jeo-code 0.8.20 → 0.8.22

package/CHANGELOG.md

@@ -6,6 +6,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.22] - 2026-07-11
+_A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping._
+
+### Added
+- **Full-transcript restore on `/resume`/`--continue`** (`src/commands/launch.ts`) — all three non-interactive startup resume paths (`--resume <id>`, `--continue`/`-c`, and the TTY-less bare `--resume`) previously printed only `"Resumed session <id> (N messages)."` with no reproduction of the prior conversation. They now render the same `formatTranscript` ledger (user prompt boxes, ✔/✗ tool-call lines, `jeo ◂` reply blocks) that the mid-session `/session resume` and `/history` commands already used, so resuming any session created going forward reproduces the prior work on screen instead of a one-line summary. Live-verified against a real on-disk session and a real `bun run src/cli.ts launch --resume <id>` child process.
+- **Resize-detection safety net** (`src/tui/terminal.ts`'s `watchResize`/`liveWindowSize`, wired into `src/tui/app.ts`'s `LaunchTui`) — a 300ms poll against the real `TIOCGWINSZ` ioctl (`getWindowSize()`) that self-heals `process.stdout.columns`/`.rows` and repaints when a `'resize'` (SIGWINCH) event is missed — e.g. a tmux pane switch while jeo's pane isn't foregrounded, or a SIGCONT race after Ctrl-Z. Composes safely alongside the existing `'resize'` listener; started in `begin()`, torn down in `finish()`.
+
+### Fixed
+- **`updateSessionDraft` trim bug** (`src/agent/session.ts`) — the no-op comparison checked `draft.trim()` for truthiness but persisted the untrimmed original string; now trims once and persists the trimmed value consistently.
+
+### Verified
+- Full `bun test` — 2906 pass / 0 fail across 291 files.
+- `bun run typecheck` — no errors.
+- Live PTY/CLI verification of the resume-transcript restore end-to-end (real session file, real child-process `launch --resume`).
+
+
+## [0.8.21] - 2026-07-10
+_"반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping._
+
+### Added
+- **Session draft-restore** (`src/agent/session.ts`, `src/commands/launch/session-slash.ts`, `src/commands/launch.ts`, `src/commands/launch/input.ts`) — an unsent, half-typed prompt now survives a hard exit (Ctrl+D/EOF/disconnected terminal) and is restored into the prompt box on `/resume` (gajae-code parity). The read-side plumbing (`updateSessionDraft`, `header.draft`, `runSessionSlash` surfacing it) already existed; `launch.ts` never consumed it. Added `persistSessionDraft` (mirrors the existing `persistSessionModel` pattern) and a new pure predicate `draftFromUnsentLine` (`launch/input.ts`), wired into all 3 resume paths — the interactive picker, the mid-loop `/session resume` command, and `--resume <id>`/`--continue`'s non-interactive startup path (this third path had NO draft restoration at all before this fix). Live-verified: seeded a real session's draft, launched the real `bun src/cli.ts --resume <id>` under a genuine PTY, confirmed the exact unsent text appeared in the live prompt box.
+- **Evidence-gated goal verification** (`src/agent/goal-verifier.ts`, `src/agent/engine.ts`, `src/commands/launch.ts`) — an LLM-judged `MET` goal verdict is now deterministically downgraded to `NOT_MET` when the turn mutated files with no fresh verification evidence, closing the "gate theater" failure mode (an LLM asserting success without re-checked evidence). `applyEvidenceGate` (pure, already unit-tested with 5 tests) existed but was never called anywhere — the same disconnected-scaffolding pattern `RouteHistory` shipped with in 0.8.16/0.8.17. `onBeforeDone`'s signature now carries the SAME `sawMutation`/`sawVerification`/`verificationStale` signals the engine's own done-gate already computes; `launch.ts`'s goal-verifier closure now gates `verifyGoal`'s raw verdict through it before persisting or acting on it.
+
+### Fixed
+- **`toolTarget` dedup** (`src/agent/step-budget.ts`, `src/agent/task-tool.ts`) — `task-tool.ts` had a private copy of the same coarse-call-target labeler `step-budget.ts` needed for a new edit-thrashing novelty rule (a model rewriting the same file with different content every attempt no longer earns endless step-budget extensions — only the first attempt at a given target counts as novel). Moved to `step-budget.ts` (exported), `task-tool.ts` now imports it — confirmed byte-identical, zero behavior change.
+
+### Added (catalog)
+- **`gpt-5.6`** (`src/ai/model-catalog.ts`) — OpenAI's newest catalogued model, consistent with existing entries; correctly excluded from the OAuth-only `CODEX_MODELS` allow-list (live discovery handles that drift per its own documented contract, not a static edit).
+
+### Verified
+- `bun test test/launch-flags.test.ts test/session-draft-restore.test.ts test/step-budget.test.ts test/goal-verifier.test.ts test/task-tool.test.ts test/doctor.test.ts test/prompt-router-tiers.test.ts test/model-catalog.test.ts` — 128 pass / 0 fail.
+- Full `bun test` — 2906 pass / 0 fail across 291 files.
+- `bun run typecheck` — no errors.
+- Live PTY end-to-end: real session seeded with `updateSessionDraft`, real `bun src/cli.ts --resume <id>` subprocess, confirmed the exact restored text in the live prompt box.
+
 ## [0.8.20] - 2026-07-10
 _"모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here._
 

package/README.ja.md

@@ -265,11 +265,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -266,11 +266,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -273,11 +273,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -265,11 +265,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.20",
+  "version": "0.8.22",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/engine.ts

@@ -27,7 +27,8 @@ import { isContextOverflowError, isRefusalError, friendlyProviderError } from ".
 import { runPreToolHooks, runPostTurnHooksForBatch } from "./hooks";
 import { truncateToolOutput, formatToolResultBody } from "./tool-output";
 export { TOOL_OUTPUT_MAX, READ_OUTPUT_MAX, TOOL_SPILL_THRESHOLD, MAX_TOOL_ARTIFACTS, truncateToolOutput, spillToolResult } from "./tool-output";
-import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSignature, type StepBudgetConfig } from "./step-budget";
+import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSignature, toolTarget, type StepBudgetConfig } from "./step-budget";
+
 import { historyTokens, trimToolResultsInPlace, stripReasoningArtifactsInPlace } from "./compaction";
 import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, repeatHint, classifyDoneGate } from "./loop-guards";
@@ -1058,6 +1059,22 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // once per call here (instead of joining full sigs, hashing, then re-hashing
     // inside budget.record) avoids re-scanning a large write body 3× per step.
     const callSigs = toolCalls.map(c => hashSignature(`${c.tool}:${JSON.stringify(c.arguments ?? {})}`));
+    // Coarse per-call TARGET (e.g. `edit src/x.ts`) — feeds the budget's novelty rule
+    // separately from the exact-args digest above. A model that keeps rewriting the
+    // SAME file/command with slightly different content each attempt produces a fresh
+    // `callSigs` entry every time (never "seen" before) but the SAME `callTargets`
+    // entry, so that thrashing stops earning step-budget extensions after its first try.
+    // `toolTarget` falls back to the bare tool name when it can't find an identifying
+    // field (e.g. a custom/dynamic tool with no filePath/command/pattern argument) — that
+    // generic case carries NO real identity ("work" for every call), so treat it as "no
+    // coarse target" and let `budget.record` fall back to the exact-args signature
+    // instead (unchanged legacy novelty for tools this helper doesn't specifically know).
+    const callTargets = toolCalls.map(c => {
+      const t = toolTarget(c.tool, c.arguments);
+      return t.toLowerCase() === (c.tool || "").toLowerCase() ? undefined : t;
+    });
+
+
     const sig = callSigs.length === 1 ? callSigs[0] : hashSignature(callSigs.join(" | "));
     if (sig === lastSig) repeatCount++;
     else {
@@ -1313,7 +1330,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // edits plus one trivial successful read must not look like a progressing
     // step to the extension heuristic (that loophole earned endless extensions).
     for (let i = 0; i < toolCalls.length; i++) {
-      if (results[i].executed) budget.record(callSigs[i], results[i].success);
+      if (results[i].executed) budget.record(callSigs[i], results[i].success, callTargets[i]);
+
     }
     // done-verification guard bookkeeping: write/edit successes mark the turn as
     // mutating; a successful bash whose command/output looks like a test/build run

package/src/agent/prompt-router.ts

@@ -222,23 +222,43 @@ function hasAntigravityOauth(config: RoutingConfig): boolean {
   return !!(config.oauth?.antigravity || config.oauth?.gemini);
 }
 
+/** Builds the routing catalog once per call: static `MODEL_CATALOG` rows need the
+ *  full `isAutoSelectCandidate` gate (including the `isLiveProviderModel` check,
+ *  when `openaiBaseUrl` is set), but rows already returned by
+ *  `liveProviderCatalogModels()` are live BY CONSTRUCTION — re-verifying each one
+ *  with `isLiveProviderModel` is pure O(n) waste (it dominated this function's
+ *  cost: ~1.4ms/call at 2000 live models). Live rows still need the shared
+ *  provider/OAuth gates (cloud provider, credential, antigravity/gemini), just not
+ *  the live-membership check specific to static rows. */
 function routingCatalog(config: RoutingConfig): CatalogModel[] {
-  const rows = [...MODEL_CATALOG, ...liveProviderCatalogModels(config)];
-  const eligible = rows.filter(m => isAutoSelectCandidate(m, config));
+  const staticEligible = MODEL_CATALOG.filter(m => isAutoSelectCandidate(m, config));
+  const liveEligible = liveProviderCatalogModels(config).filter(m => isAutoSelectCandidateLive(m, config));
   const byId = new Map<string, CatalogModel>();
-  for (const row of eligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
+  for (const row of staticEligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
+  for (const row of liveEligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
   return [...byId.values()];
 }
 
-function isAutoSelectCandidate(m: CatalogModel, config: RoutingConfig): boolean {
-  // Shared model-LEVEL credential gate (the full auth matrix is documented on
-  // modelServableWithConfig; keep aligned with resolveCall).
+/** Shared provider/OAuth eligibility gates, independent of live-membership. */
+function isCoreEligible(m: CatalogModel, config: RoutingConfig): boolean {
   if (!isCloudProvider(m.provider) || m.limitedAvailability || !modelServableWithConfig(m.provider, m.canonical, config)) return false;
-  if (m.provider === "openai" && config.openaiBaseUrl && !isLiveProviderModel("openai", m.canonical, config)) return false;
   if (hasAntigravityOauth(config) && m.provider === "gemini") return false;
   return true;
 }
 
+function isAutoSelectCandidate(m: CatalogModel, config: RoutingConfig): boolean {
+  if (!isCoreEligible(m, config)) return false;
+  if (m.provider === "openai" && config.openaiBaseUrl && !isLiveProviderModel("openai", m.canonical, config)) return false;
+  return true;
+}
+
+/** Same eligibility as `isAutoSelectCandidate`, for a row ALREADY sourced from
+ *  `liveProviderCatalogModels()` — skips the live-membership re-check (see
+ *  `routingCatalog`'s doc comment). */
+function isAutoSelectCandidateLive(m: CatalogModel, config: RoutingConfig): boolean {
+  return isCoreEligible(m, config);
+}
+
 
 /** Size class jeo infers for a catalog model, used to group EQUIVALENT models
  *  across DIFFERENT providers for pool-based routing (see `tierModelPool`) — the
@@ -358,12 +378,10 @@ export function cheapestCredentialed(config: RoutingConfig): string | null {
   let best: CatalogModel | null = null;
   let bestCost = Infinity;
   for (const m of routingCatalog(config)) {
-    // Candidate eligibility is centralized in `isAutoSelectCandidate`: it keeps
-    // OAuth-backed Antigravity routing on provider-qualified 3.1+ Gemini rows and
-    // prevents public `gemini` catalog rows from winning when Antigravity OAuth is
-    // the available Gemini lane. The real veto gate in launch.ts's `runTurn` still
-    // re-verifies full readiness (including live OAuth expiry) before a turn uses it.
-    if (!isAutoSelectCandidate(m, config)) continue;
+    // `routingCatalog(config)` already filtered to eligible rows (static rows via
+    // `isAutoSelectCandidate`, live rows via `isAutoSelectCandidateLive`) — no need
+    // to re-check here. See cheapestCredentialed's own doc comment for the
+    // Antigravity/Gemini OAuth rationale behind that eligibility gate.
     const price = priceForModel(m.canonical);
     if (!price) continue;
     const cost = price.inPerM + price.outPerM;
@@ -406,9 +424,8 @@ export function strongestCredentialed(
 ): string | null {
   let best: CatalogModel | null = null;
   for (const m of routingCatalog(config)) {
-    // Candidate eligibility is centralized in `isAutoSelectCandidate` (see
+    // `routingCatalog(config)` already filtered to eligible rows (see
     // cheapestCredentialed above for the Antigravity/Gemini OAuth rationale).
-    if (!isAutoSelectCandidate(m, config)) continue;
     if (filter && !filter(m)) continue;
     if (!best) { best = m; continue; }
     const xhighM = m.thinking.includes("xhigh") ? 1 : 0;

package/src/agent/step-budget.ts

@@ -168,17 +168,29 @@ export class StepBudget {
   }
 
   /** Record an executed tool call (ring-buffered to the scoring window).
-   *  Stored as a fixed-size digest — see `hashSignature` (memory bound). */
-  record(signature: string, success: boolean): void {
+   *  Stored as a fixed-size digest — see `hashSignature` (memory bound).
+   *
+   *  `targetKey` (optional) is the COARSE target (e.g. `edit src/x.ts`) the novelty rule
+   *  scores against, instead of `signature`'s full-args hash. Without it, retrying an
+   *  edit on the SAME file with slightly different content each attempt looks "novel"
+   *  forever (the exact args hash never repeats) and the extension heuristic reads that
+   *  edit-thrashing loop as endless progress. With it, only the FIRST attempt at a given
+   *  target counts as novel; grinding on the same file/command afterwards does not, so a
+   *  stuck rewrite loop stops earning extensions even though every individual call
+   *  "succeeds" and every exact signature is technically unique. Falls back to `signature`
+   *  when omitted (unchanged behavior for existing callers/tests). */
+  record(signature: string, success: boolean, targetKey?: string): void {
     const sig = hashSignature(signature);
-    if (!this.seen.has(sig)) {
-      this.seen.add(sig);
+    const noveltyKey = hashSignature(targetKey ?? signature);
+    if (!this.seen.has(noveltyKey)) {
+      this.seen.add(noveltyKey);
       this.novelSinceExtension++;
     }
     this.window.push({ signature: sig, success });
     if (this.window.length > this.cfg.windowSize) this.window.shift();
   }
 
+
   /** A mid-turn steering message arrived — fresh, user-driven work. Grant headroom
    *  (capped at the hard cap, without consuming the extension budget) and clear the
    *  scoring window so the new instruction is never declined by the previous
@@ -239,3 +251,31 @@ export class StepBudget {
     };
   }
 }
+/**
+ * A concise, gjc-style label for a tool call's actual TARGET (file / command / glob) —
+ * not just the bare tool name plus its full argument blob. Two calls that touch the SAME
+ * target (e.g. `edit src/x.ts` twice with different bodies) collapse to the same target
+ * key here even though `hashSignature` of their full arguments differs. Shared by the
+ * budget's novelty rule (below) and `task-tool.ts`'s live subagent monitor label — kept
+ * pure/local (no TUI dependency in the agent layer).
+ */
+export function toolTarget(tool: string, rawArgs: unknown): string {
+  const a = (rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs) ? rawArgs : {}) as Record<string, unknown>;
+  const t = (tool || "").toLowerCase();
+  const str = (...keys: string[]): string => {
+    for (const k of keys) { const v = a[k]; if (typeof v === "string" && v.length > 0) return v; }
+    return "";
+  };
+  if (t === "bash") {
+    const cmd = str("command", "cmd").split("\n")[0]!.trim();
+    return cmd ? `bash: ${cmd.length > 80 ? cmd.slice(0, 79) + "…" : cmd}` : "bash";
+  }
+  if (t === "read" || t === "write" || t === "edit") {
+    const f = str("filePath", "path");
+    return f ? `${t} ${f}` : t;
+  }
+  if (t === "find") { const g = str("globPattern", "pattern"); return g ? `find ${g}` : "find"; }
+  if (t === "search") { const p = str("pattern"); return p ? `search ${p}` : "search"; }
+  if (t === "task") { const r = str("role"); return r ? `task ${r}` : "task"; }
+  return tool || "tool";
+}

package/src/agent/task-tool.ts

@@ -10,6 +10,8 @@
  * `task` itself, so delegation cannot recurse infinitely.
  */
 import { runAgentLoop, type ToolHandler } from "./engine";
+import { toolTarget } from "./step-budget";
+
 import type { ToolResult } from "./tools";
 import type { Message } from "./loop";
 import { loadProjectContext, withProjectContext } from "./context-files";
@@ -146,31 +148,6 @@ export function taskToolProtocolLine(config?: Pick<Config, "subagents">): string
   );
 }
 
-/**
- * A concise, gjc-style label for a subagent's tool call — the actual TARGET (file / command /
- * glob), not just the bare tool name — so the parent's live monitor shows "read src/x.ts" or
- * "bash: bun test" instead of "read"/"bash". Kept local (no TUI dependency in the agent layer).
- */
-function toolTarget(tool: string, rawArgs: unknown): string {
-  const a = (rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs) ? rawArgs : {}) as Record<string, unknown>;
-  const t = (tool || "").toLowerCase();
-  const str = (...keys: string[]): string => {
-    for (const k of keys) { const v = a[k]; if (typeof v === "string" && v.length > 0) return v; }
-    return "";
-  };
-  if (t === "bash") {
-    const cmd = str("command", "cmd").split("\n")[0]!.trim();
-    return cmd ? `bash: ${cmd.length > 80 ? cmd.slice(0, 79) + "…" : cmd}` : "bash";
-  }
-  if (t === "read" || t === "write" || t === "edit") {
-    const f = str("filePath", "path");
-    return f ? `${t} ${f}` : t;
-  }
-  if (t === "find") { const g = str("globPattern", "pattern"); return g ? `find ${g}` : "find"; }
-  if (t === "search") { const p = str("pattern"); return p ? `search ${p}` : "search"; }
-  if (t === "task") { const r = str("role"); return r ? `task ${r}` : "task"; }
-  return tool || "tool";
-}
 
 function firstUsefulLine(output: string | undefined): string {
   if (!output) return "";

package/src/ai/model-catalog.ts

@@ -235,6 +235,32 @@ interface LiveProviderModelRecord {
 }
 const liveProviderModels = new Map<string, LiveProviderModelRecord>();
 
+/** Secondary index for `isLiveProviderModel`: `provider\u0000id` -> the set of
+ *  `liveProviderModels` keys whose row `canonical` or `providerModel` equals that
+ *  id. Keeps the lookup O(1) (average case) instead of an O(n) scan over every
+ *  live-discovered model — the scan previously ran once per STATIC catalog row
+ *  inside `isAutoSelectCandidate` (routingCatalog's OpenAI/`openaiBaseUrl` gate),
+ *  making `routingCatalog()` O(n*m) whenever an aggregator-style base URL (e.g.
+ *  OpenRouter, a local proxy) had discovered hundreds of live models — measured
+ *  ~165ms/call at 2000 live models, on every routed turn.
+ */
+const liveModelIdIndex = new Map<string, Set<string>>();
+
+function liveIndexKey(provider: ProviderName, id: string): string {
+  return `${provider}\u0000${id}`;
+}
+
+function addToLiveIndex(provider: ProviderName, id: string, recordKey: string): void {
+  if (!id) return;
+  const key = liveIndexKey(provider, id);
+  let set = liveModelIdIndex.get(key);
+  if (!set) {
+    set = new Set();
+    liveModelIdIndex.set(key, set);
+  }
+  set.add(recordKey);
+}
+
 function normalizeBaseUrl(baseUrl: string | undefined): string | undefined {
   return baseUrl?.replace(/\/+$/, "");
 }
@@ -302,11 +328,14 @@ export function recordLiveProviderModels(
     const row = known
       ? { ...known, canonical, provider, providerModel }
       : liveModelFallbackRow(provider, canonical, providerModel);
-    liveProviderModels.set(liveModelRecordKey(provider, canonical, baseUrl), {
+    const recordKey = liveModelRecordKey(provider, canonical, baseUrl);
+    liveProviderModels.set(recordKey, {
       row,
       source: opts.source ?? "none",
       baseUrl,
     });
+    addToLiveIndex(provider, canonical, recordKey);
+    addToLiveIndex(provider, providerModel, recordKey);
   }
 }
 
@@ -324,21 +353,30 @@ export function liveProviderCatalogModels(config?: { openaiBaseUrl?: string }):
     .map(record => record.row);
 }
 
-/** True when a model came from the current provider/base URL's live model list. */
+/** True when a model came from the current provider/base URL's live model list.
+ *  O(1) average case via `liveModelIdIndex` — see that Map's doc comment for why
+ *  this must not be an O(n) scan over every live-discovered model (it runs once
+ *  per STATIC catalog row inside `isAutoSelectCandidate`). */
 export function isLiveProviderModel(provider: ProviderName, model: string, config?: { openaiBaseUrl?: string }): boolean {
   const candidates = new Set([model, liveCanonicalId(provider, model), stripProviderPrefix(provider, model)]);
-  return [...liveProviderModels.values()].some(record =>
-    record.row.provider === provider &&
-    liveRecordMatchesConfig(record, config) &&
-    (candidates.has(record.row.canonical) || candidates.has(record.row.providerModel))
-  );
+  for (const candidate of candidates) {
+    const recordKeys = liveModelIdIndex.get(liveIndexKey(provider, candidate));
+    if (!recordKeys) continue;
+    for (const recordKey of recordKeys) {
+      const record = liveProviderModels.get(recordKey);
+      if (record && liveRecordMatchesConfig(record, config)) return true;
+    }
+  }
+  return false;
 }
 
 /** Test-only: clear live provider model supplements. */
 export function resetLiveProviderModels(): void {
   liveProviderModels.clear();
+  liveModelIdIndex.clear();
 }
 
+
 /**
  * Model ids the Kimi Code OAuth backend (api.kimi.com/coding, Anthropic Messages
  * format) actually serves. The subscription endpoint rejects Moonshot API-platform

package/src/commands/launch/input.ts

@@ -415,6 +415,19 @@ export function captureLivePromptInputChunk(state: PromptInputQueue, chunk: stri
   return accepted;
 }
 
+/**
+ * Whether an in-flight readline line buffer (captured right before a hard
+ * exit — Ctrl+D/EOF/disconnected terminal) should be persisted as an unsent
+ * draft (gajae-code "unsent prompt survives /resume" parity). Whitespace-only
+ * or empty input is never a real draft. Pure predicate so the exit-path
+ * wiring in launch.ts (which owns the actual persistence side effect) stays
+ * thin and this decision is independently testable.
+ */
+export function draftFromUnsentLine(line: string | undefined): string | undefined {
+  const trimmed = (line ?? "").trim();
+  return trimmed ? trimmed : undefined;
+}
+
 /**
  * TTY "new input first" contract: fold any queued FULL lines (stray
  * Enter-terminated buffer noise, or older persisted queues) into the editable

package/src/commands/launch.ts

@@ -50,7 +50,7 @@ import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/sta
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
-import { readGoalState, writeGoalState, clearGoalState, verifyGoal } from "../agent/goal-verifier";
+import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
 import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, type PromptTier, type RouteDecision } from "../agent/prompt-router";
 import { RouteHistory } from "../agent/route-history";
 
@@ -110,10 +110,13 @@ import {
   latestSessionId,
   exportSession,
   updateSessionModel,
+  updateSessionDraft,
   appendCompaction,
   resolveSessionRef,
 } from "../agent/session";
-import { clearLine, cursorUp, toColumn, truncate as truncateAnsi, size as terminalSize, resetMouseTracking, clearScreen, clearVisible, clearToEnd, enableModifyOtherKeys, disableModifyOtherKeys, enableKittyKeyboard, disableKittyKeyboard } from "../tui/terminal";
+import { clearLine, cursorUp, toColumn, truncate as truncateAnsi, size as terminalSize, resetMouseTracking, clearScreen, clearVisible, clearToEnd, enableModifyOtherKeys, disableModifyOtherKeys, enableKittyKeyboard, disableKittyKeyboard, setCursorColor, resetCursorColor, isTTY, watchResize } from "../tui/terminal";
+
+
 
 
 import {
@@ -163,6 +166,7 @@ import {
   boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
+  draftFromUnsentLine,
   restoreQueuedLinesToPrefill,
   createInFlightAbortHarness,
   classifyMidTurnLine,
@@ -194,6 +198,8 @@ import {
   contextUsageLines,
   historyViewLines,
 } from "./launch/slash-views";
+import { formatTranscript } from "../tui/components/transcript";
+
 
 import {
   handleUsage,
@@ -262,6 +268,7 @@ export {
   boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
+  draftFromUnsentLine,
   restoreQueuedLinesToPrefill,
   createInFlightAbortHarness,
   classifyMidTurnLine,
@@ -687,6 +694,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let lastUserInput = "";
   // Full untruncated text of the last assistant reply — surfaced in detail by Ctrl+O.
   let lastReply = "";
+  // Unsent draft restored from a NON-interactive resume path (`--resume <id>`,
+  // `--continue`/`-c`) — the interactive-picker and mid-loop `/session resume`
+  // paths feed `queuedPromptInput.partial` directly (declared much later); this
+  // one exists because `queuedPromptInput` isn't in scope yet at startup. Read
+  // once by `queuedPromptInput`'s own initializer below, then not touched again.
+  let startupDraft: string | undefined;
   // Full untruncated output of the most recent tool call — the clipped forge
   // card's `⟦Ctrl+O for more⟧` hint resolves here.
   let lastToolDetail: { tool: string; output: string } | null = null;
@@ -752,17 +765,29 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
   // pi-style session persistence: resume an existing session or create a new one.
   let sessionId: string | undefined;
+  // True once a resume actually restored PRIOR messages (not just an empty
+  // placeholder). Consumed by the "INTERACTIVE mode" welcome-banner block below to
+  // skip the fresh-start clearScreen()+banner render — found live: printing the
+  // resumed transcript ledger here, then unconditionally wiping the screen and
+  // drawing the generic welcome box a few hundred lines later, buried the actual
+  // restored work under a "fresh start" banner instead of leaving it on screen.
+  let resumedWithHistory = false;
+
   let compactionSeq = 0;
   if (!flags.noSession) {
     if (flags.resumeInteractive) {
+
       // Bare `--resume`/`-r` (no value) at cold startup (gjc-parity): the interactive
       // session picker — added right before the REPL loop starts, below — takes over
       // and replaces this session before the user ever sees it, but ONLY in a TTY.
-      // Start with a fresh session here as the safe default either way.
-      sessionId = (await createSession(cwd, undefined, sessionModel)).id;
       if (!process.stdin.isTTY || !process.stdout.isTTY) {
         // No TTY means no picker is possible — fall back to the same silent-latest
-        // behavior as `--continue` rather than silently doing nothing.
+        // behavior as `--continue` rather than silently doing nothing. Resolve the
+        // TRUE latest session BEFORE creating any placeholder session below — creating
+        // one first would make IT the newest-mtime file, permanently masking the real
+        // prior session and turning this fallback into dead code (found live: a bare
+        // `--resume` outside a TTY always "resumed" a fresh empty session instead of
+        // the actual prior one).
         const id = await latestSessionId(cwd);
         if (id) {
           try {
@@ -772,11 +797,35 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             if (!initialSessionModel && header.model) sessionModel = header.model;
             const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
             console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
+            // Reproduce the prior screen exactly (gjc/gajae-code parity): a bare
+            // `--resume` picker with no TTY falls back to the latest session, so
+            // this is the ONLY chance to show the prior work before the REPL
+            // starts — replay it as a scrollback ledger, same formatter `/session
+            // resume` uses mid-session, so a resumed screen always reads like the
+            // exact prior conversation instead of a bare message count.
+            if (messages.length > 0) {
+              resumedWithHistory = true;
+              const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
+              console.log([sep, ...formatTranscript(history, { maxTurns: 6, color: true, unicode: true }), sep].join("\n"));
+            }
+
+
           } catch (err) {
             console.log(`Could not resume ${id}: ${(err as Error).message}. Starting fresh.`);
           }
         }
+        // No prior session to resume (fresh cwd), or the resume attempt above failed —
+        // safe-default fresh session, same as every other "nothing to resume" path.
+        if (!sessionId) {
+          sessionId = (await createSession(cwd, undefined, sessionModel)).id;
+        }
+      } else {
+        // TTY: start with a fresh session as the safe default; the interactive picker
+        // below (right before the REPL loop) takes over and replaces it before the
+        // user ever sees this one, so creating it first here is harmless.
+        sessionId = (await createSession(cwd, undefined, sessionModel)).id;
       }
+
     } else if (flags.resume) {
       let id: string | undefined;
       let skipResume = false;
@@ -808,8 +857,23 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           // Restore the model this session was last using unless the CLI explicitly
           // pinned one (flags.model/role/provider → initialSessionModel wins).
           if (!initialSessionModel && header.model) sessionModel = header.model;
+          // Restore the unsent input-box draft (gajae-code parity) — see
+          // startupDraft's own doc comment for why this path can't feed
+          // queuedPromptInput.partial directly yet.
+          if (header.draft) startupDraft = header.draft;
           const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
           console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
+          // Reproduce the prior screen exactly (gjc/gajae-code parity): same
+          // scrollback-ledger replay `/session resume` uses mid-session, so
+          // `--resume`/`-c`/`--resume <id>` restores the prior work onto the
+          // screen instead of just a bare message count.
+          if (messages.length > 0) {
+            resumedWithHistory = true;
+            const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
+            console.log([sep, ...formatTranscript(history, { maxTurns: 6, color: true, unicode: true }), sep].join("\n"));
+          }
+
+
         } catch (err) {
           console.log(`Could not resume ${id}: ${(err as Error).message}. Starting fresh.`);
           sessionId = (await createSession(cwd, undefined, sessionModel)).id;
@@ -841,6 +905,18 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     } catch { /* best-effort */ }
   };
 
+  // Persist (or clear) the unsent input-box draft into the session header so a
+  // later `/resume` restores it into the prompt (gajae-code parity: an
+  // in-progress prompt survives a quit + resume instead of being silently
+  // lost). Best-effort, same contract as persistSessionModel above — a
+  // header-rewrite failure must never abort the exit path that calls this.
+  const persistSessionDraft = async (draft: string): Promise<void> => {
+    if (flags.noSession || !sessionId) return;
+    try {
+      await updateSessionDraft(sessionId, draft, cwd);
+    } catch { /* best-effort */ }
+  };
+
   // `step N/M` display seed: the explicit --max-steps cap, else the dynamic budget's
   // rolling base — the engine's onBudget event keeps the denominator honest as it grows.
   const initialStepLimit = flags.maxSteps > 0 ? flags.maxSteps : initialDynamicStepLimit();
@@ -1282,7 +1358,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         // Todos checklist used to end a finished turn stuck at "✓0 ◐1 ·4 / 5"
         // because nothing ever forced the model to update item statuses).
         let turnTodos: { title: string; status: string }[] = [];
-        const onBeforeDone = async (reason: string): Promise<string | null> => {
+        const onBeforeDone = async (
+          reason: string,
+          evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean },
+        ): Promise<string | null> => {
           const unfinished = turnTodos.filter(t => t.status !== "done");
           if (turnTodos.length > 0 && unfinished.length > 0) {
             return (
@@ -1304,7 +1383,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             }
 
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
-            const verdict = await verifyGoal(goalState.condition, history, activeModel);
+            const llmVerdict = await verifyGoal(goalState.condition, history, activeModel);
+            // Deterministic downgrade: a fresh MET from the transcript-only LLM
+            // judge still needs mutation/verification evidence to back it up —
+            // see applyEvidenceGate's own docs (goal-verifier.ts). NOT_MET/
+            // IMPOSSIBLE pass through unchanged; this only ever tightens MET.
+            const verdict = applyEvidenceGate(llmVerdict, evidence);
 
             goalState.verdicts.push({
               at: Date.now(),
@@ -1881,18 +1965,28 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     renderWelcome({ ...welcomeData, cols: terminalSize().cols });
   // gjc-style fresh-start clear so the banner opens atop a clean screen. TTY only,
   // never mid-turn (scrollback flood). ponytail: add an opt-out env if anyone misses their scrollback.
-  if (process.stdout.isTTY) process.stdout.write(clearScreen());
-  // Launch sweep: the forge mark's gradient loops seamlessly (default 2 full
-  // cycles, JEO_WELCOME_ANIM_CYCLES overrides), ending on the static banner.
-  // Truecolor TTYs only; JEO_NO_WELCOME_ANIM=1 opts out.
-  const sweepable =
-    !!process.stdout.isTTY &&
-    welcomeTheme.color &&
-    detectColorLevel(process.env, true) === ColorLevel.TrueColor &&
-    jeoEnv("NO_WELCOME_ANIM") !== "1";
-  const sweepCycles = Math.min(10, Math.max(1, Number(jeoEnv("WELCOME_ANIM_CYCLES")) || 2));
-  if (sweepable) await playWelcomeSweep(welcomeData, { cycles: sweepCycles });
-  else console.log(renderWelcome(welcomeData).join("\n"));
+  // SKIPPED on a resume that actually restored prior messages: the transcript ledger
+  // was already printed above (during session persistence, right after "Resumed
+  // session ... (N messages)"), so clearing here would wipe it and the generic
+  // "fresh start" banner below would bury the just-restored work — live-verified via
+  // a real pty run of `--resume <id>`, which showed exactly that: the resumed
+  // conversation flashed on screen then vanished under the welcome box a moment later.
+  if (!resumedWithHistory) {
+    if (process.stdout.isTTY) process.stdout.write(clearScreen());
+    // Launch sweep: the forge mark's gradient loops seamlessly (default 2 full
+    // cycles, JEO_WELCOME_ANIM_CYCLES overrides), ending on the static banner.
+    // Truecolor TTYs only; JEO_NO_WELCOME_ANIM=1 opts out.
+    const sweepable =
+      !!process.stdout.isTTY &&
+      welcomeTheme.color &&
+      detectColorLevel(process.env, true) === ColorLevel.TrueColor &&
+      jeoEnv("NO_WELCOME_ANIM") !== "1";
+    const sweepCycles = Math.min(10, Math.max(1, Number(jeoEnv("WELCOME_ANIM_CYCLES")) || 2));
+    if (sweepable) await playWelcomeSweep(welcomeData, { cycles: sweepCycles });
+    else console.log(renderWelcome(welcomeData).join("\n"));
+  }
+
+
 
   // Surface the "New version" banner reliably: render ONCE from the on-disk cache
   // instantly (no network wait, works offline — the common path after the first
@@ -2182,7 +2276,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // IMMEDIATELY on its next iteration, bypassing the "new input first" prefill contract
   // (the user explicitly invoked them — no second Enter).
   const pendingMidTurnCommands: string[] = [];
-  const queuedPromptInput: PromptInputQueue = { pendingLines: pendingStdinLines, partial: "", pastedLines: [], inPaste: false };
+  const queuedPromptInput: PromptInputQueue = { pendingLines: pendingStdinLines, partial: startupDraft ?? "", pastedLines: [], inPaste: false };
   queueBusyInput = (chunk: string) => captureLivePromptInputChunk(queuedPromptInput, chunk);
   queueBusyPasteActive = () => queuedPromptInput.inPaste;
   queueBusySnapshot = () => ({
@@ -2251,6 +2345,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // hard break, not a graceful `/exit`. Some Bun/tmux paths leave stdin.isTTY
     // false while stdout is still a TTY, so accept either side as interactive.
     if ((process.stdin.isTTY || process.stdout.isTTY || previewEnabled) && !gracefulReadlineClose) {
+      // Best-effort, fire-and-forget: persist whatever's still typed but unsent
+      // (Ctrl+D / EOF / disconnected terminal — no explicit discard gesture, unlike
+      // Ctrl+C's own "clear the box" contract, which stays untouched here) so
+      // `/resume` can restore it (see persistSessionDraft above). Must not block
+      // process.exit() below.
+      const draft = draftFromUnsentLine((rl as unknown as { line?: string }).line);
+      if (draft) void persistSessionDraft(draft);
       hardExitOnLoopEnd = true;
       forceExitFromCtrlC();
     }
@@ -2584,11 +2685,28 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     }
     return out;
   };
+  // Match the REAL terminal cursor's color to the theme accent (OSC 12) so the caret
+  // is never a same-toned block over the input box's typed text — the default terminal
+  // cursor color (usually solid white) otherwise reads as a stray light patch on every
+  // non-mono theme, especially the darker ones, making it hard to spot where typing
+  // lands. Colorless (`mono`) intentionally skips this and any terminal that ignores
+  // OSC 12 (rare) is unaffected either way. Reset on process exit (see below).
+  const applyCursorColor = (): void => {
+    if (isTTY() && uiTheme.color) {
+      try { process.stdout.write(setCursorColor(uiTheme.accent)); } catch { /* terminal gone */ }
+    }
+  };
   const refreshUiTheme = (): void => {
     uiTheme = resolveTheme(process.env);
     uiAccent = accentPaint(uiTheme);
     uiAccentShadow = accentShadowPaint(uiTheme);
+    applyCursorColor();
   };
+  applyCursorColor();
+  process.once("exit", () => {
+    try { process.stdout.write(resetCursorColor()); } catch { /* terminal gone */ }
+  });
+
   // The gjc-layout status bar pinned directly ABOVE the input box: bg-gradient
   // identity block (model · thinking / branch / cwd) left, live ctx% right.
   const statusBarLine = (cols: number): string => {
@@ -2905,7 +3023,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }, 16);
     };
     process.stdout.on("resize", onPickerResize);
+    // Poll-based safety net (same rationale as the idle footer's watchResize): a
+    // picker left open across a missed 'resize' event would otherwise stay pinned
+    // to its opening geometry until a keypress happened to trigger a repaint.
+    const stopPickerResizeWatch = watchResize(() => onPickerResize());
     try {
+
       await new Promise<void>(resolve => {
         const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean; shift?: boolean; sequence?: string } | undefined) => {
           // Same normalization as the footer handler: kitty CSI-u Esc/Ctrl+C must
@@ -2923,7 +3046,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       });
     } finally {
       process.stdout.off("resize", onPickerResize);
+      stopPickerResizeWatch();
       if (resizeTimer) clearTimeout(resizeTimer);
+
       if (process.stdin.setRawMode && !wasRaw) {
         process.stdin.setRawMode(false);
       }
@@ -3676,12 +3801,22 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }, RESIZE_THROTTLE_MS);
     };
     process.stdout.on("resize", idleResizeHandler);
+    // Poll-based safety net: the idle footer sits between turns for most of a
+    // session's wall-clock time, so a missed 'resize' event here (tmux pane switch
+    // while this pane isn't foreground, a SIGCONT race, etc. — see terminal.ts's
+    // watchResize doc) is the single biggest source of "screen stays at its
+    // starting size" reports. Cheap 300ms poll; idleResizeHandler already dedupes
+    // via lastIdleAt/reReserveFooter so this composes safely with the real event.
+    const stopIdleResizeWatch = watchResize(() => idleResizeHandler());
     promptListenerCleanups.push(() => {
       process.stdout.off("resize", idleResizeHandler);
       if (idleResizeTimer) clearTimeout(idleResizeTimer);
+      stopIdleResizeWatch();
     });
   }
 
+
+
   // Bare `--resume`/`-r` (no value) at cold startup (gjc-parity): show the SAME
   // interactive session picker `/session resume` (no arg) uses, in place of the
   // fresh session created above. TTY-only — non-TTY already fell back to
@@ -3695,6 +3830,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     if (pickResult.sessionModel !== undefined) sessionModel = pickResult.sessionModel;
     if (pickResult.lastUserInput !== undefined) lastUserInput = pickResult.lastUserInput;
     if (pickResult.lastReply !== undefined) lastReply = pickResult.lastReply;
+    // Restore the unsent input-box draft left over at last save (gajae-code
+    // parity) — feeds the SAME "new input first" prefill path queued mid-turn
+    // lines already use, so it's visible in the box, Enter to run, Esc/Ctrl+U
+    // to discard, on the very first prompt of this resumed session.
+    if (pickResult.draft) queuedPromptInput.partial = pickResult.draft;
   }
 
   // Remote (Telegram) free-text reply / config command routing — wired here,
@@ -3898,6 +4038,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         if (result.sessionModel !== undefined) sessionModel = result.sessionModel;
         if (result.lastUserInput !== undefined) lastUserInput = result.lastUserInput;
         if (result.lastReply !== undefined) lastReply = result.lastReply;
+        // Restore the unsent input-box draft (see the resumeInteractive call
+        // site above for the full rationale) — `continue` below immediately
+        // re-enters the loop top, which consumes `queuedPromptInput.partial`
+        // as this next prompt's prefill.
+        if (result.draft) queuedPromptInput.partial = result.draft;
         continue;
       }
       if (input === "/retry") {

package/src/tui/app.ts

@@ -11,7 +11,8 @@
  */
 import { Renderer } from "./renderer";
 import { readWorkflowStateStrict } from "../agent/state";
-import { size, isTTY, hideCursor, showCursor, enterAltScreen, leaveAltScreen } from "./terminal";
+import { size, isTTY, hideCursor, showCursor, enterAltScreen, leaveAltScreen, watchResize } from "./terminal";
+
 import { Spinner } from "./components/spinner";
 import { ToolList } from "./components/tool-list";
 import { StreamRegion } from "./components/stream";
@@ -251,6 +252,10 @@ export class LaunchTui {
   private lastResizeAt = 0;
   private lastCols = -1;
   private lastRows = -1;
+  // Stops the poll-based resize safety net (terminal.ts's watchResize) started in
+  // begin(); cleared in finish() alongside the 'resize'/SIGCONT listeners.
+  private stopResizeWatch: (() => void) | undefined;
+
   private pendingIndex: number | null = null;
   private pendingTitle: string | null = null;
   private pendingForge: ForgeSummary | null = null;
@@ -1172,7 +1177,15 @@ export class LaunchTui {
         if (processMax > 0 && resumeCount + 1 >= processMax) process.setMaxListeners(resumeCount + 2);
         process.on("SIGCONT", this.onResume);
       }
+      // Poll-based safety net (terminal.ts's watchResize): catches a resize the TTY
+      // 'resize' event missed (e.g. a tmux pane switch while this pane wasn't the
+      // foreground one — tmux only forwards SIGWINCH to the active pane). Cheap
+      // (300ms comparison poll), fires resizeRepaint() only on an actual geometry
+      // change, and is a no-op alongside a real 'resize' event (whichever notices
+      // first wins; lastCols/lastRows dedupe the other).
+      this.stopResizeWatch = watchResize(() => this.resizeRepaint());
     }
+
     // Animate the spinner + elapsed clock while the model is thinking.
     this.timer = setInterval(() => {
       try {
@@ -1269,7 +1282,12 @@ export class LaunchTui {
       if (process.platform !== "win32") {
         process.removeListener("SIGCONT", this.onResume);
       }
+      if (this.stopResizeWatch) {
+        this.stopResizeWatch();
+        this.stopResizeWatch = undefined;
+      }
     }
+
     if (this.usedAltScreen) {
       // Leave the alt screen (restores the main buffer + scrollback), then print the
       // static summary below the prior output so the turn leaves exactly one record.

package/src/tui/terminal.ts

@@ -84,6 +84,75 @@ export function size(): { cols: number; rows: number } {
     rows: process.stdout.rows || 24,
   };
 }
+/** True live geometry via `getWindowSize()` — a real `TIOCGWINSZ` ioctl through libuv,
+ *  bypassing `process.stdout.columns`/`.rows` entirely. Node/Bun only refresh THOSE
+ *  cached fields when a `'resize'` (SIGWINCH) event fires, which is exactly the signal
+ *  {@link watchResize} exists to work around (tmux pane/window switch while jeo's pane
+ *  isn't foregrounded, a SIGCONT race after Ctrl-Z, an SSH/multiplexer layer that only
+ *  propagates the ioctl update on the next write) — in every one of those, the cached
+ *  fields go stale and NOTHING re-freshes them without a real event. Returns `null` when
+ *  unavailable (older runtimes, non-TTY streams — Bun/Node only expose `getWindowSize`
+ *  on a real `tty.WriteStream`), it throws (handle torn down), or it reports `0,0` (no
+ *  controlling terminal ever set a winsize, e.g. a bare pty as `bun test` sees). */
+function liveWindowSize(): { cols: number; rows: number } | null {
+  const stream = process.stdout as NodeJS.WriteStream & { getWindowSize?: () => [number, number] };
+  if (typeof stream.getWindowSize !== "function") return null;
+  try {
+    const [cols, rows] = stream.getWindowSize();
+    return cols > 0 && rows > 0 ? { cols, rows } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Poll-based resize watcher — a SAFETY NET alongside the TTY `'resize'` event.
+ *  `'resize'` (SIGWINCH) is missed in several real-world cases jeo actually hits: a
+ *  tmux pane/window switch while jeo's pane isn't the foreground one (tmux only
+ *  forwards SIGWINCH to the active pane), a SIGCONT race after Ctrl-Z where the resize
+ *  happened entirely during the stop, and some SSH/multiplexer layers that only
+ *  propagate the ioctl update on the next write rather than emitting a fresh event.
+ *  In every one of these, `process.stdout.columns`/`.rows` (and therefore `size()`)
+ *  go stale and NOTHING short of a real `'resize'` event ever refreshes them — so a
+ *  naive poll comparing `size()` against itself can never observe a change that
+ *  already happened, it would just keep comparing one stale cache to itself.
+ *
+ *  Each tick instead asks the OS DIRECTLY via {@link liveWindowSize} (a cheap,
+ *  allocation-free ioctl — safe every `intervalMs`). When that live read disagrees
+ *  with the last-seen geometry, this SELF-HEALS the stale cache — writing the
+ *  corrected values onto `process.stdout.columns`/`.rows` exactly like Node's own
+ *  SIGWINCH handler would — before firing `onChange`, so every other reader of
+ *  `size()` (the live-frame `draw()`, `resizeRepaint()`, `idleResizeHandler()`, a
+ *  picker's `repaint()`) sees the corrected geometry too, not just this callback.
+ *  When `getWindowSize` is unavailable, falls back to comparing `size()` against
+ *  itself (the pre-existing behavior) — still catches a genuine cache update that
+ *  arrived via some OTHER path (e.g. a real `'resize'` event firing between polls).
+ *  Never fires spuriously — only on an actual geometry change — so it composes
+ *  safely alongside an existing `'resize'` listener (whichever notices first wins,
+ *  the other becomes a no-op once both routes converge on the same geometry).
+ *  Returns a `stop()` to clear the interval; the timer is `unref()`d so it can never
+ *  keep the process alive on its own. */
+export function watchResize(onChange: (cols: number, rows: number) => void, intervalMs = 300): () => void {
+  let last = size();
+  const timer = setInterval(() => {
+    const live = liveWindowSize();
+    const cur = live ?? size();
+    if (cur.cols !== last.cols || cur.rows !== last.rows) {
+      last = cur;
+      if (live) {
+        try {
+          process.stdout.columns = live.cols;
+          process.stdout.rows = live.rows;
+        } catch { /* non-writable in this environment — onChange still fires below */ }
+      }
+      onChange(cur.cols, cur.rows);
+    }
+  }, intervalMs);
+  if (typeof (timer as unknown as { unref?: () => void }).unref === "function") {
+    (timer as unknown as { unref: () => void }).unref();
+  }
+  return () => clearInterval(timer);
+}
+
 
 export function isTTY(): boolean {
   return !!process.stdout.isTTY;
@@ -137,3 +206,23 @@ export function enableKittyKeyboard(): string {
 export function disableKittyKeyboard(): string {
   return `${ESC}<u`;
 }
+/** Set the terminal's TEXT CURSOR color via OSC 12 (`\x1b]12;#rrggbb\x07`) — widely
+ *  supported (xterm, iTerm2, kitty, wezterm, alacritty, ghostty, foot, most tmux/VTE
+ *  terminals). jeo's input box parks the REAL terminal cursor at the caret (see
+ *  `input-box.ts`'s `cursorRow`/`cursorCol`) rather than drawing a fake one, so the
+ *  cursor's on-screen color is entirely up to the terminal's default — usually a
+ *  solid white/light block. On every theme except `mono` (whose panels/prompt already
+ *  render colorless), that default cursor color visually MATCHES the light card
+ *  backgrounds used elsewhere in the UI (e.g. `cardFillPaint`), making the caret
+ *  nearly impossible to spot against typed text. Setting it to the theme's accent hue
+ *  gives the caret a color that's always distinct from body text and panel fills. */
+export function setCursorColor(hex: string): string {
+  return `\x1b]12;${hex}\x07`;
+}
+
+/** Restore the terminal's default cursor color (OSC 112, no color id) — the
+ *  counterpart to {@link setCursorColor}, sent on exit so a shell/editor started
+ *  afterward isn't left with jeo's accent-colored cursor. */
+export function resetCursorColor(): string {
+  return `\x1b]112\x07`;
+}