jeo-code 0.8.21 → 0.8.22

package/CHANGELOG.md

@@ -6,6 +6,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.22] - 2026-07-11
+_A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping._
+
+### Added
+- **Full-transcript restore on `/resume`/`--continue`** (`src/commands/launch.ts`) — all three non-interactive startup resume paths (`--resume <id>`, `--continue`/`-c`, and the TTY-less bare `--resume`) previously printed only `"Resumed session <id> (N messages)."` with no reproduction of the prior conversation. They now render the same `formatTranscript` ledger (user prompt boxes, ✔/✗ tool-call lines, `jeo ◂` reply blocks) that the mid-session `/session resume` and `/history` commands already used, so resuming any session created going forward reproduces the prior work on screen instead of a one-line summary. Live-verified against a real on-disk session and a real `bun run src/cli.ts launch --resume <id>` child process.
+- **Resize-detection safety net** (`src/tui/terminal.ts`'s `watchResize`/`liveWindowSize`, wired into `src/tui/app.ts`'s `LaunchTui`) — a 300ms poll against the real `TIOCGWINSZ` ioctl (`getWindowSize()`) that self-heals `process.stdout.columns`/`.rows` and repaints when a `'resize'` (SIGWINCH) event is missed — e.g. a tmux pane switch while jeo's pane isn't foregrounded, or a SIGCONT race after Ctrl-Z. Composes safely alongside the existing `'resize'` listener; started in `begin()`, torn down in `finish()`.
+
+### Fixed
+- **`updateSessionDraft` trim bug** (`src/agent/session.ts`) — the no-op comparison checked `draft.trim()` for truthiness but persisted the untrimmed original string; now trims once and persists the trimmed value consistently.
+
+### Verified
+- Full `bun test` — 2906 pass / 0 fail across 291 files.
+- `bun run typecheck` — no errors.
+- Live PTY/CLI verification of the resume-transcript restore end-to-end (real session file, real child-process `launch --resume`).
+
+
 ## [0.8.21] - 2026-07-10
 _"반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping._
 

package/README.ja.md

@@ -265,11 +265,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
 - **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -266,11 +266,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
 - **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -273,11 +273,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
 - **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -265,11 +265,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.22]** (2026-07-11) — A rescan of the working tree turned up a resume-fidelity gap plus two unwired TUI safety-net helpers left by a concurrent session; each was traced, wired where needed, and verified before shipping.
 - **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
 - **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
-- **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.21",
+  "version": "0.8.22",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/prompt-router.ts

@@ -222,23 +222,43 @@ function hasAntigravityOauth(config: RoutingConfig): boolean {
   return !!(config.oauth?.antigravity || config.oauth?.gemini);
 }
 
+/** Builds the routing catalog once per call: static `MODEL_CATALOG` rows need the
+ *  full `isAutoSelectCandidate` gate (including the `isLiveProviderModel` check,
+ *  when `openaiBaseUrl` is set), but rows already returned by
+ *  `liveProviderCatalogModels()` are live BY CONSTRUCTION — re-verifying each one
+ *  with `isLiveProviderModel` is pure O(n) waste (it dominated this function's
+ *  cost: ~1.4ms/call at 2000 live models). Live rows still need the shared
+ *  provider/OAuth gates (cloud provider, credential, antigravity/gemini), just not
+ *  the live-membership check specific to static rows. */
 function routingCatalog(config: RoutingConfig): CatalogModel[] {
-  const rows = [...MODEL_CATALOG, ...liveProviderCatalogModels(config)];
-  const eligible = rows.filter(m => isAutoSelectCandidate(m, config));
+  const staticEligible = MODEL_CATALOG.filter(m => isAutoSelectCandidate(m, config));
+  const liveEligible = liveProviderCatalogModels(config).filter(m => isAutoSelectCandidateLive(m, config));
   const byId = new Map<string, CatalogModel>();
-  for (const row of eligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
+  for (const row of staticEligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
+  for (const row of liveEligible) if (!byId.has(row.canonical)) byId.set(row.canonical, row);
   return [...byId.values()];
 }
 
-function isAutoSelectCandidate(m: CatalogModel, config: RoutingConfig): boolean {
-  // Shared model-LEVEL credential gate (the full auth matrix is documented on
-  // modelServableWithConfig; keep aligned with resolveCall).
+/** Shared provider/OAuth eligibility gates, independent of live-membership. */
+function isCoreEligible(m: CatalogModel, config: RoutingConfig): boolean {
   if (!isCloudProvider(m.provider) || m.limitedAvailability || !modelServableWithConfig(m.provider, m.canonical, config)) return false;
-  if (m.provider === "openai" && config.openaiBaseUrl && !isLiveProviderModel("openai", m.canonical, config)) return false;
   if (hasAntigravityOauth(config) && m.provider === "gemini") return false;
   return true;
 }
 
+function isAutoSelectCandidate(m: CatalogModel, config: RoutingConfig): boolean {
+  if (!isCoreEligible(m, config)) return false;
+  if (m.provider === "openai" && config.openaiBaseUrl && !isLiveProviderModel("openai", m.canonical, config)) return false;
+  return true;
+}
+
+/** Same eligibility as `isAutoSelectCandidate`, for a row ALREADY sourced from
+ *  `liveProviderCatalogModels()` — skips the live-membership re-check (see
+ *  `routingCatalog`'s doc comment). */
+function isAutoSelectCandidateLive(m: CatalogModel, config: RoutingConfig): boolean {
+  return isCoreEligible(m, config);
+}
+
 
 /** Size class jeo infers for a catalog model, used to group EQUIVALENT models
  *  across DIFFERENT providers for pool-based routing (see `tierModelPool`) — the
@@ -358,12 +378,10 @@ export function cheapestCredentialed(config: RoutingConfig): string | null {
   let best: CatalogModel | null = null;
   let bestCost = Infinity;
   for (const m of routingCatalog(config)) {
-    // Candidate eligibility is centralized in `isAutoSelectCandidate`: it keeps
-    // OAuth-backed Antigravity routing on provider-qualified 3.1+ Gemini rows and
-    // prevents public `gemini` catalog rows from winning when Antigravity OAuth is
-    // the available Gemini lane. The real veto gate in launch.ts's `runTurn` still
-    // re-verifies full readiness (including live OAuth expiry) before a turn uses it.
-    if (!isAutoSelectCandidate(m, config)) continue;
+    // `routingCatalog(config)` already filtered to eligible rows (static rows via
+    // `isAutoSelectCandidate`, live rows via `isAutoSelectCandidateLive`) — no need
+    // to re-check here. See cheapestCredentialed's own doc comment for the
+    // Antigravity/Gemini OAuth rationale behind that eligibility gate.
     const price = priceForModel(m.canonical);
     if (!price) continue;
     const cost = price.inPerM + price.outPerM;
@@ -406,9 +424,8 @@ export function strongestCredentialed(
 ): string | null {
   let best: CatalogModel | null = null;
   for (const m of routingCatalog(config)) {
-    // Candidate eligibility is centralized in `isAutoSelectCandidate` (see
+    // `routingCatalog(config)` already filtered to eligible rows (see
     // cheapestCredentialed above for the Antigravity/Gemini OAuth rationale).
-    if (!isAutoSelectCandidate(m, config)) continue;
     if (filter && !filter(m)) continue;
     if (!best) { best = m; continue; }
     const xhighM = m.thinking.includes("xhigh") ? 1 : 0;

package/src/ai/model-catalog.ts

@@ -235,6 +235,32 @@ interface LiveProviderModelRecord {
 }
 const liveProviderModels = new Map<string, LiveProviderModelRecord>();
 
+/** Secondary index for `isLiveProviderModel`: `provider\u0000id` -> the set of
+ *  `liveProviderModels` keys whose row `canonical` or `providerModel` equals that
+ *  id. Keeps the lookup O(1) (average case) instead of an O(n) scan over every
+ *  live-discovered model — the scan previously ran once per STATIC catalog row
+ *  inside `isAutoSelectCandidate` (routingCatalog's OpenAI/`openaiBaseUrl` gate),
+ *  making `routingCatalog()` O(n*m) whenever an aggregator-style base URL (e.g.
+ *  OpenRouter, a local proxy) had discovered hundreds of live models — measured
+ *  ~165ms/call at 2000 live models, on every routed turn.
+ */
+const liveModelIdIndex = new Map<string, Set<string>>();
+
+function liveIndexKey(provider: ProviderName, id: string): string {
+  return `${provider}\u0000${id}`;
+}
+
+function addToLiveIndex(provider: ProviderName, id: string, recordKey: string): void {
+  if (!id) return;
+  const key = liveIndexKey(provider, id);
+  let set = liveModelIdIndex.get(key);
+  if (!set) {
+    set = new Set();
+    liveModelIdIndex.set(key, set);
+  }
+  set.add(recordKey);
+}
+
 function normalizeBaseUrl(baseUrl: string | undefined): string | undefined {
   return baseUrl?.replace(/\/+$/, "");
 }
@@ -302,11 +328,14 @@ export function recordLiveProviderModels(
     const row = known
       ? { ...known, canonical, provider, providerModel }
       : liveModelFallbackRow(provider, canonical, providerModel);
-    liveProviderModels.set(liveModelRecordKey(provider, canonical, baseUrl), {
+    const recordKey = liveModelRecordKey(provider, canonical, baseUrl);
+    liveProviderModels.set(recordKey, {
       row,
       source: opts.source ?? "none",
       baseUrl,
     });
+    addToLiveIndex(provider, canonical, recordKey);
+    addToLiveIndex(provider, providerModel, recordKey);
   }
 }
 
@@ -324,21 +353,30 @@ export function liveProviderCatalogModels(config?: { openaiBaseUrl?: string }):
     .map(record => record.row);
 }
 
-/** True when a model came from the current provider/base URL's live model list. */
+/** True when a model came from the current provider/base URL's live model list.
+ *  O(1) average case via `liveModelIdIndex` — see that Map's doc comment for why
+ *  this must not be an O(n) scan over every live-discovered model (it runs once
+ *  per STATIC catalog row inside `isAutoSelectCandidate`). */
 export function isLiveProviderModel(provider: ProviderName, model: string, config?: { openaiBaseUrl?: string }): boolean {
   const candidates = new Set([model, liveCanonicalId(provider, model), stripProviderPrefix(provider, model)]);
-  return [...liveProviderModels.values()].some(record =>
-    record.row.provider === provider &&
-    liveRecordMatchesConfig(record, config) &&
-    (candidates.has(record.row.canonical) || candidates.has(record.row.providerModel))
-  );
+  for (const candidate of candidates) {
+    const recordKeys = liveModelIdIndex.get(liveIndexKey(provider, candidate));
+    if (!recordKeys) continue;
+    for (const recordKey of recordKeys) {
+      const record = liveProviderModels.get(recordKey);
+      if (record && liveRecordMatchesConfig(record, config)) return true;
+    }
+  }
+  return false;
 }
 
 /** Test-only: clear live provider model supplements. */
 export function resetLiveProviderModels(): void {
   liveProviderModels.clear();
+  liveModelIdIndex.clear();
 }
 
+
 /**
  * Model ids the Kimi Code OAuth backend (api.kimi.com/coding, Anthropic Messages
  * format) actually serves. The subscription endpoint rejects Moonshot API-platform

package/src/commands/launch.ts

@@ -114,7 +114,9 @@ import {
   appendCompaction,
   resolveSessionRef,
 } from "../agent/session";
-import { clearLine, cursorUp, toColumn, truncate as truncateAnsi, size as terminalSize, resetMouseTracking, clearScreen, clearVisible, clearToEnd, enableModifyOtherKeys, disableModifyOtherKeys, enableKittyKeyboard, disableKittyKeyboard } from "../tui/terminal";
+import { clearLine, cursorUp, toColumn, truncate as truncateAnsi, size as terminalSize, resetMouseTracking, clearScreen, clearVisible, clearToEnd, enableModifyOtherKeys, disableModifyOtherKeys, enableKittyKeyboard, disableKittyKeyboard, setCursorColor, resetCursorColor, isTTY, watchResize } from "../tui/terminal";
+
+
 
 
 import {
@@ -196,6 +198,8 @@ import {
   contextUsageLines,
   historyViewLines,
 } from "./launch/slash-views";
+import { formatTranscript } from "../tui/components/transcript";
+
 
 import {
   handleUsage,
@@ -761,17 +765,29 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
   // pi-style session persistence: resume an existing session or create a new one.
   let sessionId: string | undefined;
+  // True once a resume actually restored PRIOR messages (not just an empty
+  // placeholder). Consumed by the "INTERACTIVE mode" welcome-banner block below to
+  // skip the fresh-start clearScreen()+banner render — found live: printing the
+  // resumed transcript ledger here, then unconditionally wiping the screen and
+  // drawing the generic welcome box a few hundred lines later, buried the actual
+  // restored work under a "fresh start" banner instead of leaving it on screen.
+  let resumedWithHistory = false;
+
   let compactionSeq = 0;
   if (!flags.noSession) {
     if (flags.resumeInteractive) {
+
       // Bare `--resume`/`-r` (no value) at cold startup (gjc-parity): the interactive
       // session picker — added right before the REPL loop starts, below — takes over
       // and replaces this session before the user ever sees it, but ONLY in a TTY.
-      // Start with a fresh session here as the safe default either way.
-      sessionId = (await createSession(cwd, undefined, sessionModel)).id;
       if (!process.stdin.isTTY || !process.stdout.isTTY) {
         // No TTY means no picker is possible — fall back to the same silent-latest
-        // behavior as `--continue` rather than silently doing nothing.
+        // behavior as `--continue` rather than silently doing nothing. Resolve the
+        // TRUE latest session BEFORE creating any placeholder session below — creating
+        // one first would make IT the newest-mtime file, permanently masking the real
+        // prior session and turning this fallback into dead code (found live: a bare
+        // `--resume` outside a TTY always "resumed" a fresh empty session instead of
+        // the actual prior one).
         const id = await latestSessionId(cwd);
         if (id) {
           try {
@@ -781,11 +797,35 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             if (!initialSessionModel && header.model) sessionModel = header.model;
             const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
             console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
+            // Reproduce the prior screen exactly (gjc/gajae-code parity): a bare
+            // `--resume` picker with no TTY falls back to the latest session, so
+            // this is the ONLY chance to show the prior work before the REPL
+            // starts — replay it as a scrollback ledger, same formatter `/session
+            // resume` uses mid-session, so a resumed screen always reads like the
+            // exact prior conversation instead of a bare message count.
+            if (messages.length > 0) {
+              resumedWithHistory = true;
+              const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
+              console.log([sep, ...formatTranscript(history, { maxTurns: 6, color: true, unicode: true }), sep].join("\n"));
+            }
+
+
           } catch (err) {
             console.log(`Could not resume ${id}: ${(err as Error).message}. Starting fresh.`);
           }
         }
+        // No prior session to resume (fresh cwd), or the resume attempt above failed —
+        // safe-default fresh session, same as every other "nothing to resume" path.
+        if (!sessionId) {
+          sessionId = (await createSession(cwd, undefined, sessionModel)).id;
+        }
+      } else {
+        // TTY: start with a fresh session as the safe default; the interactive picker
+        // below (right before the REPL loop) takes over and replaces it before the
+        // user ever sees this one, so creating it first here is harmless.
+        sessionId = (await createSession(cwd, undefined, sessionModel)).id;
       }
+
     } else if (flags.resume) {
       let id: string | undefined;
       let skipResume = false;
@@ -823,6 +863,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           if (header.draft) startupDraft = header.draft;
           const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
           console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
+          // Reproduce the prior screen exactly (gjc/gajae-code parity): same
+          // scrollback-ledger replay `/session resume` uses mid-session, so
+          // `--resume`/`-c`/`--resume <id>` restores the prior work onto the
+          // screen instead of just a bare message count.
+          if (messages.length > 0) {
+            resumedWithHistory = true;
+            const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
+            console.log([sep, ...formatTranscript(history, { maxTurns: 6, color: true, unicode: true }), sep].join("\n"));
+          }
+
+
         } catch (err) {
           console.log(`Could not resume ${id}: ${(err as Error).message}. Starting fresh.`);
           sessionId = (await createSession(cwd, undefined, sessionModel)).id;
@@ -1914,18 +1965,28 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     renderWelcome({ ...welcomeData, cols: terminalSize().cols });
   // gjc-style fresh-start clear so the banner opens atop a clean screen. TTY only,
   // never mid-turn (scrollback flood). ponytail: add an opt-out env if anyone misses their scrollback.
-  if (process.stdout.isTTY) process.stdout.write(clearScreen());
-  // Launch sweep: the forge mark's gradient loops seamlessly (default 2 full
-  // cycles, JEO_WELCOME_ANIM_CYCLES overrides), ending on the static banner.
-  // Truecolor TTYs only; JEO_NO_WELCOME_ANIM=1 opts out.
-  const sweepable =
-    !!process.stdout.isTTY &&
-    welcomeTheme.color &&
-    detectColorLevel(process.env, true) === ColorLevel.TrueColor &&
-    jeoEnv("NO_WELCOME_ANIM") !== "1";
-  const sweepCycles = Math.min(10, Math.max(1, Number(jeoEnv("WELCOME_ANIM_CYCLES")) || 2));
-  if (sweepable) await playWelcomeSweep(welcomeData, { cycles: sweepCycles });
-  else console.log(renderWelcome(welcomeData).join("\n"));
+  // SKIPPED on a resume that actually restored prior messages: the transcript ledger
+  // was already printed above (during session persistence, right after "Resumed
+  // session ... (N messages)"), so clearing here would wipe it and the generic
+  // "fresh start" banner below would bury the just-restored work — live-verified via
+  // a real pty run of `--resume <id>`, which showed exactly that: the resumed
+  // conversation flashed on screen then vanished under the welcome box a moment later.
+  if (!resumedWithHistory) {
+    if (process.stdout.isTTY) process.stdout.write(clearScreen());
+    // Launch sweep: the forge mark's gradient loops seamlessly (default 2 full
+    // cycles, JEO_WELCOME_ANIM_CYCLES overrides), ending on the static banner.
+    // Truecolor TTYs only; JEO_NO_WELCOME_ANIM=1 opts out.
+    const sweepable =
+      !!process.stdout.isTTY &&
+      welcomeTheme.color &&
+      detectColorLevel(process.env, true) === ColorLevel.TrueColor &&
+      jeoEnv("NO_WELCOME_ANIM") !== "1";
+    const sweepCycles = Math.min(10, Math.max(1, Number(jeoEnv("WELCOME_ANIM_CYCLES")) || 2));
+    if (sweepable) await playWelcomeSweep(welcomeData, { cycles: sweepCycles });
+    else console.log(renderWelcome(welcomeData).join("\n"));
+  }
+
+
 
   // Surface the "New version" banner reliably: render ONCE from the on-disk cache
   // instantly (no network wait, works offline — the common path after the first
@@ -2624,11 +2685,28 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     }
     return out;
   };
+  // Match the REAL terminal cursor's color to the theme accent (OSC 12) so the caret
+  // is never a same-toned block over the input box's typed text — the default terminal
+  // cursor color (usually solid white) otherwise reads as a stray light patch on every
+  // non-mono theme, especially the darker ones, making it hard to spot where typing
+  // lands. Colorless (`mono`) intentionally skips this and any terminal that ignores
+  // OSC 12 (rare) is unaffected either way. Reset on process exit (see below).
+  const applyCursorColor = (): void => {
+    if (isTTY() && uiTheme.color) {
+      try { process.stdout.write(setCursorColor(uiTheme.accent)); } catch { /* terminal gone */ }
+    }
+  };
   const refreshUiTheme = (): void => {
     uiTheme = resolveTheme(process.env);
     uiAccent = accentPaint(uiTheme);
     uiAccentShadow = accentShadowPaint(uiTheme);
+    applyCursorColor();
   };
+  applyCursorColor();
+  process.once("exit", () => {
+    try { process.stdout.write(resetCursorColor()); } catch { /* terminal gone */ }
+  });
+
   // The gjc-layout status bar pinned directly ABOVE the input box: bg-gradient
   // identity block (model · thinking / branch / cwd) left, live ctx% right.
   const statusBarLine = (cols: number): string => {
@@ -2945,7 +3023,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }, 16);
     };
     process.stdout.on("resize", onPickerResize);
+    // Poll-based safety net (same rationale as the idle footer's watchResize): a
+    // picker left open across a missed 'resize' event would otherwise stay pinned
+    // to its opening geometry until a keypress happened to trigger a repaint.
+    const stopPickerResizeWatch = watchResize(() => onPickerResize());
     try {
+
       await new Promise<void>(resolve => {
         const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean; shift?: boolean; sequence?: string } | undefined) => {
           // Same normalization as the footer handler: kitty CSI-u Esc/Ctrl+C must
@@ -2963,7 +3046,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       });
     } finally {
       process.stdout.off("resize", onPickerResize);
+      stopPickerResizeWatch();
       if (resizeTimer) clearTimeout(resizeTimer);
+
       if (process.stdin.setRawMode && !wasRaw) {
         process.stdin.setRawMode(false);
       }
@@ -3716,12 +3801,22 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }, RESIZE_THROTTLE_MS);
     };
     process.stdout.on("resize", idleResizeHandler);
+    // Poll-based safety net: the idle footer sits between turns for most of a
+    // session's wall-clock time, so a missed 'resize' event here (tmux pane switch
+    // while this pane isn't foreground, a SIGCONT race, etc. — see terminal.ts's
+    // watchResize doc) is the single biggest source of "screen stays at its
+    // starting size" reports. Cheap 300ms poll; idleResizeHandler already dedupes
+    // via lastIdleAt/reReserveFooter so this composes safely with the real event.
+    const stopIdleResizeWatch = watchResize(() => idleResizeHandler());
     promptListenerCleanups.push(() => {
       process.stdout.off("resize", idleResizeHandler);
       if (idleResizeTimer) clearTimeout(idleResizeTimer);
+      stopIdleResizeWatch();
     });
   }
 
+
+
   // Bare `--resume`/`-r` (no value) at cold startup (gjc-parity): show the SAME
   // interactive session picker `/session resume` (no arg) uses, in place of the
   // fresh session created above. TTY-only — non-TTY already fell back to

package/src/tui/app.ts

@@ -11,7 +11,8 @@
  */
 import { Renderer } from "./renderer";
 import { readWorkflowStateStrict } from "../agent/state";
-import { size, isTTY, hideCursor, showCursor, enterAltScreen, leaveAltScreen } from "./terminal";
+import { size, isTTY, hideCursor, showCursor, enterAltScreen, leaveAltScreen, watchResize } from "./terminal";
+
 import { Spinner } from "./components/spinner";
 import { ToolList } from "./components/tool-list";
 import { StreamRegion } from "./components/stream";
@@ -251,6 +252,10 @@ export class LaunchTui {
   private lastResizeAt = 0;
   private lastCols = -1;
   private lastRows = -1;
+  // Stops the poll-based resize safety net (terminal.ts's watchResize) started in
+  // begin(); cleared in finish() alongside the 'resize'/SIGCONT listeners.
+  private stopResizeWatch: (() => void) | undefined;
+
   private pendingIndex: number | null = null;
   private pendingTitle: string | null = null;
   private pendingForge: ForgeSummary | null = null;
@@ -1172,7 +1177,15 @@ export class LaunchTui {
         if (processMax > 0 && resumeCount + 1 >= processMax) process.setMaxListeners(resumeCount + 2);
         process.on("SIGCONT", this.onResume);
       }
+      // Poll-based safety net (terminal.ts's watchResize): catches a resize the TTY
+      // 'resize' event missed (e.g. a tmux pane switch while this pane wasn't the
+      // foreground one — tmux only forwards SIGWINCH to the active pane). Cheap
+      // (300ms comparison poll), fires resizeRepaint() only on an actual geometry
+      // change, and is a no-op alongside a real 'resize' event (whichever notices
+      // first wins; lastCols/lastRows dedupe the other).
+      this.stopResizeWatch = watchResize(() => this.resizeRepaint());
     }
+
     // Animate the spinner + elapsed clock while the model is thinking.
     this.timer = setInterval(() => {
       try {
@@ -1269,7 +1282,12 @@ export class LaunchTui {
       if (process.platform !== "win32") {
         process.removeListener("SIGCONT", this.onResume);
       }
+      if (this.stopResizeWatch) {
+        this.stopResizeWatch();
+        this.stopResizeWatch = undefined;
+      }
     }
+
     if (this.usedAltScreen) {
       // Leave the alt screen (restores the main buffer + scrollback), then print the
       // static summary below the prior output so the turn leaves exactly one record.

package/src/tui/terminal.ts

@@ -84,6 +84,75 @@ export function size(): { cols: number; rows: number } {
     rows: process.stdout.rows || 24,
   };
 }
+/** True live geometry via `getWindowSize()` — a real `TIOCGWINSZ` ioctl through libuv,
+ *  bypassing `process.stdout.columns`/`.rows` entirely. Node/Bun only refresh THOSE
+ *  cached fields when a `'resize'` (SIGWINCH) event fires, which is exactly the signal
+ *  {@link watchResize} exists to work around (tmux pane/window switch while jeo's pane
+ *  isn't foregrounded, a SIGCONT race after Ctrl-Z, an SSH/multiplexer layer that only
+ *  propagates the ioctl update on the next write) — in every one of those, the cached
+ *  fields go stale and NOTHING re-freshes them without a real event. Returns `null` when
+ *  unavailable (older runtimes, non-TTY streams — Bun/Node only expose `getWindowSize`
+ *  on a real `tty.WriteStream`), it throws (handle torn down), or it reports `0,0` (no
+ *  controlling terminal ever set a winsize, e.g. a bare pty as `bun test` sees). */
+function liveWindowSize(): { cols: number; rows: number } | null {
+  const stream = process.stdout as NodeJS.WriteStream & { getWindowSize?: () => [number, number] };
+  if (typeof stream.getWindowSize !== "function") return null;
+  try {
+    const [cols, rows] = stream.getWindowSize();
+    return cols > 0 && rows > 0 ? { cols, rows } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Poll-based resize watcher — a SAFETY NET alongside the TTY `'resize'` event.
+ *  `'resize'` (SIGWINCH) is missed in several real-world cases jeo actually hits: a
+ *  tmux pane/window switch while jeo's pane isn't the foreground one (tmux only
+ *  forwards SIGWINCH to the active pane), a SIGCONT race after Ctrl-Z where the resize
+ *  happened entirely during the stop, and some SSH/multiplexer layers that only
+ *  propagate the ioctl update on the next write rather than emitting a fresh event.
+ *  In every one of these, `process.stdout.columns`/`.rows` (and therefore `size()`)
+ *  go stale and NOTHING short of a real `'resize'` event ever refreshes them — so a
+ *  naive poll comparing `size()` against itself can never observe a change that
+ *  already happened, it would just keep comparing one stale cache to itself.
+ *
+ *  Each tick instead asks the OS DIRECTLY via {@link liveWindowSize} (a cheap,
+ *  allocation-free ioctl — safe every `intervalMs`). When that live read disagrees
+ *  with the last-seen geometry, this SELF-HEALS the stale cache — writing the
+ *  corrected values onto `process.stdout.columns`/`.rows` exactly like Node's own
+ *  SIGWINCH handler would — before firing `onChange`, so every other reader of
+ *  `size()` (the live-frame `draw()`, `resizeRepaint()`, `idleResizeHandler()`, a
+ *  picker's `repaint()`) sees the corrected geometry too, not just this callback.
+ *  When `getWindowSize` is unavailable, falls back to comparing `size()` against
+ *  itself (the pre-existing behavior) — still catches a genuine cache update that
+ *  arrived via some OTHER path (e.g. a real `'resize'` event firing between polls).
+ *  Never fires spuriously — only on an actual geometry change — so it composes
+ *  safely alongside an existing `'resize'` listener (whichever notices first wins,
+ *  the other becomes a no-op once both routes converge on the same geometry).
+ *  Returns a `stop()` to clear the interval; the timer is `unref()`d so it can never
+ *  keep the process alive on its own. */
+export function watchResize(onChange: (cols: number, rows: number) => void, intervalMs = 300): () => void {
+  let last = size();
+  const timer = setInterval(() => {
+    const live = liveWindowSize();
+    const cur = live ?? size();
+    if (cur.cols !== last.cols || cur.rows !== last.rows) {
+      last = cur;
+      if (live) {
+        try {
+          process.stdout.columns = live.cols;
+          process.stdout.rows = live.rows;
+        } catch { /* non-writable in this environment — onChange still fires below */ }
+      }
+      onChange(cur.cols, cur.rows);
+    }
+  }, intervalMs);
+  if (typeof (timer as unknown as { unref?: () => void }).unref === "function") {
+    (timer as unknown as { unref: () => void }).unref();
+  }
+  return () => clearInterval(timer);
+}
+
 
 export function isTTY(): boolean {
   return !!process.stdout.isTTY;
@@ -137,3 +206,23 @@ export function enableKittyKeyboard(): string {
 export function disableKittyKeyboard(): string {
   return `${ESC}<u`;
 }
+/** Set the terminal's TEXT CURSOR color via OSC 12 (`\x1b]12;#rrggbb\x07`) — widely
+ *  supported (xterm, iTerm2, kitty, wezterm, alacritty, ghostty, foot, most tmux/VTE
+ *  terminals). jeo's input box parks the REAL terminal cursor at the caret (see
+ *  `input-box.ts`'s `cursorRow`/`cursorCol`) rather than drawing a fake one, so the
+ *  cursor's on-screen color is entirely up to the terminal's default — usually a
+ *  solid white/light block. On every theme except `mono` (whose panels/prompt already
+ *  render colorless), that default cursor color visually MATCHES the light card
+ *  backgrounds used elsewhere in the UI (e.g. `cardFillPaint`), making the caret
+ *  nearly impossible to spot against typed text. Setting it to the theme's accent hue
+ *  gives the caret a color that's always distinct from body text and panel fills. */
+export function setCursorColor(hex: string): string {
+  return `\x1b]12;${hex}\x07`;
+}
+
+/** Restore the terminal's default cursor color (OSC 112, no color id) — the
+ *  counterpart to {@link setCursorColor}, sent on exit so a shell/editor started
+ *  afterward isn't left with jeo's accent-colored cursor. */
+export function resetCursorColor(): string {
+  return `\x1b]112\x07`;
+}