jeo-code 0.8.13 → 0.8.15

package/CHANGELOG.md

@@ -6,6 +6,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.15] - 2026-07-09
+_"api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed._
+
+### Fixed
+- **API-authenticated live model catalogs now feed routing** (`src/ai/model-catalog.ts`, `src/ai/model-discovery.ts`, `src/agent/prompt-router.ts`) — successful provider `/models` responses are recorded in a session-lifetime live-provider supplement separate from the OpenAI OAuth Codex allow-list. API-key OpenAI and OpenAI-compatible clouds (Groq, OpenRouter, custom base URLs, etc.) can now contribute live model rows to `tierModelPool()`, `cheapestCredentialed()`, and `strongestCredentialed()` without waiting for a static release.
+- **Custom OpenAI base URLs no longer auto-select unrelated public OpenAI rows** (`src/agent/prompt-router.ts`) — when `openaiBaseUrl` is configured, routing excludes static public OpenAI catalog rows unless the current base URL's own `/models` response observed that id. Explicit user pins still work as manual overrides, but automatic routing now only chooses models the configured endpoint actually exposed.
+- **Co-resident TUI instances no longer trip listener-leak warnings** (`src/tui/app.ts`, `test/tui-app.test.ts`) — resize/SIGCONT listener ceilings are raised only to the observed in-process TUI fan-out, and the backpressure test now calls `finish()` so its cleanup path matches production.
+
+### Added
+- **API-auth model regression coverage** (`test/model-discovery.test.ts`, `test/prompt-router.test.ts`) — added tests proving API-key OpenAI discovery records live routing rows without widening `isCodexModel()`, custom base URLs do not inherit public `gpt-*` pools before discovery, recorded custom-base models route as `openai/...`, and OpenAI-compatible provider models enter pools under their provider prefix.
+
+### Verified
+- Focused model/routing suite: `bun test test/model-discovery.test.ts test/prompt-router.test.ts test/model-manager.test.ts` — 132 pass / 0 fail.
+- Typecheck: `bun run typecheck` — pass.
+- Full suite: `bun test` — 2814 pass / 0 fail.
+- Package tarball smoke: `npm pack --dry-run` — produced `jeo-code-0.8.15.tgz`.
+
+## [0.8.14] - 2026-07-09
+_"GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier._
+
+### Fixed
+- **Post-call routing recovery now tries equivalent tier fallbacks** (`src/commands/launch.ts`) — after a routed model ends without a usable answer for recoverable reasons (`returned no content`, rate/usage limit, model unavailable/not found, or agent protocol dead-end), jeo now walks the same `tierModelPool()` equivalent model set used by the pre-call veto path, skips models already attempted this turn, preserves per-model cache keys, emits a `[route]` notice, updates `/route why` with the actual replacement, and retries the turn. Deterministic budget/safety cases (`max_output_tokens`, `finish_reason=length`, content filter/refusal/safety categories) intentionally do not reroute.
+
+### Added
+- **Post-call reroute regression coverage** (`test/launch-prompt-routing.test.ts`) — added tests for plain OpenAI no-content recovery to a same-tier fallback, continued traversal when the first fallback also fails recoverably, and no reroute for deterministic output-budget no-content.
+
+### Verified
+- Focused routing suite: `bun test test/launch-prompt-routing.test.ts` — 26 pass / 0 fail.
+
 ## [0.8.13] - 2026-07-09
 _"테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used._
 

package/README.ja.md

@@ -262,11 +262,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
+- **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
-- **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
-- **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -263,11 +263,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
+- **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
-- **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
-- **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -265,11 +265,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
+- **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
-- **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
-- **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -262,11 +262,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
+- **[0.8.14]** (2026-07-09) — "GPT 연결 실패가 여전히 무응답으로 끝나는 케이스를 잡아줘" — traced the remaining GPT/routing failure path to post-call continuity: the route target could be credentialed and servable, but still end a turn with a recoverable terminal result such as plain `OpenAI returned no content`, rate/quota pressure, model unavailable/not found, or an invalid agent-tool response. jeo already knew the prompt tier and equivalent credentialed fallbacks, but it only applied that fallback before the model call. After the call failed, the turn stopped instead of trying another model in the same tier.
 - **[0.8.13]** (2026-07-09) — "테스트검증 jeo --tmux 로 진행해줘" — traced a routing recovery weakness that survived the earlier credential, servability, and local reachability vetoes: once a configured route target was rejected, jeo threw away the whole routing decision and dropped to the session/default model even when the same prompt tier had another credentialed, servable model available. That kept turns working, but it also silently undid routing's cost/latency goal and made `/route why` less useful because the recorded decision was a fallback note instead of the actual model used.
 - **[0.8.12]** (2026-07-08) — "제오코드에서 oauth 지피티 모델 연결이 안되는데 원인파악해서 개선해" — root-caused a structural drift bug: OpenAI's live Codex models endpoint (`chatgpt.com/backend-api/codex/models`, the SAME endpoint the `/model` picker discovers from) had shipped `gpt-5.4-mini` alongside `gpt-5.5`/`gpt-5.4`, but jeo's static OAuth allow-list (`CODEX_MODELS`) hadn't caught up — the picker correctly listed the model (straight from that live endpoint), but selecting or calling it then hit a hard-coded `CODEX_MODELS.includes(...)` gate that rejected it with "OpenAI OAuth credential only supports Codex models", even though the account's own OAuth token genuinely serves it. This is a whole class of bug: it recurs every time OpenAI ships a new Codex model between jeo releases, and previously required a jeo update to fix each time.
 - **[0.8.11]** (2026-07-08) — "프롬프트 라우팅 동작이 Error: Unable to connect. Is the computer able to access the url? Error: Was there a typo in the url or port? 와 같은 메시지 남기고 동작안하는데 원인을 파악하고 근본문제해결하자" — traced the raw, provider-less connection error to two compounding gaps. (1) `describeProvider` reports local providers (ollama/lmstudio) as `ready: true` UNCONDITIONALLY — "keyless" only means no credential is required, never that the server is actually reachable — so the routing veto gate (which exists precisely to keep a misconfigured routing target from making a turn worse than routing being off) had no way to catch a `routing.tiers`/`roles` pin to a downed local server. (2) Bun's fetch/undici throws a bare `Error("Unable to connect. Is the computer able to access the url?")` with `.code === "ConnectionRefused"` for BOTH a refused connection and an unresolvable host — no HTTP status, no provider name, no URL — and this fell through every existing error classifier (`defaultRetryable`, `friendlyProviderError`) to reach the user completely unfiltered.
-- **[0.8.10]** (2026-07-08) — "지피티 모델 연결이 안되는데 원인파악해서 개선해" — OpenAI's Codex/Responses backend (used by every `gpt-5.5`/`gpt-5.4` OAuth call, and by API-key reasoning models) can emit an in-band `response.failed`/`error` SSE EVENT on an otherwise-200 stream (documented codes: `server_error`, `rate_limit_exceeded` — OpenAI's own guidance is "retry with exponential backoff"). This was thrown as an unclassified bare `Error`, which propagated straight out of the engine's model call with NO retry — a transient OpenAI backend hiccup killed the whole turn outright, surfacing as "GPT doesn't connect" during real interactive use even though `jeo doctor` and a fresh one-shot call both looked healthy (the failure only manifests mid-stream, after the connection has already succeeded).
-- **[0.8.9]** (2026-07-08) — "프롬프트 라우팅 속도 문제가 있는거같은데 근본원인 알려줘" — prompt routing incurred significant latency due to a design oversight in LLM-based escalation: when heuristic confidence falls below threshold (standard conceptual questions with no code blocks/file paths conflict-trigger 0.35 confidence), it makes a blocking, synchronous LLM classifier call. If the user's global `thinkingLevel` is enabled (medium/high/xhigh), the cheap classifier model (Haiku 4.5 / GPT-4o-mini) also ran with reasoning enabled, wasting 500ms–1500ms on internal thoughts for a simple 1-word JSON response. The same reasoning-latency leak existed on all other background/internal LLM calls (compaction summarizer, goal verifier, memory distiller), blocking user turns on compaction boundaries.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/prompt-router.ts

@@ -49,11 +49,10 @@
  */
 import { callLlm } from "./loop";
 import { resolveRoleModel, modelServableWithConfig } from "../ai/model-manager";
-import { catalogMetadata, MODEL_CATALOG, compareReleaseDate, type CatalogModel } from "../ai/model-catalog";
+import { catalogMetadata, MODEL_CATALOG, compareReleaseDate, liveProviderCatalogModels, isLiveProviderModel, type CatalogModel, type ThinkLevel } from "../ai/model-catalog";
 import { priceForModel } from "../ai/pricing";
 import { tryExtractJsonObject } from "./json";
 import type { Config } from "./state";
-import type { ThinkLevel } from "../ai/model-catalog";
 import type { ProviderName } from "../ai/types";
 import type { AuthProvider } from "../auth";
 
@@ -90,24 +89,17 @@ export interface RoutePromptOptions {
 // --- Frozen, bilingual-validated classification signals (do not re-derive). ---
 
 const RE_CAUSAL = /\b(why|how|root cause|how come)\b/i;
-const RE_CAUSAL_KR = /(왜\s|근본\s*원인|이유가|어떻게)/;
+const RE_CAUSAL_KR = /(왜\s|근본\s*원인|이유가|어떻게|이유|어째서|원인|해결책|해결방안)/;
 const RE_TRIVIAL_QUESTION_WORD = /\b(what|who|when|where|which)\b/i;
-const RE_TRIVIAL_QUESTION_WORD_KR = /(뭐|뭔가요|무엇|언제|어디|누구|몇\s|인가요|있나요)/;
+const RE_TRIVIAL_QUESTION_WORD_KR = /(뭐|뭔가요|무엇|언제|어디|누구|몇\s|인가요|있나요|냐|음\?|인가)/;
 const RE_CODE_FENCE = /```/;
-const RE_PATH_TOKEN = /(?:^|[\s"'`(])@?(?:\.{0,2}[\w-]*\/)+[\w-]+(?:\.[\w-]+)*\.[A-Za-z]\w{0,7}\b/g;
+const RE_CODE_SNIPPET = /(?:const|let|var|import|export|function|class|if\s*\(|try\s*{|=>|\{\s*[\w\d_]+\s*\})/;
+const RE_PATH_TOKEN = /(?:^|[\s"'`(])@?(?:\.{0,2}[\w-]*[\/\\])+[\w-]+(?:\.[\w-]+)*(?:\.[A-Za-z]\w{0,7}|[\/\\])\b/g;
+const RE_CLI_COMMAND = /(?:^|\s)(git|npm|bun|docker-compose|pip|cargo)\s+[a-z-_]+/i;
 const RE_DEEP_KEYWORDS_EN = /\b(design|architecture|refactor|debug|deep\s*dive|investigate|diagnose|redesign)\b/i;
 const RE_DEEP_KEYWORDS_KR = /(설계|아키텍처|리팩터|디버그|딥\s*다이브|딥다이브|진단)/;
-const RE_SENTENCE_BOUNDARY = /[.!?][ \n]|[.!?]$/g;
+const RE_SENTENCE_BOUNDARY = /[.!?][ \n]|[.!?.]$/g;
 
-/**
- * Pure, synchronous, zero-I/O prompt classification. Every branch and threshold
- * here is frozen per the PromptRouter contract (validated against a 17+-case
- * bilingual corpus) — in particular: a causal ("why"/"how"/"왜"/"어떻게") question
- * is NEVER treated as trivial just because it's short and question-shaped (a
- * debugging question is the opposite of trivial), and the path-token regex is
- * anchored so numeric fractions like "3/4.5" or "10/10" never false-positive as
- * a file path (the trailing segment must end in a letter-led extension).
- */
 export function classifyPromptHeuristically(prompt: string): HeuristicResult {
   const trimmed = prompt.trim();
   const signals: string[] = [];
@@ -126,14 +118,22 @@ export function classifyPromptHeuristically(prompt: string): HeuristicResult {
     signals.push("short-question");
   }
 
-  // trivial signal 2: no code fence AND no file path mention.
+  // trivial signal 2: no code fence AND no code snippet AND no file path mention AND no CLI command.
   const hasCodeFence = RE_CODE_FENCE.test(trimmed);
+  const hasCodeSnippet = RE_CODE_SNIPPET.test(trimmed);
+  const hasCliCommand = RE_CLI_COMMAND.test(trimmed);
   const pathMatches = [...trimmed.matchAll(RE_PATH_TOKEN)];
-  if (!hasCodeFence && pathMatches.length === 0) {
+  if (!hasCodeFence && !hasCodeSnippet && !hasCliCommand && pathMatches.length === 0) {
     trivialScore++;
     signals.push("no-code-no-path");
   }
 
+  // trivial signal 3: explicit CLI command (usually simple lookup/execution)
+  if (hasCliCommand) {
+    trivialScore++;
+    signals.push("cli-command");
+  }
+
   // complex signal 1: deep-work keyword.
   if (RE_DEEP_KEYWORDS_EN.test(trimmed) || RE_DEEP_KEYWORDS_KR.test(trimmed)) {
     complexScore++;
@@ -160,7 +160,6 @@ export function classifyPromptHeuristically(prompt: string): HeuristicResult {
     complexScore++;
     signals.push("multi-file");
   }
-
   // Tier + confidence resolution (frozen thresholds).
   if (trivialScore > 0 && complexScore > 0) {
     return { tier: "standard", confidence: 0.35, signals }; // conflicting signals -> let escalation decide
@@ -202,7 +201,7 @@ export function resetPromptRouterWarnings(): void {
  *  `undefined`. Production callers (`readGlobalConfig()`'s real `Config`) always
  *  provide both. */
 export type RoutingConfig = Pick<Config, "defaultModel" | "roles" | "routing"> &
-  Partial<Pick<Config, "providers" | "oauth">>;
+  Partial<Pick<Config, "providers" | "oauth" | "openaiBaseUrl">>;
 
 /** Cloud providers eligible for cross-provider auto-select (excludes local
  *  ollama/lmstudio, which are never a sensible "route to the cheapest/strongest"
@@ -221,10 +220,19 @@ function hasAntigravityOauth(config: RoutingConfig): boolean {
   return !!(config.oauth?.antigravity || config.oauth?.gemini);
 }
 
+function routingCatalog(config: RoutingConfig): CatalogModel[] {
+  const rows = [...MODEL_CATALOG, ...liveProviderCatalogModels(config)];
+  const eligible = rows.filter(m => isAutoSelectCandidate(m, config));
+  const byId = new Map<string, CatalogModel>();
+  for (const row of eligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
+  return [...byId.values()];
+}
+
 function isAutoSelectCandidate(m: CatalogModel, config: RoutingConfig): boolean {
   // Shared model-LEVEL credential gate (the full auth matrix is documented on
   // modelServableWithConfig; keep aligned with resolveCall).
   if (!isCloudProvider(m.provider) || m.limitedAvailability || !modelServableWithConfig(m.provider, m.canonical, config)) return false;
+  if (m.provider === "openai" && config.openaiBaseUrl && !isLiveProviderModel("openai", m.canonical, config)) return false;
   if (hasAntigravityOauth(config) && m.provider === "gemini") return false;
   return true;
 }
@@ -280,7 +288,7 @@ function compareStrengthAscending(a: CatalogModel, b: CatalogModel): number {
  *  for deterministic pool ordering (required by `selectFromPool`'s index math). */
 export function tierModelPool(tier: PromptTier, config: RoutingConfig): string[] {
   const targetClass = TIER_TO_SIZE_CLASS[tier];
-  const credentialed = MODEL_CATALOG.filter(m => isAutoSelectCandidate(m, config));
+  const credentialed = routingCatalog(config);
 
   const suffixPool = credentialed.filter(m => sizeClassFor(m) === targetClass);
 
@@ -329,7 +337,7 @@ export function selectFromPool(pool: readonly string[], sessionId: string | unde
 export function cheapestCredentialed(config: RoutingConfig): string | null {
   let best: CatalogModel | null = null;
   let bestCost = Infinity;
-  for (const m of MODEL_CATALOG) {
+  for (const m of routingCatalog(config)) {
     // Candidate eligibility is centralized in `isAutoSelectCandidate`: it keeps
     // OAuth-backed Antigravity routing on provider-qualified 3.1+ Gemini rows and
     // prevents public `gemini` catalog rows from winning when Antigravity OAuth is
@@ -377,7 +385,7 @@ export function strongestCredentialed(
   filter?: (m: CatalogModel) => boolean
 ): string | null {
   let best: CatalogModel | null = null;
-  for (const m of MODEL_CATALOG) {
+  for (const m of routingCatalog(config)) {
     // Candidate eligibility is centralized in `isAutoSelectCandidate` (see
     // cheapestCredentialed above for the Antigravity/Gemini OAuth rationale).
     if (!isAutoSelectCandidate(m, config)) continue;
@@ -406,8 +414,8 @@ export function strongestCredentialed(
  *  mid-class-suffixed model is credentialed (caller falls through to
  *  `roles.medium`/`defaultModel` — never to `complex`'s flagship pick). */
 function strongestMidTierCredentialed(config: RoutingConfig): string | null {
-  const midClass = MODEL_CATALOG.filter(
-    m => isAutoSelectCandidate(m, config) && sizeClassFor(m) === "mid",
+  const midClass = routingCatalog(config).filter(
+    m => sizeClassFor(m) === "mid",
   );
   if (midClass.length === 0) return null;
   return midClass.sort(compareStrengthAscending).at(-1)!.canonical;

package/src/ai/model-catalog.ts

@@ -222,6 +222,122 @@ export function resetLiveCodexModels(): void {
   liveCodexModels.clear();
 }
 
+/** Live provider model ids observed from authenticated/keyless `/models` endpoints during
+ *  this process. Unlike `liveCodexModels`, this is NOT an OAuth allow-list; it is a
+ *  routing supplement so API-key and OpenAI-compatible catalogs discovered at runtime
+ *  can participate in prompt routing without waiting for a static release. */
+type LiveProviderModelSource = "oauth" | "api_key" | "keyless" | "none";
+interface LiveProviderModelRecord {
+  row: CatalogModel;
+  source: LiveProviderModelSource;
+  baseUrl?: string;
+}
+const liveProviderModels = new Map<string, LiveProviderModelRecord>();
+
+function normalizeBaseUrl(baseUrl: string | undefined): string | undefined {
+  return baseUrl?.replace(/\/+$/, "");
+}
+
+function stripProviderPrefix(provider: ProviderName, id: string): string {
+  const prefix = `${provider}/`;
+  if (id.startsWith(prefix)) return id.slice(prefix.length);
+  if (provider === "openai" && id.startsWith("openai/")) return id.slice("openai/".length);
+  if (provider === "gemini" && id.startsWith("google/")) return id.slice("google/".length);
+  return id;
+}
+
+function liveCanonicalId(provider: ProviderName, id: string): string {
+  const trimmed = id.trim();
+  if (!trimmed) return trimmed;
+  if (trimmed.startsWith(`${provider}/`)) return trimmed;
+  if (provider === "openai") {
+    const lower = trimmed.toLowerCase();
+    // Official OpenAI-style ids already route to OpenAI by heuristic. Custom
+    // OpenAI-compatible deployments (Azure/local/proxy) often use arbitrary names;
+    // qualify those so routing sends them back to the endpoint that listed them.
+    return lower.includes("gpt") || /^o\d/.test(lower) || lower.includes("chatgpt")
+      ? trimmed
+      : `openai/${trimmed}`;
+  }
+  if (provider === "xai" || provider === "kimi") return trimmed;
+  return openaiCompatDef(provider) || provider === "ollama" || provider === "lmstudio" || provider === "antigravity"
+    ? `${provider}/${trimmed}`
+    : trimmed;
+}
+
+function liveModelRecordKey(provider: ProviderName, canonical: string, baseUrl: string | undefined): string {
+  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${canonical}`;
+}
+
+function liveModelFallbackRow(provider: ProviderName, canonical: string, providerModel: string): CatalogModel {
+  const inferred = inferCatalogMetadata(canonical) ?? inferCatalogMetadata(providerModel);
+  return {
+    canonical,
+    provider,
+    providerModel,
+    contextTokens: inferred?.contextTokens ?? 128_000,
+    maxOutputTokens: inferred?.maxOutputTokens ?? 16_384,
+    thinking: inferred?.thinking ?? [],
+    images: inferred?.images ?? true,
+    company: inferred?.company ?? companyLabel(provider),
+    releaseDate: inferred?.releaseDate,
+    sizeClass: inferred?.sizeClass,
+  };
+}
+
+/** Record live ids returned by a provider's own model-list endpoint. Additive only:
+ *  transient partial responses must not evict an id observed earlier this session. */
+export function recordLiveProviderModels(
+  provider: ProviderName,
+  ids: readonly string[],
+  opts: { source?: LiveProviderModelSource; baseUrl?: string } = {},
+): void {
+  const baseUrl = normalizeBaseUrl(opts.baseUrl);
+  for (const id of ids) {
+    const canonical = liveCanonicalId(provider, id);
+    if (!canonical) continue;
+    const providerModel = stripProviderPrefix(provider, canonical);
+    const known = findCatalogModel(canonical) ?? findCatalogModel(providerModel);
+    const row = known
+      ? { ...known, canonical, provider, providerModel }
+      : liveModelFallbackRow(provider, canonical, providerModel);
+    liveProviderModels.set(liveModelRecordKey(provider, canonical, baseUrl), {
+      row,
+      source: opts.source ?? "none",
+      baseUrl,
+    });
+  }
+}
+
+function liveRecordMatchesConfig(record: LiveProviderModelRecord, config?: { openaiBaseUrl?: string }): boolean {
+  if (record.row.provider !== "openai") return true;
+  const wanted = normalizeBaseUrl(config?.openaiBaseUrl);
+  if (wanted || record.baseUrl) return wanted === record.baseUrl;
+  return true;
+}
+
+/** Live-discovered catalog rows usable for routing under the current config. */
+export function liveProviderCatalogModels(config?: { openaiBaseUrl?: string }): CatalogModel[] {
+  return [...liveProviderModels.values()]
+    .filter(record => liveRecordMatchesConfig(record, config))
+    .map(record => record.row);
+}
+
+/** True when a model came from the current provider/base URL's live model list. */
+export function isLiveProviderModel(provider: ProviderName, model: string, config?: { openaiBaseUrl?: string }): boolean {
+  const candidates = new Set([model, liveCanonicalId(provider, model), stripProviderPrefix(provider, model)]);
+  return [...liveProviderModels.values()].some(record =>
+    record.row.provider === provider &&
+    liveRecordMatchesConfig(record, config) &&
+    (candidates.has(record.row.canonical) || candidates.has(record.row.providerModel))
+  );
+}
+
+/** Test-only: clear live provider model supplements. */
+export function resetLiveProviderModels(): void {
+  liveProviderModels.clear();
+}
+
 /**
  * Model ids the Kimi Code OAuth backend (api.kimi.com/coding, Anthropic Messages
  * format) actually serves. The subscription endpoint rejects Moonshot API-platform

package/src/ai/model-discovery.ts

@@ -11,7 +11,7 @@ import { readGlobalConfig, type Config } from "../agent/state";
 import { resolveCredential, type AuthProvider, type Credential } from "../auth";
 import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
-import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS, recordLiveCodexModels } from "./model-catalog";
+import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS, recordLiveCodexModels, recordLiveProviderModels } from "./model-catalog";
 import { extractChatgptAccountId } from "./providers/openai-responses";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
@@ -405,9 +405,10 @@ export async function listProviderModels(
       }
     }
     const models = [...new Set(ids)].sort().slice(0, limit);
-    // Widen the self-healing Codex gate (model-catalog.ts) the moment the account's
-    // OWN live endpoint confirms a model — closes the "picker shows it, call-time
-    // gate rejects it" drift window without waiting for a jeo release.
+    // Record live ids for routing supplements. For OpenAI OAuth, keep the
+    // existing Codex allow-list widening separate: API-key/custom-base discovery
+    // must not make OAuth Codex calls accept unrelated API models.
+    recordLiveProviderModels(provider, models, { source, baseUrl: opts.baseUrl });
     if (provider === "openai" && source === "oauth") recordLiveCodexModels(models);
     return { provider, models, ok: true, source };
   } catch (err) {

package/src/commands/launch.ts

@@ -1323,31 +1323,50 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         });
         const routeFailureReason = (doneReason: unknown): string | null => {
           const message = String(doneReason ?? "");
-          if (!message) return null;
+          if (!message) return "stopped without a final answer";
           const asError = new Error(message);
           if (isRateLimitError(asError)) return "hit a rate limit";
           if (isUsageLimitError(asError)) return "hit a usage/quota limit";
           if (/does not recognize the requested model|model .*?(?:not found|not available|unavailable|unsupported|retired|gated)|\b(?:400|404)\b/i.test(message)) {
             return "is unavailable";
           }
+          // Treat plain empty completions and protocol dead-ends as continuity failures:
+          // the routed model did not produce an answer the agent can commit. Do NOT
+          // reroute deterministic policy/budget errors — switching models must not be
+          // a safety bypass or a substitute for raising output/context budgets.
+          if (/returned no content/i.test(message)) {
+            if (/max[_ -]?(?:output[_ -]?)?tokens|finish_reason=length|done_reason=length|stop_reason=max_tokens|content_filter|refusal|safety|prohibited_content|blocklist|recitation|spii|reasoning_extraction/i.test(message)) {
+              return null;
+            }
+            return "returned no content";
+          }
+          if (/no valid tool call|without signaling done|consecutive failing tool calls|consecutive failing tool steps|repeating the same tool call|cycling through the same/i.test(message)) {
+            return "did not produce a usable agent response";
+          }
           return null;
         };
         result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
-        const routedFailureReason = routed && !result.done ? routeFailureReason(result.doneReason) : null;
-        if (routed && routedFailureReason) {
-          const fallback = await equivalentRouteFallback(routed, routedFailureReason, [activeModel]);
-          if (fallback) {
-            const previousModel = activeModel;
-            activeModel = fallback;
-            activeThinking = routed.thinking ?? sessionThinking;
-            turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
-            contextTokens = catalogMetadata(activeModel)?.contextTokens;
-            lastRouteDecision = { ...routed, model: activeModel, warning: `routed model '${previousModel}' ${routedFailureReason}; switched to equivalent '${activeModel}'` };
-            const notice = `[route] routed model '${previousModel}' ${routedFailureReason}; switching to equivalent '${activeModel}' for this turn.`;
-            if (tui) tui.events().onNotice?.(notice);
-            else console.log(notice);
-            result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
-          }
+        const routeFallbackMaxRaw = Number(jeoEnv("ROUTE_FALLBACK_MAX_ATTEMPTS") ?? NaN);
+        const routeFallbackMax = Number.isFinite(routeFallbackMaxRaw) && routeFallbackMaxRaw >= 0
+          ? Math.floor(routeFallbackMaxRaw)
+          : 3;
+        const attemptedRouteModels = new Set<string>([activeModel]);
+        for (let routeFallbackAttempt = 0; routed && routeFallbackAttempt < routeFallbackMax; routeFallbackAttempt++) {
+          const routedFailureReason = !result.done ? routeFailureReason(result.doneReason) : null;
+          if (!routedFailureReason) break;
+          const fallback = await equivalentRouteFallback(routed, routedFailureReason, [...attemptedRouteModels]);
+          if (!fallback) break;
+          const previousModel = activeModel;
+          attemptedRouteModels.add(fallback);
+          activeModel = fallback;
+          activeThinking = routed.thinking ?? sessionThinking;
+          turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
+          contextTokens = catalogMetadata(activeModel)?.contextTokens;
+          lastRouteDecision = { ...routed, model: activeModel, warning: `routed model '${previousModel}' ${routedFailureReason}; switched to equivalent '${activeModel}'` };
+          const notice = `[route] routed model '${previousModel}' ${routedFailureReason}; switching to equivalent '${activeModel}' for this turn.`;
+          if (tui) tui.events().onNotice?.(notice);
+          else console.log(notice);
+          result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
         }
         if (result.done && looksLikeSkillEcho(result.doneReason ?? "", resolvedSkills)) {
           history.push({

package/src/tui/app.ts

@@ -1135,14 +1135,23 @@ export class LaunchTui {
         this.draw();
       });
     // Watch terminal resizes: rows/cols changes invalidate the previous frame, so
-    // force a full repaint instead of diffing against stale line positions.
+    // force a full repaint instead of diffing against stale line positions. Tests and
+    // embedded runners can create several co-resident TUI instances before teardown;
+    // raise the listener ceiling just enough to represent that real fan-out instead
+    // of letting Node/Bun turn legitimate co-residency into a MaxListeners warning.
     if (this.tty) {
+      const resizeCount = process.stdout.listenerCount("resize");
+      const stdoutMax = process.stdout.getMaxListeners();
+      if (stdoutMax > 0 && resizeCount + 1 >= stdoutMax) process.stdout.setMaxListeners(resizeCount + 2);
       process.stdout.on("resize", this.onResize);
       // Suspend (Ctrl-Z) → resume (fg): SIGWINCH is lost while the process is stopped,
       // so a terminal resized mid-suspend would resume with stale geometry and a torn
       // frame. SIGCONT fires on resume; force a re-measure + full repaint. POSIX only
       // (Windows has no SIGCONT — registering it would throw).
       if (process.platform !== "win32") {
+        const resumeCount = process.listenerCount("SIGCONT");
+        const processMax = process.getMaxListeners();
+        if (processMax > 0 && resumeCount + 1 >= processMax) process.setMaxListeners(resumeCount + 2);
         process.on("SIGCONT", this.onResume);
       }
     }