced result never widens the gate, since it says nothing about what OAuth can serve. `oauthServesModel` (the gate behind `resolveCall`, `effectiveCredentialForProvider`, and `modelServableWithConfig`) and the `/model` pin-warning now both consult `isCodexModel` instead of the raw static list — closes this bug class permanently: any future Codex model OpenAI ships becomes usable the moment the account's own endpoint confirms it, with zero release lag. The OAuth-rejection error message is now built dynamically from `CODEX_MODELS` instead of a hard-coded two-model string.
+
+### Verified
+- Independently mutation-tested (5 mutations across all 4 touched files): all 5 caught by tests; found and closed 1 genuine gap in `recordLiveCodexModels`'s additive-across-separate-calls contract (a clear-then-add REPLACE implementation was indistinguishable from ADD until a test called it twice with disjoint id lists).
+- Live-verified: `jeo --model gpt-5.4-mini -p "hello"` failed with the OAuth-rejection error before the fix, succeeds after.
+- Full suite 2802/2802 pass, typecheck clean.
+
+## [0.8.11] - 2026-07-08
+_"프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered._
+
+### Fixed
+- **Local-provider reachability veto gate** (`src/commands/launch.ts`, `src/ai/model-discovery.ts`) — new `isLocalProviderReachable()` performs a short-timeout (1500ms) live probe against ollama/lmstudio before routing commits to a pinned local model. An unreachable server now vetoes the route (falls back to the session/default model, same `warnOnce` pattern as the existing credential/servability veto branches) instead of routing into a turn that would fail mid-call. Cloud providers never reach this branch — their existing credential/servability checks are sufficient.
+- **Provider + base URL context on connection failures** (`src/util/retry.ts`, `src/ai/model-manager.ts`) — new `ConnectionContextError` wraps a raw `isConnectionError` failure (Bun `ConnectionRefused` / Node `ECONNREFUSED`/`ENOTFOUND`/`EHOSTUNREACH`/`EAI_AGAIN`) with the resolved provider and effective base URL, threaded through `resolveCall`'s `Resolved` type and applied at both `call()` and `stream()` in `createModelManager()` — covers the residual case where routing was NOT engaged (e.g. an explicit `/model ollama/...` pin) and a connection failure still needs to reach the user with useful context.
+- **Actionable connection-error messages** (`src/util/provider-error.ts`) — `friendlyProviderError` now recognizes `ConnectionContextError` (names the provider + base URL; local providers get "start the server" guidance, others get "check the base URL / network" guidance) and bare `isConnectionError` failures as a defensive fallback, replacing the raw Bun message with `Could not connect to <provider> at <url>. …` in every case.
+- **Connection failures are now retryable** (`src/util/retry.ts`) — `defaultRetryable` treats `isConnectionError` as retryable (a local server mid-restart, or a transient DNS blip, can clear within the backoff budget); a persistently-down provider still exhausts the budget and surfaces the new actionable message rather than the raw one.
+
+### Added
+- **Reachability veto gate tests** (`test/launch-prompt-routing.test.ts`) — 5 tests covering the veto firing on an unreachable ollama pin, no false positive when reachable, `/route why` naming the fallback, `warnOnce` notice suppression across turns, and confirming cloud-provider routes never trigger the live probe.
+- **`isLocalProviderReachable` unit tests** (`test/model-discovery.test.ts`) — reachable/unreachable/non-ok-status coverage.
+- **`ConnectionContextError`/`withConnectionContext` unit tests** (`test/retry.test.ts`) — wrapping, pass-through of non-connection errors, and `defaultRetryable` classification.
+- **`friendlyProviderError` connection-message tests** (`test/provider-error-taxonomy.test.ts`) — local vs. non-local guidance, and the bare-error fallback.
+- **`model-manager` integration tests** (`test/model-provider-mapping.test.ts`) — `call()` and `stream()` both re-throw a raw connection failure as `ConnectionContextError` naming the correct provider/base URL.
+
 ## [0.8.10] - 2026-07-08
 _"지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded)._
 

package/README.ja.md

@@ -262,11 +262,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
+- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
-- **[0.8.6]** (2026-07-08) — Explicit `/model` pin always winning over PromptRouter was correct but opaque: `/route status` showed "routing: on" even while a session pin blocked routing from ever evaluating a prompt, and there was no way back to routed mode short of restarting the session. Also closed a related escalation gap: `routing.enabled` with `roles.smol` unset made ambiguous-prompt LLM escalation silently skip every turn, even when a cheaper credentialed model existed to run the classifier.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -263,11 +263,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
+- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
-- **[0.8.6]** (2026-07-08) — Explicit `/model` pin always winning over PromptRouter was correct but opaque: `/route status` showed "routing: on" even while a session pin blocked routing from ever evaluating a prompt, and there was no way back to routed mode short of restarting the session. Also closed a related escalation gap: `routing.enabled` with `roles.smol` unset made ambiguous-prompt LLM escalation silently skip every turn, even when a cheaper credentialed model existed to run the classifier.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -265,11 +265,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
+- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
-- **[0.8.6]** (2026-07-08) — Explicit `/model` pin always winning over PromptRouter was correct but opaque: `/route status` showed "routing: on" even while a session pin blocked routing from ever evaluating a prompt, and there was no way back to routed mode short of restarting the session. Also closed a related escalation gap: `routing.enabled` with `roles.smol` unset made ambiguous-prompt LLM escalation silently skip every turn, even when a cheaper credentialed model existed to run the classifier.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -262,11 +262,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
+- **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
-- **[0.8.6]** (2026-07-08) — Explicit `/model` pin always winning over PromptRouter was correct but opaque: `/route status` showed "routing: on" even while a session pin blocked routing from ever evaluating a prompt, and there was no way back to routed mode short of restarting the session. Also closed a related escalation gap: `routing.enabled` with `roles.smol` unset made ambiguous-prompt LLM escalation silently skip every turn, even when a cheaper credentialed model existed to run the classifier.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/memory.ts

@@ -229,11 +229,53 @@ interface ParsedConceptEntry { sig: string; concept: Concept | null }
 const parsedConceptCache = new Map<string, ParsedConceptEntry>();
 const PARSED_CONCEPT_CACHE_CAP = 512;
 
+/** Single-slot cache for `buildCorpusStats`/`buildConceptGraph` over the LAST
+ *  `concepts` array seen, keyed by reference identity. `memoryPromptSection` runs
+ *  `selectWithinBudget` once per interactive turn (`refreshSessionMemory`) and once
+ *  per subagent spawn (team/ralph/autopilot) — each call re-tokenized every concept's
+ *  searchable text and re-scanned every body for cross-links, even when NOTHING in the
+ *  bundle changed between calls. `loadConcepts` already returns the same cached `Concept`
+ *  OBJECTS when a file's mtime/size is unchanged (see `parsedConceptCache` above), so an
+ *  identical (same length + same object references) `concepts` array is the common case
+ *  across consecutive calls in one session — this hits that case with a cheap O(n)
+ *  reference-equality scan instead of paying the O(n · text length) rebuild. A genuinely
+ *  changed bundle (new/edited/deleted concept) always produces a different array — either
+ *  a different length or at least one different object reference — so correctness never
+ *  depends on this cache; it only skips work that would reach the same answer. */
+let statsGraphCacheConcepts: Concept[] | null = null;
+let statsGraphCacheStats: CorpusStats | null = null;
+let statsGraphCacheGraph: ConceptGraph | null = null;
+
+function sameConceptsArray(a: Concept[], b: Concept[]): boolean {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+
+/** Corpus stats + link graph for `concepts`, memoized against the last call (see above). */
+function statsAndGraphFor(concepts: Concept[]): { stats: CorpusStats; graph: ConceptGraph } {
+  if (
+    statsGraphCacheConcepts && statsGraphCacheStats && statsGraphCacheGraph &&
+    sameConceptsArray(statsGraphCacheConcepts, concepts)
+  ) {
+    return { stats: statsGraphCacheStats, graph: statsGraphCacheGraph };
+  }
+  const stats = buildCorpusStats(concepts);
+  const graph = buildConceptGraph(concepts);
+  statsGraphCacheConcepts = concepts;
+  statsGraphCacheStats = stats;
+  statsGraphCacheGraph = graph;
+  return { stats, graph };
+}
+
 /** Drop the per-file concept parse cache so the next loadConcepts re-reads disk.
  *  The cache is already mtime/size self-invalidating; this is a hard reset for
  *  tests and callers that mutate files without changing their stat signature. */
 export function invalidateConceptCache(): void {
   parsedConceptCache.clear();
+  statsGraphCacheConcepts = null;
+  statsGraphCacheStats = null;
+  statsGraphCacheGraph = null;
 }
 
 /** Read every concept document in the bundle into structured `Concept`s. Reserved
@@ -572,8 +614,7 @@ function selectWithinBudget(concepts: Concept[], query: string | undefined, budg
   const sectionLenByType = new Map<string, number>(); // type -> rendered length of that type's section so far
   let total = 0; // rendered length of `selected` under renderConcepts
 
-  const stats = buildCorpusStats(concepts);
-  const graph = buildConceptGraph(concepts);
+  const { stats, graph } = statsAndGraphFor(concepts);
 
   const take = (pool: Concept[]) => {
     for (const c of priorityOrder(pool, query, stats, graph)) {

package/src/agent/tool-output.ts

@@ -60,15 +60,18 @@ export const TOOL_SPILL_THRESHOLD = TOOL_OUTPUT_MAX;
 /** Most recent tool-result artifacts to keep; older ones are pruned on each spill. */
 export const MAX_TOOL_ARTIFACTS = 50;
 
-/** Best-effort retention: keep the newest `MAX_TOOL_ARTIFACTS` files in `dir`, delete the rest. */
+/** Best-effort retention: keep the newest `MAX_TOOL_ARTIFACTS` files in `dir`, delete the
+ *  rest. Filenames are always `${Date.now()}-${rand}-${tool}.txt` (spillToolResult is the
+ *  sole writer into this directory) — the leading 13-digit millisecond timestamp is fixed-
+ *  width until year 2286, so a plain lexicographic sort of the FILENAMES reproduces mtime
+ *  order exactly. This replaces an `fs.stat` per file (up to MAX_TOOL_ARTIFACTS syscalls,
+ *  paid on every spill once a long session's artifact dir sits at/near the cap) with a pure
+ *  in-memory string sort — zero syscalls beyond the single `readdir` every call already paid. */
 async function pruneToolArtifacts(dir: string): Promise<void> {
   const files = await fs.readdir(dir).catch(() => [] as string[]);
   if (files.length <= MAX_TOOL_ARTIFACTS) return;
-  const stamped = await Promise.all(
-    files.map(async f => ({ f, m: (await fs.stat(path.join(dir, f)).catch(() => null))?.mtimeMs ?? 0 })),
-  );
-  stamped.sort((a, b) => b.m - a.m); // newest first
-  for (const { f } of stamped.slice(MAX_TOOL_ARTIFACTS)) {
+  const newestFirst = [...files].sort((a, b) => (a < b ? 1 : a > b ? -1 : 0));
+  for (const f of newestFirst.slice(MAX_TOOL_ARTIFACTS)) {
     await fs.rm(path.join(dir, f), { force: true }).catch(() => {});
   }
 }

package/src/ai/model-catalog.ts

@@ -101,6 +101,7 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
   // OpenAI (newest first: gpt-5.5 > gpt-5.4 > o4-mini/o3/gpt-4.1 > o3-mini > gpt-4o-mini > gpt-4o)
   { canonical: "gpt-5.5", provider: "openai", providerModel: "gpt-5.5", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-04" },
   { canonical: "gpt-5.4", provider: "openai", providerModel: "gpt-5.4", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-03" },
+  { canonical: "gpt-5.4-mini", provider: "openai", providerModel: "gpt-5.4-mini", contextTokens: 272_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-03" },
   { canonical: "o4-mini", provider: "openai", providerModel: "o4-mini", contextTokens: 200_000, maxOutputTokens: 100_000, thinking: STD, images: true, releaseDate: "2025-04" },
   { canonical: "o3", provider: "openai", providerModel: "o3", contextTokens: 200_000, maxOutputTokens: 100_000, thinking: STD, images: true, releaseDate: "2025-04" },
   { canonical: "gpt-4.1", provider: "openai", providerModel: "gpt-4.1", contextTokens: 1_000_000, maxOutputTokens: 32_768, thinking: [], images: true, releaseDate: "2025-04" },
@@ -182,7 +183,44 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
  * usable list endpoint, so an OAuth-only OpenAI login surfaces exactly these instead
  * of the full chat-completions catalog. Verified live against a ChatGPT account.
  */
-export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4"];
+export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
+
+/**
+ * Session-lifetime cache of OpenAI Codex model ids OBSERVED live from the account's
+ * own `codex/models` response (see `listProviderModels` in model-discovery.ts, which
+ * calls `recordLiveCodexModels` on every successful OAuth discovery). `CODEX_MODELS`
+ * above is a maintained snapshot that WILL drift the moment OpenAI ships a new Codex
+ * model — that drift is exactly the bug class this closes: the picker shows a model
+ * (from the SAME live endpoint) that the static gate then hard-rejects at call time
+ * ("OAuth doesn't support this model") even though the account can serve it. Any
+ * successful discovery this session widens the gate immediately, no release needed;
+ * a fresh process starts empty and falls back to the static list until the first
+ * discovery call (picker open, `jeo doctor`, or model resolution) populates it.
+ */
+const liveCodexModels = new Set<string>();
+
+/** Record model ids OpenAI's live Codex endpoint returned for the current account
+ *  this session. Additive only — never removes a previously-observed id (a transient
+ *  discovery hiccup should never narrow what a call is allowed to reach). */
+export function recordLiveCodexModels(ids: readonly string[]): void {
+  for (const id of ids) liveCodexModels.add(id);
+}
+
+/** True when `model` is a Codex-servable id — either in the maintained static list,
+ *  or observed live this session (see `recordLiveCodexModels`). Accepts a bare or
+ *  `openai/`-qualified id. */
+export function isCodexModel(model: string): boolean {
+  const wire = model.startsWith("openai/") ? model.slice(7) : model;
+  return CODEX_MODELS.includes(wire) || liveCodexModels.has(wire);
+}
+
+/** Test-only: clear the live-observed Codex model cache (mirrors `resetPromptRouterWarnings`
+ *  / `resetAppearanceCache`). Bun runs test files in one process, so this module-level Set
+ *  would otherwise leak an `oauth`-source `listProviderModels("openai", …)` call's observed
+ *  ids into unrelated tests in the same run. */
+export function resetLiveCodexModels(): void {
+  liveCodexModels.clear();
+}
 
 /**
  * Model ids the Kimi Code OAuth backend (api.kimi.com/coding, Anthropic Messages

package/src/ai/model-discovery.ts

@@ -11,7 +11,7 @@ import { readGlobalConfig, type Config } from "../agent/state";
 import { resolveCredential, type AuthProvider, type Credential } from "../auth";
 import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
-import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS } from "./model-catalog";
+import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS, recordLiveCodexModels } from "./model-catalog";
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
@@ -405,6 +405,10 @@ export async function listProviderModels(
       }
     }
     const models = [...new Set(ids)].sort().slice(0, limit);
+    // Widen the self-healing Codex gate (model-catalog.ts) the moment the account's
+    // OWN live endpoint confirms a model — closes the "picker shows it, call-time
+    // gate rejects it" drift window without waiting for a jeo release.
+    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models);
     return { provider, models, ok: true, source };
   } catch (err) {
     const msg = (err as Error)?.name === "TimeoutError" || (err as Error)?.name === "AbortError" ? "timeout" : "unreachable";
@@ -412,6 +416,27 @@ export async function listProviderModels(
   }
 }
 
+/** Live reachability probe for a KEYLESS local provider (ollama/lmstudio) — the
+ *  narrow gap `describeProvider` leaves open: it reports these as `ready: true`
+ *  unconditionally (keyless means "no credential needed", not "server is up"), so
+ *  a routing decision that lands on a downed local server previously sailed past
+ *  every readiness check and only failed at call time with a raw, unhelpful
+ *  connection error (see `friendlyProviderError`'s `ConnectionContextError`
+ *  branch for the same failure surfaced OUTSIDE this proactive check, e.g. an
+ *  explicit `/model ollama/...` pin). Reuses `listProviderModels`'s tested
+ *  fetch/timeout/error handling — never throws. `timeoutMs` defaults short
+ *  (1500ms, well under `listProviderModels`'s 5000ms default): a live loopback
+ *  service answers in single-digit ms, so this stays cheap on the turn hot path
+ *  and still fails fast on a genuinely unreachable host. */
+export async function isLocalProviderReachable(
+  provider: "ollama" | "lmstudio",
+  baseUrl: string | undefined,
+  opts: Pick<DiscoveryOptions, "timeoutMs" | "fetchImpl"> = {},
+): Promise<boolean> {
+  const result = await listProviderModels(provider, { baseUrl, timeoutMs: opts.timeoutMs ?? 1500, fetchImpl: opts.fetchImpl, limit: 1 });
+  return result.ok;
+}
+
 /**
  * Discover live models across providers. By default only queries providers that
  * are logged in / reachable (skips `none` cloud providers); ollama is always

package/src/ai/model-manager.ts

@@ -6,10 +6,10 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor, BUILTIN_ALIASES } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { OPENAI_COMPAT_NAMES, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
-import { withRetry, defaultRetryable, type RetryOptions } from "../util/retry";
+import { withRetry, defaultRetryable, withConnectionContext, isConnectionError, ConnectionContextError, type RetryOptions } from "../util/retry";
 import { jeoEnv } from "../util/env";
 import type { Config } from "../agent/state";
 
@@ -307,10 +307,11 @@ export function resolveRetryOptions(retry: Config["retry"], kind: "request" | "s
  */
 function oauthServesModel(provider: AuthProvider, model: string): boolean {
   if (provider === "openai") {
-    // Provider-qualified ids (`openai/gpt-5.5`) are valid route targets — the
-    // adapters strip the prefix on the wire, so servability must match.
-    const wire = model.startsWith("openai/") ? model.slice(7) : model;
-    return CODEX_MODELS.includes(wire);
+    // `isCodexModel` checks the maintained CODEX_MODELS list PLUS any id observed
+    // live this session (model-catalog.ts) — closes the "picker shows a model the
+    // account's own endpoint just confirmed, call-time gate rejects it anyway" drift
+    // window that opens every time OpenAI ships a new Codex model between releases.
+    return isCodexModel(model);
   }
   if (provider === "kimi") {
     const wire = model.startsWith("kimi/") ? model.slice(5) : model;
@@ -380,6 +381,12 @@ interface Resolved {
   callOptions: CallOptions;
   credential: Credential;
   retry: RetryOptions;
+  /** The resolved provider + effective base URL, threaded through so a raw
+   *  pre-response connection failure (see `isConnectionError`) can be enriched
+   *  with "which provider/URL was unreachable" before it reaches the user —
+   *  the bare fetch error carries neither. */
+  provider: ProviderName;
+  baseUrl: string | undefined;
 }
 
 /**
@@ -452,13 +459,13 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   const retry: RetryOptions = { ...resolveRetryOptions(config.retry, kind), ...(options.onRetry ? { onRetry: options.onRetry } : {}), ...(callOptions.signal ? { signal: callOptions.signal } : {}) };
 
   if (provider === "ollama" || provider === "lmstudio") {
-    return { adapter, callOptions, credential: { kind: "none", provider: "openai" }, retry };
+    return { adapter, callOptions, credential: { kind: "none", provider: "openai" }, retry, provider, baseUrl };
   }
 
   if (provider === "xai") {
     const key = config.providers?.xai;
     if (!key) throw new Error("No credential for provider 'xai'. Set XAI_API_KEY (or providers.xai in config).");
-    return { adapter, callOptions, credential: xaiCredential(key), retry };
+    return { adapter, callOptions, credential: xaiCredential(key), retry, provider, baseUrl };
   }
 
   if (provider === "antigravity") {
@@ -472,7 +479,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
     if (credential.kind !== "oauth") {
       throw new Error("Antigravity models use Google OAuth. Run 'jeo auth login antigravity' (recommended) or 'jeo auth login gemini', then retry — the Google Cloud projectId is discovered automatically.");
     }
-    return { adapter, callOptions, credential, retry };
+    return { adapter, callOptions, credential, retry, provider, baseUrl };
   }
 
   const credentialProvider = provider as AuthProvider;
@@ -481,7 +488,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   const isLocalOpenAi = provider === "openai" && !!baseUrl;
   if (provider === "openai" && effective.kind === "oauth" && !isLocalOpenAi && !oauthServesModel("openai", model)) {
     throw new Error(
-      "OpenAI OAuth 자격증명은 Codex 모델(gpt-5.5/gpt-5.4)만 지원. OPENAI_API_KEY를 설정하거나 모델을 변경하세요"
+      `OpenAI OAuth 자격증명은 Codex 모델(${CODEX_MODELS.join("/")})만 지원. OPENAI_API_KEY를 설정하거나 모델을 변경하세요`
     );
   }
   if (provider === "kimi" && effective.kind === "oauth" && !oauthServesModel("kimi", model)) {
@@ -494,7 +501,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
       `No credential for provider '${provider}'. Run 'jeo setup', 'jeo auth login', or set ${provider.toUpperCase()}_API_KEY / ${provider.toUpperCase()}_OAUTH_TOKEN.`
     );
   }
-  return { adapter, callOptions, credential: credentialForCall(provider, effective, config, baseUrl), retry };
+  return { adapter, callOptions, credential: credentialForCall(provider, effective, config, baseUrl), retry, provider, baseUrl };
 }
 
 /** Hard wall-clock cap for a single NON-streaming provider request (service-readiness: a
@@ -694,11 +701,15 @@ export function createModelManager(): ModelManager {
   return {
     resolveProvider,
     async call(messages, options = {}) {
-      const { adapter, callOptions, credential, retry } = await resolveCall(options);
-      return withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, callTimeoutMs()) }, credential), retry);
+      const { adapter, callOptions, credential, retry, provider, baseUrl } = await resolveCall(options);
+      return withConnectionContext(
+        () => withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, callTimeoutMs()) }, credential), retry),
+        provider,
+        baseUrl,
+      );
     },
     async *stream(messages, options = {}) {
-      const { adapter, callOptions, credential, retry } = await resolveCall(options, "stream");
+      const { adapter, callOptions, credential, retry, provider, baseUrl } = await resolveCall(options, "stream");
       if (adapter.stream) {
         const streamFn = adapter.stream.bind(adapter);
         // Per-attempt abort controller fired by the idle timeout — so a stalled stream
@@ -733,15 +744,24 @@ export function createModelManager(): ModelManager {
           return streamFn(messages, { ...liveOptions, signal }, credential)[Symbol.asyncIterator]();
         };
         const maxMs = streamMaxMs();
-        yield* retryableStream(makeIter, retry, {
-          idleMs: streamIdleMs(),
-          ...(maxMs !== undefined ? { deadlineAt: Date.now() + maxMs } : {}),
-          lastActivityAt: () => lastActivityAt,
-          onIdle: () => attempt?.abort(),
-        });
+        try {
+          yield* retryableStream(makeIter, retry, {
+            idleMs: streamIdleMs(),
+            ...(maxMs !== undefined ? { deadlineAt: Date.now() + maxMs } : {}),
+            lastActivityAt: () => lastActivityAt,
+            onIdle: () => attempt?.abort(),
+          });
+        } catch (err) {
+          if (isConnectionError(err)) throw new ConnectionContextError(provider, baseUrl, err);
+          throw err;
+        }
       } else {
         // Fallback: providers without streaming yield the full response as one chunk.
-        yield await withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, callTimeoutMs()) }, credential), retry);
+        yield await withConnectionContext(
+          () => withRetry(() => adapter.call(messages, { ...callOptions, signal: withTimeout(callOptions.signal, callTimeoutMs()) }, credential), retry),
+          provider,
+          baseUrl,
+        );
       }
     },
   };

package/src/ai/providers/antigravity.ts

@@ -2,10 +2,10 @@ import { randomUUID } from "node:crypto";
 import type { Credential } from "../../auth";
 import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readSse } from "../sse";
-import { providerHttpError } from "./errors";
+import { providerHttpError, ProviderStreamError } from "./errors";
 import { serializeToolCalls } from "../../agent/tool-schemas";
 import { sanitizeJsonStrings } from "../../util/sanitize-json";
-import { geminiThinkingConfig, getGeminiCliHeaders, type GeminiThinkingConfig } from "./gemini";
+import { geminiThinkingConfig, type GeminiThinkingConfig } from "./gemini";
 
 const ANTIGRAVITY_DAILY_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
 const ANTIGRAVITY_SANDBOX_ENDPOINT = "https://daily-cloudcode-pa.sandbox.googleapis.com";
@@ -95,11 +95,31 @@ export async function resolveAntigravityProjectId(
 
   const discover = opts.discover ?? (async (token: string) => {
     const { discoverGoogleProjectId, ANTIGRAVITY_DISCOVERY_METADATA } = await import("../../auth/flows/google-project");
-    // Antigravity-client tokens discover with ANTIGRAVITY metadata; gemini-cli
-    // tokens use the default gemini-cli metadata shape.
-    return discoverGoogleProjectId(token, credential.provider === "antigravity"
-      ? { metadata: { ...ANTIGRAVITY_DISCOVERY_METADATA }, extraHeaders: { "User-Agent": getAntigravityUserAgent() }, alwaysOnboard: true, signal: opts.signal }
-      : { extraHeaders: getGeminiCliHeaders(), signal: opts.signal });
+    // This function's SOLE callers are fetchAntigravity/ccaTurn — every discovery
+    // it performs exists to serve an Antigravity/Cloud-Code-Assist turn, so it must
+    // ALWAYS identify itself to Google as Antigravity (metadata + User-Agent),
+    // regardless of which OAuth STORAGE SLOT the token came from (a dedicated
+    // antigravity login vs a plain gemini-cli token used as fallback — the common
+    // case for users who only ran `jeo auth login gemini`, the documented default).
+    // Previously this branched on `credential.provider === "antigravity"` and sent
+    // gemini-cli identity (User-Agent `GeminiCLI/…`, metadata `pluginType: GEMINI`)
+    // for the fallback case. Root-caused live: Google's `loadCodeAssist` now REJECTS
+    // that identity for gemini-cli-individual accounts it has migrated to Antigravity
+    // (`ineligibleTiers[].reasonCode: "UNSUPPORTED_CLIENT"`, message "please migrate
+    // to the Antigravity suite of products") — the response omits `currentTier`/
+    // `cloudaicompanionProject` entirely, so discovery falls through into onboarding,
+    // which then fails after 5 polls with "did not return a provisioned project id"
+    // even though the SAME account resolves its EXISTING project instantly (0 polls)
+    // once the request honestly identifies as Antigravity. This was the actual
+    // observed "stops/hangs on Antigravity Gemini" symptom for any account without a
+    // dedicated antigravity OAuth login: a deterministic, fast-failing (not literally
+    // infinite) but 100%-reproducible discovery break, not a timeout/network hang.
+    return discoverGoogleProjectId(token, {
+      metadata: { ...ANTIGRAVITY_DISCOVERY_METADATA },
+      extraHeaders: { "User-Agent": getAntigravityUserAgent() },
+      alwaysOnboard: true,
+      signal: opts.signal,
+    });
   });
   let projectId: string;
   try {
@@ -232,6 +252,17 @@ interface CcaChunk {
     candidates?: { content?: { parts?: { text?: string; thought?: boolean; functionCall?: { name?: string; args?: Record<string, unknown> } }[] }; finishReason?: string }[];
     usageMetadata?: CcaUsage;
   };
+  /** A `google.rpc.Status`-shaped in-band error line, sibling of `response` — see
+   *  `gemini.ts`'s identical field for the full rationale (silently swallowed here
+   *  before this fix, which for a turn that had already streamed some text meant an
+   *  early, error-free, TRUNCATED stop: "안티그라비티 모델이 중간에 멈추는" report). */
+  error?: { code?: number; message?: string; status?: string };
+}
+/** Throw a {@link ProviderStreamError} for an in-band error line — no-op when absent. */
+function throwIfGoogleStreamError(chunk: CcaChunk): void {
+  const err = chunk.error;
+  if (!err) return;
+  throw new ProviderStreamError("Antigravity", err.message ?? "unknown error", err.status, err.code);
 }
 /** When Antigravity (Cloud Code Assist) returns HTTP 200 with no text, surface the
  *  real cause (safety block / RECITATION / etc.) instead of a silent, reason-free
@@ -293,6 +324,7 @@ export const antigravityAdapter: ProviderAdapter = {
     for await (const data of readSse(response.body)) {
       let chunk: CcaChunk;
       try { chunk = JSON.parse(data); } catch { continue; }
+      throwIfGoogleStreamError(chunk);
       const thought = thoughtOf(chunk);
       if (thought) options.onReasoning?.(thought);
       const delta = textOf(chunk);
@@ -321,6 +353,7 @@ export const antigravityAdapter: ProviderAdapter = {
     for await (const data of readSse(response.body, options.onStreamActivity)) {
       let chunk: CcaChunk;
       try { chunk = JSON.parse(data); } catch { continue; }
+      throwIfGoogleStreamError(chunk);
       const thought = thoughtOf(chunk);
       if (thought) options.onReasoning?.(thought);
       const delta = textOf(chunk);

package/src/ai/providers/errors.ts

@@ -39,10 +39,14 @@ export class ProviderStreamError extends Error {
   readonly status: number;
   readonly provider: string;
   readonly code?: string;
-  constructor(provider: string, message: string, code?: string) {
+  /** `explicitStatus` lets a caller pass an ALREADY-numeric provider status (e.g. Google's
+   *  `error.code` on a `google.rpc.Status` envelope — 429/500/503) instead of relying on the
+   *  OpenAI-specific `code === "rate_limit_exceeded"` string heuristic below, which only
+   *  recognizes that one literal and defaults everything else to 500. */
+  constructor(provider: string, message: string, code?: string, explicitStatus?: number) {
     super(`${provider} stream failed${code ? ` (${code})` : ""}: ${message}`);
     this.name = "ProviderStreamError";
-    this.status = code === "rate_limit_exceeded" ? 429 : 500;
+    this.status = explicitStatus ?? (code === "rate_limit_exceeded" ? 429 : 500);
     this.provider = provider;
     this.code = code;
   }

package/src/ai/providers/gemini.ts

@@ -1,7 +1,7 @@
 import type { Credential } from "../../auth";
 import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readSse } from "../sse";
-import { providerHttpError, fetchWithArtifactFailSafe } from "./errors";
+import { providerHttpError, fetchWithArtifactFailSafe, ProviderStreamError } from "./errors";
 import { jeoEnv } from "../../util/env";
 import { serializeToolCalls } from "../../agent/tool-schemas";
 import { sanitizeJsonStrings } from "../../util/sanitize-json";
@@ -258,11 +258,22 @@ interface GeminiChunk {
   candidates?: { content?: { parts?: { text?: string; thought?: boolean; thoughtSignature?: string; functionCall?: { name?: string; args?: Record<string, unknown> } }[] }; finishReason?: string }[];
   promptFeedback?: { blockReason?: string };
   usageMetadata?: { promptTokenCount?: number; candidatesTokenCount?: number; thoughtsTokenCount?: number };
+  /** A `google.rpc.Status`-shaped in-band error line: Google's streaming endpoints can emit
+   *  this as its own SSE `data:` event on an otherwise-live 200 connection (the codebase
+   *  already knows this envelope shape from `parseRetryFromBody`'s `"retryDelay"` parsing on
+   *  the equivalent non-stream error body) instead of terminating the HTTP response with a
+   *  non-2xx status. Previously silently ignored — neither `candidates` nor `promptFeedback`
+   *  matches it, so it fell through every existing check with no error and no text, which for
+   *  a turn that had already streamed SOME text meant the turn just ended early with a
+   *  truncated reply and no error at all: the "모델이 중간에 멈추는" (model stops mid-way) report. */
+  error?: { code?: number; message?: string; status?: string };
 }
 
-/** Cloud Code Assist wraps each standard chunk under `response`. */
+/** Cloud Code Assist wraps each standard chunk under `response`; an in-band error (see
+ *  `GeminiChunk.error`) arrives as a SIBLING of `response`, not nested inside it. */
 interface CcaChunk {
   response?: GeminiChunk;
+  error?: { code?: number; message?: string; status?: string };
 }
 
 function textOf(chunk: GeminiChunk): string {
@@ -317,6 +328,20 @@ function blockedReason(chunk: GeminiChunk): string | undefined {
   return undefined;
 }
 
+/** Throw a {@link ProviderStreamError} for an in-band `google.rpc.Status` error line (see
+ *  `GeminiChunk.error`/`CcaChunk.error`) — a no-op when the chunk carries none. Mirrors the
+ *  OpenAI Responses `response.failed`/`error` fix: `error.status` (a string enum, e.g.
+ *  `"RESOURCE_EXHAUSTED"`/`"UNAVAILABLE"`/`"INTERNAL"`) plays the same "classifier" role our
+ *  `code` param plays for OpenAI, and `error.code` (Google's own numeric HTTP-equivalent) is
+ *  passed straight through as the explicit status instead of re-derived from a string match. */
+function throwIfGoogleStreamError(
+  provider: string,
+  err: { code?: number; message?: string; status?: string } | undefined,
+): void {
+  if (!err) return;
+  throw new ProviderStreamError(provider, err.message ?? "unknown error", err.status, err.code);
+}
+
 /**
  * Cloud Code Assist SSE turn for a Google OAuth credential: resolves the
  * projectId (stored → env → lazy loadCodeAssist/onboardUser discovery), POSTs
@@ -343,6 +368,7 @@ async function* ccaTurn(messages: Message[], options: CallOptions, credential: C
     } catch {
       continue;
     }
+    throwIfGoogleStreamError("Gemini (Cloud Code Assist)", chunk.error);
     const inner = chunk.response;
     if (!inner) continue;
     const thought = thoughtOf(inner);
@@ -419,6 +445,7 @@ export const geminiAdapter: ProviderAdapter = {
       } catch {
         continue;
       }
+      throwIfGoogleStreamError("Gemini", chunk.error);
       const thought = thoughtOf(chunk);
       if (thought) options.onReasoning?.(thought);
       captureGeminiSignatures(chunk, options, seenSigs);

package/src/commands/launch/model-slash.ts

@@ -21,6 +21,7 @@ import {
   resolveSelection,
   catalogMetadata,
   CODEX_MODELS,
+  isCodexModel,
   qualifyModelId,
 } from "../../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ThinkLevel } from "../../ai";
@@ -287,7 +288,10 @@ export async function runModelSlash(input: string, ctx: ModelSlashCtx): Promise<
   if (st && !st.ready) console.log(`  ! ${provider} is not ready (${st.label}) — set ${st.envVar ?? "the provider key"} or run 'jeo setup'.`);
   // ChatGPT OAuth only serves the Codex models; warn before the turn fails if the user
   // pins a non-Codex id with no local base URL to fall back to (gjc-parity readiness guard).
-  if (arg && provider === "openai" && st?.kind === "oauth" && !CODEX_MODELS.includes(resolved)) {
+  // `isCodexModel` also accepts any id this session's OWN live discovery already
+  // confirmed (see model-catalog.ts) — a static-list-only check here would falsely
+  // warn about a model /model's own live picker just showed as valid.
+  if (arg && provider === "openai" && st?.kind === "oauth" && !isCodexModel(resolved)) {
     const hasLocalBase = !!((await readGlobalConfig()).openaiBaseUrl || process.env.OPENAI_BASE_URL);
     if (!hasLocalBase) {
       console.log(`  ! ChatGPT OAuth serves only Codex models (${CODEX_MODELS.join(", ")}); '${resolved}' will be rejected at runtime — pick one of those, or set OPENAI_API_KEY / OPENAI_BASE_URL.`);

package/src/commands/launch.ts

@@ -45,7 +45,7 @@ import { callLlm, type Message } from "../agent/loop";
 import { friendlyProviderError } from "../util/provider-error";
 import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/state";
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
-import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig } from "../ai";
+import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal } from "../agent/goal-verifier";
 import { routePrompt, deriveCacheSessionKey, warnOnce, type RouteDecision } from "../agent/prompt-router";
@@ -926,6 +926,32 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           `[route] routed to '${routed.model}' but the stored ${routedProvider} OAuth login cannot serve that model — falling back to the default model this turn. Set ${routedProvider.toUpperCase()}_API_KEY or reconfigure routing.tiers/roles to a model your login serves.`,
         );
         routed = null;
+      } else if (routedProvider === "ollama" || routedProvider === "lmstudio") {
+        // Live reachability gate for LOCAL providers only: `describeProvider` reports
+        // ollama/lmstudio as `ready: true` unconditionally (keyless just means "no
+        // credential needed", not "the server is actually up"), so a routing.tiers/
+        // roles pin to a downed local server previously sailed past every readiness
+        // check above and only failed mid-turn with a raw, provider-less connection
+        // error ("Unable to connect. Is the computer able to access the url?" —
+        // Bun's fetch/undici error for a refused connection AND an unresolvable
+        // host alike). A short-timeout live probe here keeps routing's fail-open
+        // contract intact for the one credential class it couldn't previously see
+        // through. Cloud providers never reach this branch — their credential/
+        // servability checks above are sufficient and adding a live probe there
+        // would just add latency for a class of failure `withRetry` already
+        // recovers from at call time.
+        const localBaseUrl = routedProvider === "ollama"
+          ? (turnConfig.ollamaBaseUrl ?? "http://localhost:11434")
+          : (turnConfig.lmstudioBaseUrl ?? "http://localhost:1234/v1");
+        const reachable = await isLocalProviderReachable(routedProvider, localBaseUrl);
+        if (!reachable) {
+          routeVetoNote = `routed model '${routed.model}' (${routedProvider}) is unreachable at ${localBaseUrl} this turn — fell back to '${sessionModel || defaultModel}'`;
+          routeCredentialNotice = warnOnce(
+            `prompt-router:provider-unreachable:${routedProvider}`,
+            `[route] routed to '${routed.model}' (${routedProvider}) but ${localBaseUrl} is unreachable — falling back to the default model this turn. Start the ${routedProvider} server, or reconfigure routing.tiers/roles for a provider that is running.`,
+          );
+          routed = null;
+        }
       }
     }
     lastRouteDecision = routed ?? (routeVetoNote ? { note: routeVetoNote } : routingEnabled && !sessionModel ? { note: "routing produced no decision (fail-open)" } : { note: "routing not active this turn" });

package/src/skills/catalog.ts

@@ -188,6 +188,7 @@ export function skillsPromptSection(skills: SkillDoc[] = SKILLS): string {
 }
 
 import * as fs from "node:fs/promises";
+import type { Dirent } from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 
@@ -411,6 +412,54 @@ function isSupportedExternalSkill(doc: SkillDoc): boolean {
   return !RESERVED_SKILL_NAMES.has(nameLower);
 }
 
+/** Resolve ONE directory entry from {@link skillDirs} to its `SkillDoc`, or `null`
+ *  when the entry is not a skill (dotfile, non-`.md` file, directory with no
+ *  `SKILL.md`, unreadable/broken symlink). Pure I/O + parse — no shared-state
+ *  writes — so callers can run many of these concurrently. */
+async function resolveSkillEntry(dir: string, entry: Dirent): Promise<SkillDoc | null> {
+  if (entry.name.startsWith(".")) return null;
+  let isFile = entry.isFile();
+  let isDir = entry.isDirectory();
+  // Vercel `npx skills add` links agent dirs (.claude/skills/x) to its canonical
+  // store — a symlinked skill reports NEITHER isFile nor isDirectory on the
+  // Dirent, which silently dropped every linked skill. Follow the link.
+  if (entry.isSymbolicLink()) {
+    try {
+      const st = await fs.stat(path.join(dir, entry.name));
+      isFile = st.isFile();
+      isDir = st.isDirectory();
+    } catch { return null; /* broken symlink */ }
+  }
+  if (isFile && entry.name.endsWith(".md")) {
+    const nm = entry.name.slice(0, -3);
+    const filePath = path.join(dir, entry.name);
+    try {
+      const parsed = parseSkillMarkdown(nm, await fs.readFile(filePath, "utf-8"), { preferMetaName: true });
+      parsed.sourcePath = filePath;
+      return isSupportedExternalSkill(parsed) ? parsed : null;
+    } catch { return null; /* unreadable file */ }
+  }
+  if (isDir) {
+    const skillPath = path.join(dir, entry.name, "SKILL.md");
+    try {
+      const parsed = parseSkillMarkdown(entry.name, await fs.readFile(skillPath, "utf-8"), { preferMetaName: true });
+      parsed.sourcePath = skillPath;
+      return isSupportedExternalSkill(parsed) ? parsed : null;
+    } catch { return null; /* dir without SKILL.md, or unreadable */ }
+  }
+  return null;
+}
+
+/** Concurrency cap for {@link resolveSkillEntry} within one directory: high enough
+ *  that a large skill directory (hundreds of entries — a real field case: `npx skills
+ *  add`-style installs commonly accumulate 500+) resolves in one or two batches
+ *  instead of paying per-file `fs` round-trip latency SEQUENTIALLY (534 entries at
+ *  ~0.4ms/syscall was a measured ~220ms — a visible stall on every session start and
+ *  every `/skill` listing), while staying well under the lowest realistic per-process
+ *  file-descriptor ulimit (macOS defaults to 256) even with several directories'
+ *  batches racing across the `skillDirs` loop below. */
+const SKILL_ENTRY_LOAD_BATCH = 32;
+
 /** Bundled skills merged with user skill docs from {@link skillDirs} (user overrides by name). */
 export async function loadSkills(cwd: string = process.cwd()): Promise<SkillDoc[]> {
   try {
@@ -424,39 +473,20 @@ export async function loadSkills(cwd: string = process.cwd()): Promise<SkillDoc[
     }
   } catch {}
   const byName = new Map<string, SkillDoc>(SKILLS.map(s => [s.name.toLowerCase(), s]));
+  // Directories are walked in their documented lowest→highest precedence order
+  // (a later dir's skill overrides an earlier one with the same name) — that
+  // cross-directory override MUST stay sequential. Entries WITHIN one directory
+  // have no such contract (readdir order is not a precedence guarantee anyone
+  // depends on), so they resolve concurrently in bounded batches, then apply to
+  // `byName` in their original readdir order for a fully deterministic result.
   for (const dir of skillDirs(cwd)) {
-    let entries: import("node:fs").Dirent[] = [];
+    let entries: Dirent[] = [];
     try { entries = await fs.readdir(dir, { withFileTypes: true }); } catch { continue; }
-    for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
-      let isFile = entry.isFile();
-      let isDir = entry.isDirectory();
-      // Vercel `npx skills add` links agent dirs (.claude/skills/x) to its canonical
-      // store — a symlinked skill reports NEITHER isFile nor isDirectory on the
-      // Dirent, which silently dropped every linked skill. Follow the link.
-      if (entry.isSymbolicLink()) {
-        try {
-          const st = await fs.stat(path.join(dir, entry.name));
-          isFile = st.isFile();
-          isDir = st.isDirectory();
-        } catch { continue; /* broken symlink */ }
-      }
-      if (isFile && entry.name.endsWith(".md")) {
-        const nm = entry.name.slice(0, -3);
-        try {
-          const parsed = parseSkillMarkdown(nm, await fs.readFile(path.join(dir, entry.name), "utf-8"), { preferMetaName: true });
-          parsed.sourcePath = path.join(dir, entry.name);
-          if (isSupportedExternalSkill(parsed)) byName.set(parsed.name.toLowerCase(), parsed);
-        } catch { /* skip unreadable file */ }
-        continue;
-      }
-      if (isDir) {
-        const skillPath = path.join(dir, entry.name, "SKILL.md");
-        try {
-          const parsed = parseSkillMarkdown(entry.name, await fs.readFile(skillPath, "utf-8"), { preferMetaName: true });
-          parsed.sourcePath = skillPath;
-          if (isSupportedExternalSkill(parsed)) byName.set(parsed.name.toLowerCase(), parsed);
-        } catch { /* skip dirs without SKILL.md or unreadable files */ }
+    for (let i = 0; i < entries.length; i += SKILL_ENTRY_LOAD_BATCH) {
+      const batch = entries.slice(i, i + SKILL_ENTRY_LOAD_BATCH);
+      const resolved = await Promise.all(batch.map(entry => resolveSkillEntry(dir, entry)));
+      for (const parsed of resolved) {
+        if (parsed) byName.set(parsed.name.toLowerCase(), parsed);
       }
     }
   }

package/src/util/provider-error.ts

@@ -4,7 +4,8 @@
  * (carrying `.status` and a body), and the agent loop surfaces failures both as a
  * thrown error and as a `doneReason`, so this lives in a shared util used by both.
  */
-import { isUsageLimitError, isRefusalError } from "./retry";
+import { isUsageLimitError, isRefusalError, isConnectionError, ConnectionContextError } from "./retry";
+import { companyLabel } from "../ai/model-catalog";
 // Re-export: engine.ts and callers import the refusal predicate from here; the
 // definition lives in retry.ts so defaultRetryable can fail fast without a cycle.
 export { isRefusalError } from "./retry";
@@ -32,6 +33,18 @@ function formatDuration(ms: number): string {
 }
 
 export function friendlyProviderError(err: unknown): string {
+  if (err instanceof ConnectionContextError) {
+    const provider = companyLabel(err.provider);
+    const target = err.baseUrl ? ` at ${err.baseUrl}` : "";
+    const isLocal = err.provider === "ollama" || err.provider === "lmstudio";
+    const hint = isLocal
+      ? ` Start the ${provider} server (or check it's still running), verify the base URL in 'jeo setup' / config.json ('${err.provider}BaseUrl'), or switch model with /model.`
+      : ` Check the configured base URL, your network connection, or switch model with /model.`;
+    return `Could not connect to ${provider}${target}.${hint}`;
+  }
+  if (isConnectionError(err)) {
+    return `Could not connect to the provider. Check the configured base URL, your network connection, or switch model with /model.`;
+  }
   const msg = (err as Error)?.message ?? String(err);
   const status = (err as { status?: number })?.status;
   const provider = /antigravity/i.test(msg)

package/src/util/retry.ts

@@ -340,6 +340,34 @@ export function isConnectionError(err: unknown): boolean {
   return /unable to connect\. is the computer able to access the url\?/i.test(errorMessageOf(err));
 }
 
+/** A raw `isConnectionError` failure re-thrown with the provider/URL context the bare
+ *  fetch error never carries (see `isConnectionError`'s docs). `.cause` preserves the
+ *  original error so `isConnectionError`/`defaultRetryable` still recognize it (both
+ *  inspect `.code` and the message text, which this class forwards). */
+export class ConnectionContextError extends Error {
+  readonly code: string | undefined;
+  constructor(readonly provider: string, readonly baseUrl: string | undefined, cause: unknown) {
+    const causeCode = cause && typeof cause === "object" && "code" in cause ? String(cause.code) : undefined;
+    super(errorMessageOf(cause), { cause });
+    this.name = "ConnectionContextError";
+    this.code = causeCode;
+  }
+}
+
+/** Run `fn`; a raw `isConnectionError` failure is re-thrown as a `ConnectionContextError`
+ *  naming `provider`/`baseUrl` so `friendlyProviderError` can turn Bun's context-free
+ *  "Unable to connect. Is the computer able to access the url?" into an actionable
+ *  message. Every other error (including a non-connection failure) passes through
+ *  unchanged. */
+export async function withConnectionContext<T>(fn: () => Promise<T>, provider: string, baseUrl: string | undefined): Promise<T> {
+  try {
+    return await fn();
+  } catch (err) {
+    if (isConnectionError(err)) throw new ConnectionContextError(provider, baseUrl, err);
+    throw err;
+  }
+}
+
 /** True for an in-band provider stream failure: the HTTP response itself was 200 (a
  *  live SSE connection), but the provider emitted a terminal error EVENT instead of
  *  completing (OpenAI Responses `response.failed`/`error`: