jeo-code 0.8.12 → 0.8.13

package/CHANGELOG.md

@@ -6,6 +6,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.13] - 2026-07-09
+_"테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used._
+
+### Fixed
+- **Routing vetoes now prefer equivalent credentialed tier models** (`src/commands/launch.ts`) — credential-missing, OAuth-not-servable, and local-provider-unreachable vetoes now scan `tierModelPool()` for the same prompt tier, exclude the rejected target, validate provider readiness, model servability, image support, and local-provider reachability, then switch to a session-stable equivalent before falling back to the session/default model. A misconfigured `roles.smol: "gpt-4o-mini"` with only Anthropic credentials now routes to `claude-haiku-4-5` instead of either failing on OpenAI or wasting a Sonnet turn.
+- **`/route why` now explains equivalent fallback decisions** (`src/commands/launch.ts`) — when a veto switches to an alternate model, the route decision keeps the actual model used and carries a warning that names the rejected model, the reason, and the equivalent replacement.
+
+### Added
+- **Equivalent-fallback regression coverage** (`test/launch-prompt-routing.test.ts`) — updated the credential, OpenAI OAuth servability, and local-provider reachability veto tests to assert the equivalent model path, `warnOnce` behavior, and `/route why` explanation.
+
+### Verified
+- Focused routing suite: `bun test test/launch-prompt-routing.test.ts` — 23 pass / 0 fail.
+
 ## [0.8.12] - 2026-07-08
 _"제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time._
 

package/README.ja.md

@@ -262,11 +262,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
-- **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -263,11 +263,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
-- **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -38,7 +38,7 @@ Run `jeo` inside a repository and it reads files, edits them, runs commands, and
 
 ## Highlights
 
-- **Multi-provider, one loop** — Anthropic / OpenAI (+Codex) / Gemini / Antigravity / Ollama / LM Studio, plus 20+ OpenAI- and Anthropic-compatible clouds (Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai, …), all behind one uniform JSON tool loop. OAuth login happens from the input box (`/provider login`), every model pick persists as the new default, and prompt routing only auto-selects usable credentialed paths: Gemini OAuth goes through the provider-qualified `antigravity/*` agent set (Gemini 3.5 Flash tiers, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6), never public `google/gemini-*` rows that require `GEMINI_API_KEY`.
+- **Multi-provider, one loop** — Anthropic / OpenAI (+Codex) / Gemini / Antigravity / Ollama / LM Studio, plus 20+ OpenAI- and Anthropic-compatible clouds (Groq, DeepSeek, Mistral, OpenRouter, xAI, Kimi, z.ai, …), all behind one uniform JSON tool loop. OAuth login happens from the input box (`/provider login`), every model pick persists as the new default, and prompt routing only auto-selects usable credentialed paths: Gemini OAuth goes through the provider-qualified `antigravity/*` agent set (Gemini 3.5 Flash tiers, Gemini 3.1 Pro, Claude Sonnet/Opus 4.6), never public `google/gemini-*` rows that require `GEMINI_API_KEY`; if a configured route points at an unready provider, jeo switches to an equivalent credentialed tier model before falling back to the default.
 - **Edit integrity** — read output carries content anchors (`42ab|`); anchored edits are verified against the current file, re-mapped when lines shifted, and rejected with fresh content instead of corrupting.
 - **Self-correcting verification loop** — configure a post-edit hook (tsc / eslint / tests) and the agent *sees* the diagnostics and fixes them in-loop; a red hook blocks `done` until resolved.
 - **Real gates, no theater** — `ralplan` consensus is a repo-grounded critic subagent whose `[OKAY]` verdict is persisted and *required* by `jeo approve`; `ultragoal` reports honestly (a suite run is a global signal, never fabricated per-criterion passes).
@@ -80,7 +80,7 @@ Inside the `jeo` REPL (Tab autocompletes; `/` opens the palette).
 | `/provider login <name>` · `/logout` | OAuth login/logout from the input box |
 | `/agents [role]` · `/subagent` | Per-role (executor/planner/architect/critic) model · thinking · step config |
 | `/thinking [level]` | Show/set default reasoning budget (low…xhigh) |
-| `/route [status\|on\|off\|why]` | Toggle prompt-based model routing for this session · explain the last routing decision (auto-routes each turn to a tier-appropriate model among the models your configured credentials — OAuth or API key — actually serve) |
+| `/route [status\|on\|off\|why]` | Toggle prompt-based model routing for this session · explain the last routing decision (auto-routes each turn to a tier-appropriate model among the models your configured credentials — OAuth or API key — actually serve, and switches to an equivalent tier model when a configured route is unready) |
 | `/fast [on\|off\|status]` | Toggle fast thinking mode when the active model advertises low reasoning |
 | `/skill` · `$<skill> [intent]` | List/run workflow skills (`$team "task"` style) |
 | `/view` · `/diff` · `/find` · `/search` | Code view, git diff, file/pattern search |
@@ -265,11 +265,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
-- **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -262,11 +262,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
 - **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
 - **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
-- **[0.8.8]** (2026-07-08) — "실동작검증을 통해서 유효성 평가하고 개선해줘" — live-verified the v0.8.5 fallback mechanism using active Claude Code OAuth credentials on this machine (confirmed 200 OK for both Fable 5 and Opus 4.8 via the proxy). Identified two critical improvement vectors during verification: (1) server-side fallback was previously scoped strictly to API-key credentials, leaving OAuth users (who also hit `reasoning_extraction` refusals) with today's reactive-only recovery; (2) the sequential `postAnthropic` retry ladder could throw immediately on a combination of different error types (e.g. temperature error first, then fallback error, then success).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/engine.ts

@@ -10,7 +10,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { Message } from "./loop";
-import { extractJsonObject } from "./json";
+import { extractJsonObjectWithSpan, tryExtractJsonObject } from "./json";
 import { nativeToolSchemasFor, normalizeNativeToolName } from "./tool-schemas";
 import { readTool, writeTool, editTool, bashTool, findTool, searchTool, lsTool, mkdirTool, deleteTool, bisectTool, type ToolResult } from "./tools";
 import { webSearchTool, setWebSearchActiveModel } from "./web-search";
@@ -469,7 +469,14 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           { jsonMode: false, model: opts.model, maxTokens: opts.maxTokens, signal: opts.signal, sessionKey: opts.sessionKey },
         );
         const consolidated = wrapUp.trim();
-        if (consolidated) {
+        // Defensive: the wrap-up call explicitly forbids tool/JSON output, but a
+        // degenerate model under a long, polluted turn can still emit tool-call-shaped
+        // JSON here. Never surface that raw to the user as if it were the answer —
+        // fall through to the plain stop message instead (same as an empty wrap-up).
+        const looksLikeToolCall = tryExtractJsonObject<any>(consolidated, { preferKeys: ["tool", "tools"] });
+        const isToolCallShaped = looksLikeToolCall && typeof looksLikeToolCall === "object" &&
+          (typeof looksLikeToolCall.tool === "string" || Array.isArray(looksLikeToolCall.tools));
+        if (consolidated && !isToolCallShaped) {
           pushAssistantTurn(history, consolidated, "", []);
           return finish({
             done: false,
@@ -671,10 +678,12 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       responseText = await invokeCallLlm(history, {
               jsonMode: true,
               // NATIVE tool-calling: declare the ACTIVE toolset (read-only subagents
-              // expose only their non-mutating tools). Capable adapters (anthropic …)
-              // use these and re-serialize the structured call to canonical JSON; the
-              // antigravity/ollama fallback ignores them. Only on the main step — never
-              // the prose wrap-up call below.
+              // expose only their non-mutating tools). NATIVE-capable adapters
+              // (anthropic, gemini, antigravity — see supportsNativeTools) send these
+              // on the wire and re-serialize the structured call to canonical JSON;
+              // ollama (no native tool support) ignores them and relies solely on the
+              // JSON-in-prose protocol above. Only on the main step — never the prose
+              // wrap-up call below.
               tools: turnToolSchemas,
               model: opts.model,
               maxTokens: opts.maxTokens,
@@ -857,7 +866,14 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
 
     let invocation: any;
     try {
-      invocation = extractJsonObject<any>(responseText, { preferKeys: ["tool", "tools"] });
+      const extracted = extractJsonObjectWithSpan<any>(responseText, { preferKeys: ["tool", "tools"] });
+      invocation = extracted.value;
+      // Trim to ONLY the matched JSON — a degenerate model that appends
+      // garbled/repeated text after a valid tool call must not have that
+      // garbage (a) shown to the user as this turn's assistant record, or
+      // (b) echoed back into its own history on the next call, where it
+      // would reinforce the corruption instead of self-correcting.
+      responseText = extracted.matched;
     } catch (err) {
       ev.onAssistant?.(responseText, null);
       // Prose salvage: a reply with no JSON object at all is a chat-style final

package/src/agent/json.ts

@@ -15,26 +15,38 @@ export function extractJsonObject<T = unknown>(
   text: string,
   opts?: { preferKeys?: string[] },
 ): T {
+  return extractJsonObjectWithSpan<T>(text, opts).value;
+}
+
+/**
+ * Like {@link extractJsonObject}, but also reports the exact substring of `text`
+ * that was matched (verbatim, pre-repair) — the object itself, with none of the
+ * surrounding prose/fences/trailing commentary. Callers that persist the model's
+ * reply (e.g. into conversation history) use this to store ONLY the valid JSON:
+ * a degenerate model that appends garbled/repeated text after a valid tool call
+ * must not have that garbage echoed back into its own context on the next turn,
+ * where it would reinforce the corruption instead of self-correcting.
+ */
+export function extractJsonObjectWithSpan<T = unknown>(
+  text: string,
+  opts?: { preferKeys?: string[] },
+): { value: T; matched: string } {
   const raw = text.trim();
   const preferKeys = opts?.preferKeys;
 
   // Fast path: already pure JSON (optionally with a trailing comma to repair).
   const fast = tryParse<T>(raw);
-  if (fast !== undefined) return fast;
+  if (fast !== undefined) return { value: fast, matched: raw };
 
   // Strip common code fences and retry (pure, then trailing-comma-repaired).
   const defenced = raw.replace(/```(?:json|JSON)?/g, "").trim();
   const fromDefencedWhole = tryParse<T>(defenced);
-  if (fromDefencedWhole !== undefined) return fromDefencedWhole;
+  if (fromDefencedWhole !== undefined) return { value: fromDefencedWhole, matched: defenced };
 
-  const parsedFromDefenced = findAndParseBalancedObject<T>(defenced, preferKeys);
-  if (parsedFromDefenced !== undefined) {
-    return parsedFromDefenced;
-  }
-  const parsedFromRaw = findAndParseBalancedObject<T>(raw, preferKeys);
-  if (parsedFromRaw !== undefined) {
-    return parsedFromRaw;
-  }
+  const fromDefenced = findAndParseBalancedObject<T>(defenced, preferKeys);
+  if (fromDefenced !== undefined) return fromDefenced;
+  const fromRaw = findAndParseBalancedObject<T>(raw, preferKeys);
+  if (fromRaw !== undefined) return fromRaw;
   throw new Error(`No parseable JSON object found in model output: ${truncate(raw, 200)}`);
 }
 
@@ -204,29 +216,33 @@ function extractBalancedObject(text: string, startIndex: number): string | null
  * after a stray JSON-looking object in reasoning prose); fall back to the first
  * parseable object when none carries a preferred key.
  */
-function findAndParseBalancedObject<T>(text: string, preferKeys?: string[]): T | undefined {
-  let firstParsed: T | undefined;
+function findAndParseBalancedObject<T>(
+  text: string,
+  preferKeys?: string[],
+): { value: T; matched: string } | undefined {
+  let first: { value: T; matched: string } | undefined;
   for (let i = 0; i < text.length; i++) {
     if (text[i] === "{") {
       const candidate = extractBalancedObject(text, i);
       if (candidate) {
         const parsed = tryParse<T>(candidate);
         if (parsed !== undefined) {
-          if (firstParsed === undefined) firstParsed = parsed;
-          if (!preferKeys || preferKeys.length === 0) return parsed;
+          const found = { value: parsed, matched: candidate };
+          if (first === undefined) first = found;
+          if (!preferKeys || preferKeys.length === 0) return found;
           if (
             parsed !== null &&
             typeof parsed === "object" &&
             preferKeys.some(k => k in (parsed as Record<string, unknown>))
           ) {
-            return parsed;
+            return found;
           }
           // else: keep scanning for an object that carries a preferred key
         }
       }
     }
   }
-  return firstParsed;
+  return first;
 }
 
 function truncate(s: string, n: number): string {

package/src/commands/launch.ts

@@ -48,7 +48,8 @@ import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recen
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal } from "../agent/goal-verifier";
-import { routePrompt, deriveCacheSessionKey, warnOnce, type RouteDecision } from "../agent/prompt-router";
+import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, type RouteDecision } from "../agent/prompt-router";
+import { isRateLimitError, isUsageLimitError } from "../util/retry";
 
 import { listAliases } from "../ai/model-registry";
 import { openaiCompatDef, SUBSCRIPTION_PROVIDER_NAMES } from "../ai/providers/openai-compatible-catalog";
@@ -882,6 +883,42 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // that write silently switch THIS running session's model mid-run. Per-session model
     // selection must stay session-local: running sessions never influence each other.
     const routingEnabled = sessionRouteOverride ?? !!turnConfig.routing?.enabled;
+    let routeCredentialNotice: string | undefined;
+    let routeVetoNote: string | undefined;
+    const equivalentRouteFallback = async (decision: RouteDecision, reason: string, exclude: readonly string[] = []): Promise<string | null> => {
+      const excluded = new Set([decision.model, ...exclude]);
+      const candidates = tierModelPool(decision.tier, turnConfig)
+        .filter(model => !excluded.has(model))
+        .filter(model => !images?.length || catalogMetadata(model)?.images !== false);
+      if (candidates.length === 0) return null;
+      const selected = selectFromPool(candidates, sessionId ? `${sessionId}:fallback:${decision.model}:${reason}` : undefined);
+      const start = Math.max(0, candidates.indexOf(selected));
+      const ordered = [...candidates.slice(start), ...candidates.slice(0, start)];
+      for (const candidate of ordered) {
+        const { resolved, provider } = await describeModel(candidate, turnConfig);
+        const status = await describeProvider(provider, turnConfig);
+        if (!status.ready || !modelServableWithConfig(provider, resolved, turnConfig)) continue;
+        if (provider === "ollama" || provider === "lmstudio") {
+          const localBaseUrl = provider === "ollama"
+            ? (turnConfig.ollamaBaseUrl ?? "http://localhost:11434")
+            : (turnConfig.lmstudioBaseUrl ?? "http://localhost:1234/v1");
+          if (!await isLocalProviderReachable(provider, localBaseUrl)) continue;
+        }
+        return candidate;
+      }
+      return null;
+    };
+    const fallbackDecision = async (decision: RouteDecision, reason: string, noticeKey: string, notice: string): Promise<RouteDecision | null> => {
+      const fallback = await equivalentRouteFallback(decision, reason);
+      if (!fallback) {
+        routeVetoNote = `routed model '${decision.model}' ${reason} — fell back to '${sessionModel || defaultModel}'`;
+        routeCredentialNotice = warnOnce(noticeKey, notice);
+        return null;
+      }
+      routeVetoNote = `routed model '${decision.model}' ${reason} — switched to equivalent '${fallback}'`;
+      routeCredentialNotice = warnOnce(noticeKey, `${notice} Switching to equivalent '${fallback}' for this turn.`);
+      return { ...decision, model: fallback, warning: decision.warning ? `${decision.warning}; ${routeVetoNote}` : routeVetoNote };
+    };
     let routed = routingEnabled && !sessionModel
       ? await routePrompt(userInput, turnConfig, { hasImages: !!images?.length, sessionId }).catch(() => null)
       : null;
@@ -900,8 +937,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // the top of prompt-router.ts. Nulling `routed` here (rather than patching its
     // `.model`) lets the EXISTING `activeModel`/`lastRouteDecision` fallback lines
     // below handle the rest unchanged.
-    let routeCredentialNotice: string | undefined;
-    let routeVetoNote: string | undefined;
     if (routed) {
       // describeModel expands aliases (e.g. a hand-written `roles.high: "gpt"`)
       // exactly like the real call path, so the servability check below judges
@@ -909,23 +944,23 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       const { resolved: routedResolved, provider: routedProvider } = await describeModel(routed.model, turnConfig);
       const status = await describeProvider(routedProvider, turnConfig);
       if (!status.ready) {
-        routeVetoNote = `routed model '${routed.model}' (${routedProvider}) has no usable credential this turn — fell back to '${sessionModel || defaultModel}'`;
-        routeCredentialNotice = warnOnce(
+        routed = await fallbackDecision(
+          routed,
+          `(${routedProvider}) has no usable credential this turn`,
           `prompt-router:provider-not-ready:${routedProvider}`,
-          `[route] routed to '${routed.model}' (${routedProvider}) but that provider has no usable credential — falling back to the default model this turn. Run 'jeo auth login ${routedProvider}' or reconfigure routing.tiers/roles for a provider you're logged into.`,
+          `[route] routed to '${routed.model}' (${routedProvider}) but that provider has no usable credential. Run 'jeo auth login ${routedProvider}' or reconfigure routing.tiers/roles for a provider you're logged into.`,
         );
-        routed = null;
       } else if (!modelServableWithConfig(routedProvider, routedResolved, turnConfig)) {
         // Provider readiness is necessary but not sufficient: an OAuth login only
         // serves specific models (auth matrix on modelServableWithConfig). Only
         // user-pinned routing.tiers/roles models can hit this branch —
         // auto-selected models already passed the same predicate.
-        routeVetoNote = `routed model '${routed.model}' (${routedProvider}) is not servable by the stored ${routedProvider} credential this turn — fell back to '${sessionModel || defaultModel}'`;
-        routeCredentialNotice = warnOnce(
+        routed = await fallbackDecision(
+          routed,
+          `(${routedProvider}) is not servable by the stored ${routedProvider} credential this turn`,
           `prompt-router:model-not-servable:${routed.model}`,
-          `[route] routed to '${routed.model}' but the stored ${routedProvider} OAuth login cannot serve that model — falling back to the default model this turn. Set ${routedProvider.toUpperCase()}_API_KEY or reconfigure routing.tiers/roles to a model your login serves.`,
+          `[route] routed to '${routed.model}' but the stored ${routedProvider} OAuth login cannot serve that model. Set ${routedProvider.toUpperCase()}_API_KEY or reconfigure routing.tiers/roles to a model your login serves.`,
         );
-        routed = null;
       } else if (routedProvider === "ollama" || routedProvider === "lmstudio") {
         // Live reachability gate for LOCAL providers only: `describeProvider` reports
         // ollama/lmstudio as `ready: true` unconditionally (keyless just means "no
@@ -945,19 +980,19 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           : (turnConfig.lmstudioBaseUrl ?? "http://localhost:1234/v1");
         const reachable = await isLocalProviderReachable(routedProvider, localBaseUrl);
         if (!reachable) {
-          routeVetoNote = `routed model '${routed.model}' (${routedProvider}) is unreachable at ${localBaseUrl} this turn — fell back to '${sessionModel || defaultModel}'`;
-          routeCredentialNotice = warnOnce(
+          routed = await fallbackDecision(
+            routed,
+            `(${routedProvider}) is unreachable at ${localBaseUrl} this turn`,
             `prompt-router:provider-unreachable:${routedProvider}`,
-            `[route] routed to '${routed.model}' (${routedProvider}) but ${localBaseUrl} is unreachable — falling back to the default model this turn. Start the ${routedProvider} server, or reconfigure routing.tiers/roles for a provider that is running.`,
+            `[route] routed to '${routed.model}' (${routedProvider}) but ${localBaseUrl} is unreachable. Start the ${routedProvider} server, or reconfigure routing.tiers/roles for a provider that is running.`,
           );
-          routed = null;
         }
       }
     }
     lastRouteDecision = routed ?? (routeVetoNote ? { note: routeVetoNote } : routingEnabled && !sessionModel ? { note: "routing produced no decision (fail-open)" } : { note: "routing not active this turn" });
     // Explicit /model always wins: `routed` is only ever computed when `!sessionModel`.
-    const activeModel = routed?.model ?? (sessionModel || defaultModel);
-    const activeThinking = routed?.thinking ?? sessionThinking;
+    let activeModel = routed?.model ?? (sessionModel || defaultModel);
+    let activeThinking = routed?.thinking ?? sessionThinking;
     // Provider-side prompt caches are keyed PER MODEL — reusing the bare `sessionId`
     // across a mid-session model switch (routePrompt changing activeModel turn to
     // turn) sends the same cache-correlation key to a different model/provider,
@@ -967,8 +1002,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // `sessionId` is undefined only under `--no-session` — in that case there is no
     // provider-side cache lineage to protect anyway, so forward `undefined` unchanged
     // (matches the prior behavior of `sessionKey: sessionId` for that mode).
-    const turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
-    const contextTokens = catalogMetadata(activeModel)?.contextTokens;
+    let turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
+    let contextTokens = catalogMetadata(activeModel)?.contextTokens;
 
     // Resolve provider + dirty count up front — both are cheap and feed the live
     // frame's footer. `turnConfig` is reused so describeModel does NOT re-read the
@@ -1273,18 +1308,47 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           tags: ["jeo", "launch"],
         });
         opik.startTurn();
-        result = await runAgentLoop(history, {
+        const runLoopWithModel = (model: string, thinking: ThinkLevel | undefined, cacheKey: string | undefined, maxSteps = flags.maxSteps, budget?: { maxExtensions: number }) => runAgentLoop(history, {
           cwd,
           tools,
-          maxSteps: flags.maxSteps,
-          model: activeModel,
-          maxTokens: resolveMaxOutputTokens(activeModel, activeThinking),
-          reasoningEffort: activeThinking ? thinkingToReasoningEffort(activeThinking) : undefined,
+          maxSteps,
+          ...(budget ? { budget } : {}),
+          model,
+          maxTokens: resolveMaxOutputTokens(model, thinking),
+          reasoningEffort: thinking ? thinkingToReasoningEffort(thinking) : undefined,
           signal: ac.signal,
-          sessionKey: turnSessionKey,
+          sessionKey: cacheKey,
           steer: drainSteer,
           events: wrapEvents(withStepPersistence({ ...withToolDetailCapture(tui ? tui.events() : streamEvents), onBeforeDone }, persistTurnTail), opik),
         });
+        const routeFailureReason = (doneReason: unknown): string | null => {
+          const message = String(doneReason ?? "");
+          if (!message) return null;
+          const asError = new Error(message);
+          if (isRateLimitError(asError)) return "hit a rate limit";
+          if (isUsageLimitError(asError)) return "hit a usage/quota limit";
+          if (/does not recognize the requested model|model .*?(?:not found|not available|unavailable|unsupported|retired|gated)|\b(?:400|404)\b/i.test(message)) {
+            return "is unavailable";
+          }
+          return null;
+        };
+        result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
+        const routedFailureReason = routed && !result.done ? routeFailureReason(result.doneReason) : null;
+        if (routed && routedFailureReason) {
+          const fallback = await equivalentRouteFallback(routed, routedFailureReason, [activeModel]);
+          if (fallback) {
+            const previousModel = activeModel;
+            activeModel = fallback;
+            activeThinking = routed.thinking ?? sessionThinking;
+            turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
+            contextTokens = catalogMetadata(activeModel)?.contextTokens;
+            lastRouteDecision = { ...routed, model: activeModel, warning: `routed model '${previousModel}' ${routedFailureReason}; switched to equivalent '${activeModel}'` };
+            const notice = `[route] routed model '${previousModel}' ${routedFailureReason}; switching to equivalent '${activeModel}' for this turn.`;
+            if (tui) tui.events().onNotice?.(notice);
+            else console.log(notice);
+            result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
+          }
+        }
         if (result.done && looksLikeSkillEcho(result.doneReason ?? "", resolvedSkills)) {
           history.push({
             role: "user",