jeo-code 0.8.11 → 0.8.12

package/CHANGELOG.md

@@ -6,6 +6,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.12] - 2026-07-08
+_"제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time._
+
+### Fixed
+- **Added the missing `gpt-5.4-mini` to the OAuth allow-list** (`src/ai/model-catalog.ts`) — immediate fix for the exact reported failure, with a full capability row (272K context, 128K max output, full thinking support, image input) added to `MODEL_CATALOG`.
+
+### Added
+- **Self-healing live Codex model gate** (`src/ai/model-catalog.ts`, `src/ai/model-discovery.ts`, `src/ai/model-manager.ts`, `src/commands/launch/model-slash.ts`) — new `isCodexModel()` checks the maintained `CODEX_MODELS` list PLUS any model id this session's OWN OAuth discovery call already observed live (`recordLiveCodexModels`, additive-only, session-lifetime). `listProviderModels` now records every `oauth`-sourced OpenAI model list on a successful call (picker open, `jeo doctor`, or any model resolution) — an `api_key`-sourced result never widens the gate, since it says nothing about what OAuth can serve. `oauthServesModel` (the gate behind `resolveCall`, `effectiveCredentialForProvider`, and `modelServableWithConfig`) and the `/model` pin-warning now both consult `isCodexModel` instead of the raw static list — closes this bug class permanently: any future Codex model OpenAI ships becomes usable the moment the account's own endpoint confirms it, with zero release lag. The OAuth-rejection error message is now built dynamically from `CODEX_MODELS` instead of a hard-coded two-model string.
+
+### Verified
+- Independently mutation-tested (5 mutations across all 4 touched files): all 5 caught by tests; found and closed 1 genuine gap in `recordLiveCodexModels`'s additive-across-separate-calls contract (a clear-then-add REPLACE implementation was indistinguishable from ADD until a test called it twice with disjoint id lists).
+- Live-verified: `jeo --model gpt-5.4-mini -p "hello"` failed with the OAuth-rejection error before the fix, succeeds after.
+- Full suite 2802/2802 pass, typecheck clean.
+
 ## [0.8.11] - 2026-07-08
 _"프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered._
 

package/README.ja.md

@@ -262,11 +262,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -263,11 +263,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -265,11 +265,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -262,11 +262,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 - **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
-- **[0.8.7]** (2026-07-08) — Fix-forward for a CI-caught release failure in v0.8.6 (this same session): `test/launch-prompt-routing.test.ts` shipped with a dropped closing brace (a git 3-way merge misaligned on a duplicate `});` line during this session's own working-tree isolation, then a subsequent `git stash push --keep-index` silently reset the working tree to the pre-fix staged content — the fix was applied once, verified once, then invisibly reverted before the commit that actually shipped). The v0.8.6 GitHub Actions release workflow correctly caught the syntax error at `bun test` and failed BEFORE the npm publish step ran; `npm view jeo-code version` confirmed 0.8.5 remained latest throughout — nothing broken ever reached the registry. Per this repo's established pattern for a same-day CI-caught regression (v0.8.0 → v0.8.1), shipping forward rather than retargeting the already-publicly-failed v0.8.6 tag.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/memory.ts

@@ -229,11 +229,53 @@ interface ParsedConceptEntry { sig: string; concept: Concept | null }
 const parsedConceptCache = new Map<string, ParsedConceptEntry>();
 const PARSED_CONCEPT_CACHE_CAP = 512;
 
+/** Single-slot cache for `buildCorpusStats`/`buildConceptGraph` over the LAST
+ *  `concepts` array seen, keyed by reference identity. `memoryPromptSection` runs
+ *  `selectWithinBudget` once per interactive turn (`refreshSessionMemory`) and once
+ *  per subagent spawn (team/ralph/autopilot) — each call re-tokenized every concept's
+ *  searchable text and re-scanned every body for cross-links, even when NOTHING in the
+ *  bundle changed between calls. `loadConcepts` already returns the same cached `Concept`
+ *  OBJECTS when a file's mtime/size is unchanged (see `parsedConceptCache` above), so an
+ *  identical (same length + same object references) `concepts` array is the common case
+ *  across consecutive calls in one session — this hits that case with a cheap O(n)
+ *  reference-equality scan instead of paying the O(n · text length) rebuild. A genuinely
+ *  changed bundle (new/edited/deleted concept) always produces a different array — either
+ *  a different length or at least one different object reference — so correctness never
+ *  depends on this cache; it only skips work that would reach the same answer. */
+let statsGraphCacheConcepts: Concept[] | null = null;
+let statsGraphCacheStats: CorpusStats | null = null;
+let statsGraphCacheGraph: ConceptGraph | null = null;
+
+function sameConceptsArray(a: Concept[], b: Concept[]): boolean {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+
+/** Corpus stats + link graph for `concepts`, memoized against the last call (see above). */
+function statsAndGraphFor(concepts: Concept[]): { stats: CorpusStats; graph: ConceptGraph } {
+  if (
+    statsGraphCacheConcepts && statsGraphCacheStats && statsGraphCacheGraph &&
+    sameConceptsArray(statsGraphCacheConcepts, concepts)
+  ) {
+    return { stats: statsGraphCacheStats, graph: statsGraphCacheGraph };
+  }
+  const stats = buildCorpusStats(concepts);
+  const graph = buildConceptGraph(concepts);
+  statsGraphCacheConcepts = concepts;
+  statsGraphCacheStats = stats;
+  statsGraphCacheGraph = graph;
+  return { stats, graph };
+}
+
 /** Drop the per-file concept parse cache so the next loadConcepts re-reads disk.
  *  The cache is already mtime/size self-invalidating; this is a hard reset for
  *  tests and callers that mutate files without changing their stat signature. */
 export function invalidateConceptCache(): void {
   parsedConceptCache.clear();
+  statsGraphCacheConcepts = null;
+  statsGraphCacheStats = null;
+  statsGraphCacheGraph = null;
 }
 
 /** Read every concept document in the bundle into structured `Concept`s. Reserved
@@ -572,8 +614,7 @@ function selectWithinBudget(concepts: Concept[], query: string | undefined, budg
   const sectionLenByType = new Map<string, number>(); // type -> rendered length of that type's section so far
   let total = 0; // rendered length of `selected` under renderConcepts
 
-  const stats = buildCorpusStats(concepts);
-  const graph = buildConceptGraph(concepts);
+  const { stats, graph } = statsAndGraphFor(concepts);
 
   const take = (pool: Concept[]) => {
     for (const c of priorityOrder(pool, query, stats, graph)) {

package/src/agent/tool-output.ts

@@ -60,15 +60,18 @@ export const TOOL_SPILL_THRESHOLD = TOOL_OUTPUT_MAX;
 /** Most recent tool-result artifacts to keep; older ones are pruned on each spill. */
 export const MAX_TOOL_ARTIFACTS = 50;
 
-/** Best-effort retention: keep the newest `MAX_TOOL_ARTIFACTS` files in `dir`, delete the rest. */
+/** Best-effort retention: keep the newest `MAX_TOOL_ARTIFACTS` files in `dir`, delete the
+ *  rest. Filenames are always `${Date.now()}-${rand}-${tool}.txt` (spillToolResult is the
+ *  sole writer into this directory) — the leading 13-digit millisecond timestamp is fixed-
+ *  width until year 2286, so a plain lexicographic sort of the FILENAMES reproduces mtime
+ *  order exactly. This replaces an `fs.stat` per file (up to MAX_TOOL_ARTIFACTS syscalls,
+ *  paid on every spill once a long session's artifact dir sits at/near the cap) with a pure
+ *  in-memory string sort — zero syscalls beyond the single `readdir` every call already paid. */
 async function pruneToolArtifacts(dir: string): Promise<void> {
   const files = await fs.readdir(dir).catch(() => [] as string[]);
   if (files.length <= MAX_TOOL_ARTIFACTS) return;
-  const stamped = await Promise.all(
-    files.map(async f => ({ f, m: (await fs.stat(path.join(dir, f)).catch(() => null))?.mtimeMs ?? 0 })),
-  );
-  stamped.sort((a, b) => b.m - a.m); // newest first
-  for (const { f } of stamped.slice(MAX_TOOL_ARTIFACTS)) {
+  const newestFirst = [...files].sort((a, b) => (a < b ? 1 : a > b ? -1 : 0));
+  for (const f of newestFirst.slice(MAX_TOOL_ARTIFACTS)) {
     await fs.rm(path.join(dir, f), { force: true }).catch(() => {});
   }
 }

package/src/ai/model-catalog.ts

@@ -101,6 +101,7 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
   // OpenAI (newest first: gpt-5.5 > gpt-5.4 > o4-mini/o3/gpt-4.1 > o3-mini > gpt-4o-mini > gpt-4o)
   { canonical: "gpt-5.5", provider: "openai", providerModel: "gpt-5.5", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-04" },
   { canonical: "gpt-5.4", provider: "openai", providerModel: "gpt-5.4", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-03" },
+  { canonical: "gpt-5.4-mini", provider: "openai", providerModel: "gpt-5.4-mini", contextTokens: 272_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-03" },
   { canonical: "o4-mini", provider: "openai", providerModel: "o4-mini", contextTokens: 200_000, maxOutputTokens: 100_000, thinking: STD, images: true, releaseDate: "2025-04" },
   { canonical: "o3", provider: "openai", providerModel: "o3", contextTokens: 200_000, maxOutputTokens: 100_000, thinking: STD, images: true, releaseDate: "2025-04" },
   { canonical: "gpt-4.1", provider: "openai", providerModel: "gpt-4.1", contextTokens: 1_000_000, maxOutputTokens: 32_768, thinking: [], images: true, releaseDate: "2025-04" },
@@ -182,7 +183,44 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
  * usable list endpoint, so an OAuth-only OpenAI login surfaces exactly these instead
  * of the full chat-completions catalog. Verified live against a ChatGPT account.
  */
-export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4"];
+export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
+
+/**
+ * Session-lifetime cache of OpenAI Codex model ids OBSERVED live from the account's
+ * own `codex/models` response (see `listProviderModels` in model-discovery.ts, which
+ * calls `recordLiveCodexModels` on every successful OAuth discovery). `CODEX_MODELS`
+ * above is a maintained snapshot that WILL drift the moment OpenAI ships a new Codex
+ * model — that drift is exactly the bug class this closes: the picker shows a model
+ * (from the SAME live endpoint) that the static gate then hard-rejects at call time
+ * ("OAuth doesn't support this model") even though the account can serve it. Any
+ * successful discovery this session widens the gate immediately, no release needed;
+ * a fresh process starts empty and falls back to the static list until the first
+ * discovery call (picker open, `jeo doctor`, or model resolution) populates it.
+ */
+const liveCodexModels = new Set<string>();
+
+/** Record model ids OpenAI's live Codex endpoint returned for the current account
+ *  this session. Additive only — never removes a previously-observed id (a transient
+ *  discovery hiccup should never narrow what a call is allowed to reach). */
+export function recordLiveCodexModels(ids: readonly string[]): void {
+  for (const id of ids) liveCodexModels.add(id);
+}
+
+/** True when `model` is a Codex-servable id — either in the maintained static list,
+ *  or observed live this session (see `recordLiveCodexModels`). Accepts a bare or
+ *  `openai/`-qualified id. */
+export function isCodexModel(model: string): boolean {
+  const wire = model.startsWith("openai/") ? model.slice(7) : model;
+  return CODEX_MODELS.includes(wire) || liveCodexModels.has(wire);
+}
+
+/** Test-only: clear the live-observed Codex model cache (mirrors `resetPromptRouterWarnings`
+ *  / `resetAppearanceCache`). Bun runs test files in one process, so this module-level Set
+ *  would otherwise leak an `oauth`-source `listProviderModels("openai", …)` call's observed
+ *  ids into unrelated tests in the same run. */
+export function resetLiveCodexModels(): void {
+  liveCodexModels.clear();
+}
 
 /**
  * Model ids the Kimi Code OAuth backend (api.kimi.com/coding, Anthropic Messages

package/src/ai/model-discovery.ts

@@ -11,7 +11,7 @@ import { readGlobalConfig, type Config } from "../agent/state";
 import { resolveCredential, type AuthProvider, type Credential } from "../auth";
 import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
-import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS } from "./model-catalog";
+import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS, recordLiveCodexModels } from "./model-catalog";
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
@@ -405,6 +405,10 @@ export async function listProviderModels(
       }
     }
     const models = [...new Set(ids)].sort().slice(0, limit);
+    // Widen the self-healing Codex gate (model-catalog.ts) the moment the account's
+    // OWN live endpoint confirms a model — closes the "picker shows it, call-time
+    // gate rejects it" drift window without waiting for a jeo release.
+    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models);
     return { provider, models, ok: true, source };
   } catch (err) {
     const msg = (err as Error)?.name === "TimeoutError" || (err as Error)?.name === "AbortError" ? "timeout" : "unreachable";

package/src/ai/model-manager.ts

@@ -6,7 +6,7 @@ import "./register-providers"; // side-effect: registers built-in adapters into
 import type { CallOptions, Message, ProviderAdapter, ProviderName } from "./types";
 import { expandAlias, resolveModelId, effectiveAliasesFor, BUILTIN_ALIASES } from "./model-registry";
 import { findCatalogEntry, type ModelCatalogEntry } from "./model-catalog-compat";
-import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel } from "./model-catalog";
+import { toProviderModel, CODEX_MODELS, KIMI_CODE_MODELS, findCatalogModel, isCodexModel } from "./model-catalog";
 import { xaiCredential } from "./providers/xai";
 import { OPENAI_COMPAT_NAMES, isOpenAICompatProvider } from "./providers/openai-compatible-catalog";
 import { withRetry, defaultRetryable, withConnectionContext, isConnectionError, ConnectionContextError, type RetryOptions } from "../util/retry";
@@ -307,10 +307,11 @@ export function resolveRetryOptions(retry: Config["retry"], kind: "request" | "s
  */
 function oauthServesModel(provider: AuthProvider, model: string): boolean {
   if (provider === "openai") {
-    // Provider-qualified ids (`openai/gpt-5.5`) are valid route targets — the
-    // adapters strip the prefix on the wire, so servability must match.
-    const wire = model.startsWith("openai/") ? model.slice(7) : model;
-    return CODEX_MODELS.includes(wire);
+    // `isCodexModel` checks the maintained CODEX_MODELS list PLUS any id observed
+    // live this session (model-catalog.ts) — closes the "picker shows a model the
+    // account's own endpoint just confirmed, call-time gate rejects it anyway" drift
+    // window that opens every time OpenAI ships a new Codex model between releases.
+    return isCodexModel(model);
   }
   if (provider === "kimi") {
     const wire = model.startsWith("kimi/") ? model.slice(5) : model;
@@ -487,7 +488,7 @@ export async function resolveCall(options: Partial<CallOptions>, kind: "request"
   const isLocalOpenAi = provider === "openai" && !!baseUrl;
   if (provider === "openai" && effective.kind === "oauth" && !isLocalOpenAi && !oauthServesModel("openai", model)) {
     throw new Error(
-      "OpenAI OAuth 자격증명은 Codex 모델(gpt-5.5/gpt-5.4)만 지원. OPENAI_API_KEY를 설정하거나 모델을 변경하세요"
+      `OpenAI OAuth 자격증명은 Codex 모델(${CODEX_MODELS.join("/")})만 지원. OPENAI_API_KEY를 설정하거나 모델을 변경하세요`
     );
   }
   if (provider === "kimi" && effective.kind === "oauth" && !oauthServesModel("kimi", model)) {

package/src/ai/providers/antigravity.ts

@@ -2,10 +2,10 @@ import { randomUUID } from "node:crypto";
 import type { Credential } from "../../auth";
 import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readSse } from "../sse";
-import { providerHttpError } from "./errors";
+import { providerHttpError, ProviderStreamError } from "./errors";
 import { serializeToolCalls } from "../../agent/tool-schemas";
 import { sanitizeJsonStrings } from "../../util/sanitize-json";
-import { geminiThinkingConfig, getGeminiCliHeaders, type GeminiThinkingConfig } from "./gemini";
+import { geminiThinkingConfig, type GeminiThinkingConfig } from "./gemini";
 
 const ANTIGRAVITY_DAILY_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
 const ANTIGRAVITY_SANDBOX_ENDPOINT = "https://daily-cloudcode-pa.sandbox.googleapis.com";
@@ -95,11 +95,31 @@ export async function resolveAntigravityProjectId(
 
   const discover = opts.discover ?? (async (token: string) => {
     const { discoverGoogleProjectId, ANTIGRAVITY_DISCOVERY_METADATA } = await import("../../auth/flows/google-project");
-    // Antigravity-client tokens discover with ANTIGRAVITY metadata; gemini-cli
-    // tokens use the default gemini-cli metadata shape.
-    return discoverGoogleProjectId(token, credential.provider === "antigravity"
-      ? { metadata: { ...ANTIGRAVITY_DISCOVERY_METADATA }, extraHeaders: { "User-Agent": getAntigravityUserAgent() }, alwaysOnboard: true, signal: opts.signal }
-      : { extraHeaders: getGeminiCliHeaders(), signal: opts.signal });
+    // This function's SOLE callers are fetchAntigravity/ccaTurn — every discovery
+    // it performs exists to serve an Antigravity/Cloud-Code-Assist turn, so it must
+    // ALWAYS identify itself to Google as Antigravity (metadata + User-Agent),
+    // regardless of which OAuth STORAGE SLOT the token came from (a dedicated
+    // antigravity login vs a plain gemini-cli token used as fallback — the common
+    // case for users who only ran `jeo auth login gemini`, the documented default).
+    // Previously this branched on `credential.provider === "antigravity"` and sent
+    // gemini-cli identity (User-Agent `GeminiCLI/…`, metadata `pluginType: GEMINI`)
+    // for the fallback case. Root-caused live: Google's `loadCodeAssist` now REJECTS
+    // that identity for gemini-cli-individual accounts it has migrated to Antigravity
+    // (`ineligibleTiers[].reasonCode: "UNSUPPORTED_CLIENT"`, message "please migrate
+    // to the Antigravity suite of products") — the response omits `currentTier`/
+    // `cloudaicompanionProject` entirely, so discovery falls through into onboarding,
+    // which then fails after 5 polls with "did not return a provisioned project id"
+    // even though the SAME account resolves its EXISTING project instantly (0 polls)
+    // once the request honestly identifies as Antigravity. This was the actual
+    // observed "stops/hangs on Antigravity Gemini" symptom for any account without a
+    // dedicated antigravity OAuth login: a deterministic, fast-failing (not literally
+    // infinite) but 100%-reproducible discovery break, not a timeout/network hang.
+    return discoverGoogleProjectId(token, {
+      metadata: { ...ANTIGRAVITY_DISCOVERY_METADATA },
+      extraHeaders: { "User-Agent": getAntigravityUserAgent() },
+      alwaysOnboard: true,
+      signal: opts.signal,
+    });
   });
   let projectId: string;
   try {
@@ -232,6 +252,17 @@ interface CcaChunk {
     candidates?: { content?: { parts?: { text?: string; thought?: boolean; functionCall?: { name?: string; args?: Record<string, unknown> } }[] }; finishReason?: string }[];
     usageMetadata?: CcaUsage;
   };
+  /** A `google.rpc.Status`-shaped in-band error line, sibling of `response` — see
+   *  `gemini.ts`'s identical field for the full rationale (silently swallowed here
+   *  before this fix, which for a turn that had already streamed some text meant an
+   *  early, error-free, TRUNCATED stop: "안티그라비티 모델이 중간에 멈추는" report). */
+  error?: { code?: number; message?: string; status?: string };
+}
+/** Throw a {@link ProviderStreamError} for an in-band error line — no-op when absent. */
+function throwIfGoogleStreamError(chunk: CcaChunk): void {
+  const err = chunk.error;
+  if (!err) return;
+  throw new ProviderStreamError("Antigravity", err.message ?? "unknown error", err.status, err.code);
 }
 /** When Antigravity (Cloud Code Assist) returns HTTP 200 with no text, surface the
  *  real cause (safety block / RECITATION / etc.) instead of a silent, reason-free
@@ -293,6 +324,7 @@ export const antigravityAdapter: ProviderAdapter = {
     for await (const data of readSse(response.body)) {
       let chunk: CcaChunk;
       try { chunk = JSON.parse(data); } catch { continue; }
+      throwIfGoogleStreamError(chunk);
       const thought = thoughtOf(chunk);
       if (thought) options.onReasoning?.(thought);
       const delta = textOf(chunk);
@@ -321,6 +353,7 @@ export const antigravityAdapter: ProviderAdapter = {
     for await (const data of readSse(response.body, options.onStreamActivity)) {
       let chunk: CcaChunk;
       try { chunk = JSON.parse(data); } catch { continue; }
+      throwIfGoogleStreamError(chunk);
       const thought = thoughtOf(chunk);
       if (thought) options.onReasoning?.(thought);
       const delta = textOf(chunk);

package/src/ai/providers/errors.ts

@@ -39,10 +39,14 @@ export class ProviderStreamError extends Error {
   readonly status: number;
   readonly provider: string;
   readonly code?: string;
-  constructor(provider: string, message: string, code?: string) {
+  /** `explicitStatus` lets a caller pass an ALREADY-numeric provider status (e.g. Google's
+   *  `error.code` on a `google.rpc.Status` envelope — 429/500/503) instead of relying on the
+   *  OpenAI-specific `code === "rate_limit_exceeded"` string heuristic below, which only
+   *  recognizes that one literal and defaults everything else to 500. */
+  constructor(provider: string, message: string, code?: string, explicitStatus?: number) {
     super(`${provider} stream failed${code ? ` (${code})` : ""}: ${message}`);
     this.name = "ProviderStreamError";
-    this.status = code === "rate_limit_exceeded" ? 429 : 500;
+    this.status = explicitStatus ?? (code === "rate_limit_exceeded" ? 429 : 500);
     this.provider = provider;
     this.code = code;
   }

package/src/ai/providers/gemini.ts

@@ -1,7 +1,7 @@
 import type { Credential } from "../../auth";
 import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readSse } from "../sse";
-import { providerHttpError, fetchWithArtifactFailSafe } from "./errors";
+import { providerHttpError, fetchWithArtifactFailSafe, ProviderStreamError } from "./errors";
 import { jeoEnv } from "../../util/env";
 import { serializeToolCalls } from "../../agent/tool-schemas";
 import { sanitizeJsonStrings } from "../../util/sanitize-json";
@@ -258,11 +258,22 @@ interface GeminiChunk {
   candidates?: { content?: { parts?: { text?: string; thought?: boolean; thoughtSignature?: string; functionCall?: { name?: string; args?: Record<string, unknown> } }[] }; finishReason?: string }[];
   promptFeedback?: { blockReason?: string };
   usageMetadata?: { promptTokenCount?: number; candidatesTokenCount?: number; thoughtsTokenCount?: number };
+  /** A `google.rpc.Status`-shaped in-band error line: Google's streaming endpoints can emit
+   *  this as its own SSE `data:` event on an otherwise-live 200 connection (the codebase
+   *  already knows this envelope shape from `parseRetryFromBody`'s `"retryDelay"` parsing on
+   *  the equivalent non-stream error body) instead of terminating the HTTP response with a
+   *  non-2xx status. Previously silently ignored — neither `candidates` nor `promptFeedback`
+   *  matches it, so it fell through every existing check with no error and no text, which for
+   *  a turn that had already streamed SOME text meant the turn just ended early with a
+   *  truncated reply and no error at all: the "모델이 중간에 멈추는" (model stops mid-way) report. */
+  error?: { code?: number; message?: string; status?: string };
 }
 
-/** Cloud Code Assist wraps each standard chunk under `response`. */
+/** Cloud Code Assist wraps each standard chunk under `response`; an in-band error (see
+ *  `GeminiChunk.error`) arrives as a SIBLING of `response`, not nested inside it. */
 interface CcaChunk {
   response?: GeminiChunk;
+  error?: { code?: number; message?: string; status?: string };
 }
 
 function textOf(chunk: GeminiChunk): string {
@@ -317,6 +328,20 @@ function blockedReason(chunk: GeminiChunk): string | undefined {
   return undefined;
 }
 
+/** Throw a {@link ProviderStreamError} for an in-band `google.rpc.Status` error line (see
+ *  `GeminiChunk.error`/`CcaChunk.error`) — a no-op when the chunk carries none. Mirrors the
+ *  OpenAI Responses `response.failed`/`error` fix: `error.status` (a string enum, e.g.
+ *  `"RESOURCE_EXHAUSTED"`/`"UNAVAILABLE"`/`"INTERNAL"`) plays the same "classifier" role our
+ *  `code` param plays for OpenAI, and `error.code` (Google's own numeric HTTP-equivalent) is
+ *  passed straight through as the explicit status instead of re-derived from a string match. */
+function throwIfGoogleStreamError(
+  provider: string,
+  err: { code?: number; message?: string; status?: string } | undefined,
+): void {
+  if (!err) return;
+  throw new ProviderStreamError(provider, err.message ?? "unknown error", err.status, err.code);
+}
+
 /**
  * Cloud Code Assist SSE turn for a Google OAuth credential: resolves the
  * projectId (stored → env → lazy loadCodeAssist/onboardUser discovery), POSTs
@@ -343,6 +368,7 @@ async function* ccaTurn(messages: Message[], options: CallOptions, credential: C
     } catch {
       continue;
     }
+    throwIfGoogleStreamError("Gemini (Cloud Code Assist)", chunk.error);
     const inner = chunk.response;
     if (!inner) continue;
     const thought = thoughtOf(inner);
@@ -419,6 +445,7 @@ export const geminiAdapter: ProviderAdapter = {
       } catch {
         continue;
       }
+      throwIfGoogleStreamError("Gemini", chunk.error);
       const thought = thoughtOf(chunk);
       if (thought) options.onReasoning?.(thought);
       captureGeminiSignatures(chunk, options, seenSigs);

package/src/commands/launch/model-slash.ts

@@ -21,6 +21,7 @@ import {
   resolveSelection,
   catalogMetadata,
   CODEX_MODELS,
+  isCodexModel,
   qualifyModelId,
 } from "../../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ThinkLevel } from "../../ai";
@@ -287,7 +288,10 @@ export async function runModelSlash(input: string, ctx: ModelSlashCtx): Promise<
   if (st && !st.ready) console.log(`  ! ${provider} is not ready (${st.label}) — set ${st.envVar ?? "the provider key"} or run 'jeo setup'.`);
   // ChatGPT OAuth only serves the Codex models; warn before the turn fails if the user
   // pins a non-Codex id with no local base URL to fall back to (gjc-parity readiness guard).
-  if (arg && provider === "openai" && st?.kind === "oauth" && !CODEX_MODELS.includes(resolved)) {
+  // `isCodexModel` also accepts any id this session's OWN live discovery already
+  // confirmed (see model-catalog.ts) — a static-list-only check here would falsely
+  // warn about a model /model's own live picker just showed as valid.
+  if (arg && provider === "openai" && st?.kind === "oauth" && !isCodexModel(resolved)) {
     const hasLocalBase = !!((await readGlobalConfig()).openaiBaseUrl || process.env.OPENAI_BASE_URL);
     if (!hasLocalBase) {
       console.log(`  ! ChatGPT OAuth serves only Codex models (${CODEX_MODELS.join(", ")}); '${resolved}' will be rejected at runtime — pick one of those, or set OPENAI_API_KEY / OPENAI_BASE_URL.`);

package/src/skills/catalog.ts

@@ -188,6 +188,7 @@ export function skillsPromptSection(skills: SkillDoc[] = SKILLS): string {
 }
 
 import * as fs from "node:fs/promises";
+import type { Dirent } from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 
@@ -411,6 +412,54 @@ function isSupportedExternalSkill(doc: SkillDoc): boolean {
   return !RESERVED_SKILL_NAMES.has(nameLower);
 }
 
+/** Resolve ONE directory entry from {@link skillDirs} to its `SkillDoc`, or `null`
+ *  when the entry is not a skill (dotfile, non-`.md` file, directory with no
+ *  `SKILL.md`, unreadable/broken symlink). Pure I/O + parse — no shared-state
+ *  writes — so callers can run many of these concurrently. */
+async function resolveSkillEntry(dir: string, entry: Dirent): Promise<SkillDoc | null> {
+  if (entry.name.startsWith(".")) return null;
+  let isFile = entry.isFile();
+  let isDir = entry.isDirectory();
+  // Vercel `npx skills add` links agent dirs (.claude/skills/x) to its canonical
+  // store — a symlinked skill reports NEITHER isFile nor isDirectory on the
+  // Dirent, which silently dropped every linked skill. Follow the link.
+  if (entry.isSymbolicLink()) {
+    try {
+      const st = await fs.stat(path.join(dir, entry.name));
+      isFile = st.isFile();
+      isDir = st.isDirectory();
+    } catch { return null; /* broken symlink */ }
+  }
+  if (isFile && entry.name.endsWith(".md")) {
+    const nm = entry.name.slice(0, -3);
+    const filePath = path.join(dir, entry.name);
+    try {
+      const parsed = parseSkillMarkdown(nm, await fs.readFile(filePath, "utf-8"), { preferMetaName: true });
+      parsed.sourcePath = filePath;
+      return isSupportedExternalSkill(parsed) ? parsed : null;
+    } catch { return null; /* unreadable file */ }
+  }
+  if (isDir) {
+    const skillPath = path.join(dir, entry.name, "SKILL.md");
+    try {
+      const parsed = parseSkillMarkdown(entry.name, await fs.readFile(skillPath, "utf-8"), { preferMetaName: true });
+      parsed.sourcePath = skillPath;
+      return isSupportedExternalSkill(parsed) ? parsed : null;
+    } catch { return null; /* dir without SKILL.md, or unreadable */ }
+  }
+  return null;
+}
+
+/** Concurrency cap for {@link resolveSkillEntry} within one directory: high enough
+ *  that a large skill directory (hundreds of entries — a real field case: `npx skills
+ *  add`-style installs commonly accumulate 500+) resolves in one or two batches
+ *  instead of paying per-file `fs` round-trip latency SEQUENTIALLY (534 entries at
+ *  ~0.4ms/syscall was a measured ~220ms — a visible stall on every session start and
+ *  every `/skill` listing), while staying well under the lowest realistic per-process
+ *  file-descriptor ulimit (macOS defaults to 256) even with several directories'
+ *  batches racing across the `skillDirs` loop below. */
+const SKILL_ENTRY_LOAD_BATCH = 32;
+
 /** Bundled skills merged with user skill docs from {@link skillDirs} (user overrides by name). */
 export async function loadSkills(cwd: string = process.cwd()): Promise<SkillDoc[]> {
   try {
@@ -424,39 +473,20 @@ export async function loadSkills(cwd: string = process.cwd()): Promise<SkillDoc[
     }
   } catch {}
   const byName = new Map<string, SkillDoc>(SKILLS.map(s => [s.name.toLowerCase(), s]));
+  // Directories are walked in their documented lowest→highest precedence order
+  // (a later dir's skill overrides an earlier one with the same name) — that
+  // cross-directory override MUST stay sequential. Entries WITHIN one directory
+  // have no such contract (readdir order is not a precedence guarantee anyone
+  // depends on), so they resolve concurrently in bounded batches, then apply to
+  // `byName` in their original readdir order for a fully deterministic result.
   for (const dir of skillDirs(cwd)) {
-    let entries: import("node:fs").Dirent[] = [];
+    let entries: Dirent[] = [];
     try { entries = await fs.readdir(dir, { withFileTypes: true }); } catch { continue; }
-    for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
-      let isFile = entry.isFile();
-      let isDir = entry.isDirectory();
-      // Vercel `npx skills add` links agent dirs (.claude/skills/x) to its canonical
-      // store — a symlinked skill reports NEITHER isFile nor isDirectory on the
-      // Dirent, which silently dropped every linked skill. Follow the link.
-      if (entry.isSymbolicLink()) {
-        try {
-          const st = await fs.stat(path.join(dir, entry.name));
-          isFile = st.isFile();
-          isDir = st.isDirectory();
-        } catch { continue; /* broken symlink */ }
-      }
-      if (isFile && entry.name.endsWith(".md")) {
-        const nm = entry.name.slice(0, -3);
-        try {
-          const parsed = parseSkillMarkdown(nm, await fs.readFile(path.join(dir, entry.name), "utf-8"), { preferMetaName: true });
-          parsed.sourcePath = path.join(dir, entry.name);
-          if (isSupportedExternalSkill(parsed)) byName.set(parsed.name.toLowerCase(), parsed);
-        } catch { /* skip unreadable file */ }
-        continue;
-      }
-      if (isDir) {
-        const skillPath = path.join(dir, entry.name, "SKILL.md");
-        try {
-          const parsed = parseSkillMarkdown(entry.name, await fs.readFile(skillPath, "utf-8"), { preferMetaName: true });
-          parsed.sourcePath = skillPath;
-          if (isSupportedExternalSkill(parsed)) byName.set(parsed.name.toLowerCase(), parsed);
-        } catch { /* skip dirs without SKILL.md or unreadable files */ }
+    for (let i = 0; i < entries.length; i += SKILL_ENTRY_LOAD_BATCH) {
+      const batch = entries.slice(i, i + SKILL_ENTRY_LOAD_BATCH);
+      const resolved = await Promise.all(batch.map(entry => resolveSkillEntry(dir, entry)));
+      for (const parsed of resolved) {
+        if (parsed) byName.set(parsed.name.toLowerCase(), parsed);
       }
     }
   }