jeo-code 0.8.21 → 0.8.23

package/src/cli/runner.ts

@@ -119,11 +119,23 @@ export const COMMANDS: readonly CommandSpec[] = [
       return args => m.runDaemonCommand(args);
     },
   },
+  {
+    name: "routine",
+    summary: "Generate a GitHub Actions workflow that runs jeo headlessly on a schedule or repo event.",
+    usage: 'routine init --trigger <schedule|issues|pull_request> --prompt "<task>" [--cron <expr>] [--name <name>] [--out <path>] [--no-pr] [--force] [--dry-run] [--json]',
+    loader: async () => {
+      // Dynamic import: lazy-loaded command registry entry (CommandSpec.loader
+      // contract), matching every other entry in this array — avoids eagerly
+      // importing all ~25 command modules at CLI startup.
+      const m = await import("../commands/routine");
+      return args => m.runRoutineCommand(args);
+    },
+  },
 
   {
     name: "skills",
     summary: "List bundled workflow skills, or sync them into ~/.jeo/skills (jeo skills <name> for details).",
-    usage: "skills [list|read <name>|sync [--check|--force] [dir]|--write [dir]] [--json]",
+    usage: "skills [list|read <name>|sync [--check|--force] [dir]|--write [dir]|lesson <skill> <failure|anti-pattern> \"<title>\" \"<detail>\"|eval <skill>] [--json]",
     loader: async () => {
       const m = await import("../commands/skills");
       return args => m.runSkillsCommand(args);

package/src/commands/launch.ts

@@ -8,6 +8,7 @@ import { executeComputerAction } from "./computer";
 import { createOpikTracer, wrapEvents } from "../agent/opik-tracer";
 import { initialDynamicStepLimit } from "../agent/step-budget";
 import { memoryPromptSection, spawnDetachedDistill, recordFailedAttempt } from "../agent/memory";
+import { recordSkillLesson } from "../agent/skill-lessons";
 import { createTaskTool, taskToolProtocolLine, type TaskSubEvent } from "../agent/task-tool";
 import { createSubagentTool, SUBAGENT_TOOL_PROTOCOL_LINE } from "../agent/subagent-tool";
 import { SubagentRegistry } from "../agent/subagent-registry";
@@ -51,7 +52,7 @@ import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recen
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
-import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, type PromptTier, type RouteDecision } from "../agent/prompt-router";
+import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, credentialScopeFor, resolveVerifierModel, type PromptTier, type RouteDecision, type RoutingConfig } from "../agent/prompt-router";
 import { RouteHistory } from "../agent/route-history";
 
 import { isRateLimitError, isUsageLimitError, isConnectionError } from "../util/retry";
@@ -114,7 +115,9 @@ import {
   appendCompaction,
   resolveSessionRef,
 } from "../agent/session";
-import { clearLine, cursorUp, toColumn, truncate as truncateAnsi, size as terminalSize, resetMouseTracking, clearScreen, clearVisible, clearToEnd, enableModifyOtherKeys, disableModifyOtherKeys, enableKittyKeyboard, disableKittyKeyboard } from "../tui/terminal";
+import { clearLine, cursorUp, toColumn, truncate as truncateAnsi, size as terminalSize, resetMouseTracking, clearScreen, clearVisible, clearToEnd, enableModifyOtherKeys, disableModifyOtherKeys, enableKittyKeyboard, disableKittyKeyboard, setCursorColor, resetCursorColor, isTTY, watchResize } from "../tui/terminal";
+
+
 
 
 import {
@@ -196,6 +199,8 @@ import {
   contextUsageLines,
   historyViewLines,
 } from "./launch/slash-views";
+import { formatTranscript } from "../tui/components/transcript";
+
 
 import {
   handleUsage,
@@ -761,17 +766,29 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
   // pi-style session persistence: resume an existing session or create a new one.
   let sessionId: string | undefined;
+  // True once a resume actually restored PRIOR messages (not just an empty
+  // placeholder). Consumed by the "INTERACTIVE mode" welcome-banner block below to
+  // skip the fresh-start clearScreen()+banner render — found live: printing the
+  // resumed transcript ledger here, then unconditionally wiping the screen and
+  // drawing the generic welcome box a few hundred lines later, buried the actual
+  // restored work under a "fresh start" banner instead of leaving it on screen.
+  let resumedWithHistory = false;
+
   let compactionSeq = 0;
   if (!flags.noSession) {
     if (flags.resumeInteractive) {
+
       // Bare `--resume`/`-r` (no value) at cold startup (gjc-parity): the interactive
       // session picker — added right before the REPL loop starts, below — takes over
       // and replaces this session before the user ever sees it, but ONLY in a TTY.
-      // Start with a fresh session here as the safe default either way.
-      sessionId = (await createSession(cwd, undefined, sessionModel)).id;
       if (!process.stdin.isTTY || !process.stdout.isTTY) {
         // No TTY means no picker is possible — fall back to the same silent-latest
-        // behavior as `--continue` rather than silently doing nothing.
+        // behavior as `--continue` rather than silently doing nothing. Resolve the
+        // TRUE latest session BEFORE creating any placeholder session below — creating
+        // one first would make IT the newest-mtime file, permanently masking the real
+        // prior session and turning this fallback into dead code (found live: a bare
+        // `--resume` outside a TTY always "resumed" a fresh empty session instead of
+        // the actual prior one).
         const id = await latestSessionId(cwd);
         if (id) {
           try {
@@ -781,11 +798,35 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             if (!initialSessionModel && header.model) sessionModel = header.model;
             const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
             console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
+            // Reproduce the prior screen exactly (gjc/gajae-code parity): a bare
+            // `--resume` picker with no TTY falls back to the latest session, so
+            // this is the ONLY chance to show the prior work before the REPL
+            // starts — replay it as a scrollback ledger, same formatter `/session
+            // resume` uses mid-session, so a resumed screen always reads like the
+            // exact prior conversation instead of a bare message count.
+            if (messages.length > 0) {
+              resumedWithHistory = true;
+              const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
+              console.log([sep, ...formatTranscript(history, { maxTurns: 6, color: true, unicode: true }), sep].join("\n"));
+            }
+
+
           } catch (err) {
             console.log(`Could not resume ${id}: ${(err as Error).message}. Starting fresh.`);
           }
         }
+        // No prior session to resume (fresh cwd), or the resume attempt above failed —
+        // safe-default fresh session, same as every other "nothing to resume" path.
+        if (!sessionId) {
+          sessionId = (await createSession(cwd, undefined, sessionModel)).id;
+        }
+      } else {
+        // TTY: start with a fresh session as the safe default; the interactive picker
+        // below (right before the REPL loop) takes over and replaces it before the
+        // user ever sees this one, so creating it first here is harmless.
+        sessionId = (await createSession(cwd, undefined, sessionModel)).id;
       }
+
     } else if (flags.resume) {
       let id: string | undefined;
       let skipResume = false;
@@ -823,6 +864,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           if (header.draft) startupDraft = header.draft;
           const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
           console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
+          // Reproduce the prior screen exactly (gjc/gajae-code parity): same
+          // scrollback-ledger replay `/session resume` uses mid-session, so
+          // `--resume`/`-c`/`--resume <id>` restores the prior work onto the
+          // screen instead of just a bare message count.
+          if (messages.length > 0) {
+            resumedWithHistory = true;
+            const sep = "─".repeat(Math.min(48, Math.max(20, (process.stdout.columns ?? 80) - 1)));
+            console.log([sep, ...formatTranscript(history, { maxTurns: 6, color: true, unicode: true }), sep].join("\n"));
+          }
+
+
         } catch (err) {
           console.log(`Could not resume ${id}: ${(err as Error).message}. Starting fresh.`);
           sessionId = (await createSession(cwd, undefined, sessionModel)).id;
@@ -925,11 +977,54 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     const routingEnabled = sessionRouteOverride ?? !!turnConfig.routing?.enabled;
     let routeCredentialNotice: string | undefined;
     let routeVetoNote: string | undefined;
+    // Credential SCOPES that have shown an ACCOUNT-LEVEL failure (rate limit,
+    // usage/quota limit, or zero usable credential) THIS turn — accumulates across
+    // every fallback round. Read by both `equivalentRouteFallback` (post/pre-call
+    // fallback search) and `rateLimitFallbackAvailable` (the engine's fast-bail
+    // predicate) so neither path proposes a candidate doomed to fail the same way.
+    //
+    // Scoped to the CREDENTIAL, not the bare provider (see `credentialScopeFor` in
+    // prompt-router.ts for the full classification rationale/doc comment) — an OAuth
+    // SUBSCRIPTION shares ONE account-wide rate-limit window across every model it
+    // serves; an API key is typically its OWN independent per-key/per-model budget.
+    // `null` (from `credentialScopeFor`) means "API-key-served, or otherwise not
+    // sharing a subscription credential" — never added to or matched against this set.
+    const excludedCredentialScopes = new Set<string>();
+    // Matches routeFailureReason's post-call reasons ("hit a rate limit", "hit a
+    // usage/quota limit", "is unauthenticated for this session", "requires
+    // billing/payment on this provider account") AND the pre-call credential gate's
+    // "(<provider>) has no usable credential this turn" — every string that means
+    // "this CREDENTIAL is exhausted/broken", as opposed to a model-specific issue
+    // (OAuth serves only some models, a single model is retired/gated — see
+    // routeFailureReason's own doc comments for why those stay model-scoped).
+    //
+    // Billing/payment (402) is intentionally included even though the ORIGINAL field
+    // observation behind routeFailureReason's 402 branch (Tencent: kimi-k2.5/
+    // deepseek-v3.2 402 while deepseek-v4-flash/glm-5.2 kept working on the SAME key)
+    // is a per-MODEL billing block on an API-KEY-served provider — this does NOT
+    // contradict including it here: `credentialScopeFor` already returns `null` for
+    // every API-key-served model (never group-excluded regardless of this regex's
+    // answer), so the Tencent case is unaffected either way. What this DOES newly
+    // catch: an OAuth SUBSCRIPTION billing failure (e.g. a Claude Pro/Max payment
+    // lapse) is account-wide by construction — every model riding that subscription
+    // is equally blocked — and previously wasted a full fallback round retrying a
+    // same-scope sibling model guaranteed to 402 identically before ever reaching a
+    // genuinely different credential.
+    const isAccountLevelRouteFailure = (reason: string): boolean =>
+      /hit a rate limit|hit a usage\/quota limit|is unauthenticated for this session|has no usable credential|requires billing\/payment on this provider account/i.test(reason);
     const equivalentRouteFallback = async (decision: RouteDecision, reason: string, exclude: readonly string[] = []): Promise<string | null> => {
+      if (isAccountLevelRouteFailure(reason)) {
+        const scope = credentialScopeFor(decision.model, turnConfig);
+        if (scope) excludedCredentialScopes.add(scope.key);
+      }
       const excluded = new Set([decision.model, ...exclude]);
       const poolCandidates = (): string[] =>
         tierModelPool(decision.tier, turnConfig)
           .filter(model => !excluded.has(model))
+          .filter(model => {
+            const scope = credentialScopeFor(model, turnConfig);
+            return !scope || !excludedCredentialScopes.has(scope.key);
+          })
           .filter(model => !images?.length || catalogMetadata(model)?.images !== false);
       let candidates = poolCandidates();
       // The static MODEL_CATALOG only lists a couple of OpenAI-compatible clouds by
@@ -1332,7 +1427,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             }
 
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
-            const llmVerdict = await verifyGoal(goalState.condition, history, activeModel);
+            const llmVerdict = await verifyGoal(goalState.condition, history, resolveVerifierModel(turnConfig));
             // Deterministic downgrade: a fresh MET from the transcript-only LLM
             // judge still needs mutation/verification evidence to back it up —
             // see applyEvidenceGate's own docs (goal-verifier.ts). NOT_MET/
@@ -1397,6 +1492,57 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           tags: ["jeo", "launch"],
         });
         opik.startTurn();
+        // Hoisted above `runLoopWithModel` (moved from after its first call) so the
+        // rate-limit fast-fallback predicate below can see the CURRENT attempted-model
+        // set on every call, including the very first one. `attemptedRouteModels` is
+        // mutated in place (`.add`) as the fallback loop below tries more models — this
+        // closure always reads its live contents, never a stale snapshot.
+        const attemptedRouteModels = new Set<string>([activeModel]);
+        // A NON-routed turn (routing disabled, or the user pinned a model via /model)
+        // still needs the equivalent-pool fallback on a usage-limit/rate-limit/credential
+        // failure — the exact "5-hour usage window exhausted, model just stops working"
+        // case this loop exists to fix. Synthesize a same-size-class RouteDecision
+        // (inferTierForModel) so `equivalentRouteFallback` has a tier/pool to search even
+        // with routing off; a real `routed` decision (routing enabled) is used unchanged.
+        let fallbackBaseDecision: RouteDecision = routed ?? {
+          model: activeModel,
+          thinking: activeThinking,
+          tier: inferTierForModel(activeModel),
+          confidence: 1,
+          source: "heuristic",
+          signals: [],
+        };
+        // Cheap SYNC check (no network/credential probing — that full validation is
+        // `equivalentRouteFallback`'s job when a switch actually happens) for "does an
+        // untried, DIFFERENT-PROVIDER candidate exist RIGHT NOW". Feeds
+        // AgentLoopOptions.rateLimitFallbackAvailable so the engine can bail a 429 retry
+        // ladder on the first failed attempt instead of riding ~90s of backoff on a
+        // model that has an equivalent sitting right there. Mirrors
+        // `equivalentRouteFallback`'s own `poolCandidates` filters (tier pool minus
+        // already-tried models minus image-incapable models when this turn has images)
+        // PLUS excludes any candidate sharing the SAME CREDENTIAL SCOPE as the model
+        // CURRENTLY being attempted (a 429 on this model means ITS credential's
+        // account/subscription window is exhausted THIS instant — another model
+        // riding the SAME OAuth subscription hits that exact limit and is not a real
+        // fallback; an API-key-served candidate has an independent budget and is NOT
+        // excluded) and any scope already excluded by an earlier account-level
+        // failure this turn — see `excludedCredentialScopes`'s doc comment. Without
+        // this, the predicate could see e.g. `claude-sonnet-4-6` as "available" while
+        // `claude-sonnet-5` (same Anthropic OAuth subscription) is the one currently
+        // 429ing, bail, switch to it, and immediately re-429 — which looks
+        // indistinguishable from "never escaping auto-retry #1".
+        const rateLimitFallbackAvailable = (): boolean => {
+          const currentScope = credentialScopeFor(fallbackBaseDecision.model, turnConfig);
+          return tierModelPool(fallbackBaseDecision.tier, turnConfig)
+            .filter(model => !attemptedRouteModels.has(model))
+            .filter(model => {
+              const scope = credentialScopeFor(model, turnConfig);
+              if (!scope) return true; // API-key-served (or keyless) — independent budget
+              if (currentScope && scope.key === currentScope.key) return false; // same exhausted subscription
+              return !excludedCredentialScopes.has(scope.key);
+            })
+            .some(model => !images?.length || catalogMetadata(model)?.images !== false);
+        };
         const runLoopWithModel = (model: string, thinking: ThinkLevel | undefined, cacheKey: string | undefined, maxSteps = flags.maxSteps, budget?: { maxExtensions: number }) => runAgentLoop(history, {
           cwd,
           tools,
@@ -1408,6 +1554,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           signal: ac.signal,
           sessionKey: cacheKey,
           steer: drainSteer,
+          rateLimitFallbackAvailable,
           events: wrapEvents(withStepPersistence({ ...withToolDetailCapture(tui ? tui.events() : streamEvents), onBeforeDone }, persistTurnTail), opik),
         });
         const routeFailureReason = (doneReason: unknown): string | null => {
@@ -1479,21 +1626,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         const routeFallbackMax = Number.isFinite(routeFallbackMaxRaw) && routeFallbackMaxRaw >= 0
           ? Math.floor(routeFallbackMaxRaw)
           : 3;
-        const attemptedRouteModels = new Set<string>([activeModel]);
-        // A NON-routed turn (routing disabled, or the user pinned a model via /model)
-        // still needs the equivalent-pool fallback on a usage-limit/rate-limit/credential
-        // failure — the exact "5-hour usage window exhausted, model just stops working"
-        // case this loop exists to fix. Synthesize a same-size-class RouteDecision
-        // (inferTierForModel) so `equivalentRouteFallback` has a tier/pool to search even
-        // with routing off; a real `routed` decision (routing enabled) is used unchanged.
-        let fallbackBaseDecision: RouteDecision = routed ?? {
-          model: activeModel,
-          thinking: activeThinking,
-          tier: inferTierForModel(activeModel),
-          confidence: 1,
-          source: "heuristic",
-          signals: [],
-        };
         for (let routeFallbackAttempt = 0; routeFallbackAttempt < routeFallbackMax; routeFallbackAttempt++) {
           const routedFailureReason = !result.done ? routeFailureReason(result.doneReason) : null;
           if (!routedFailureReason) break;
@@ -1541,6 +1673,15 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             signal: ac.signal,
             sessionKey: turnSessionKey,
             steer: drainSteer,
+            // Deliberately NOT wiring rateLimitFallbackAvailable here: this repair
+            // retry has no reroute loop around it (unlike runLoopWithModel's
+            // routeFallbackAttempt loop) — bailing the retry ladder early on a 429
+            // would only fail FASTER with the identical outcome (no fallback model to
+            // switch to either way), trading away the one real win the full backoff
+            // ladder still offers here: a transient (<~90s) rate-limit blip clearing
+            // mid-wait and this retry succeeding. See launch.ts's `rateLimitFallbackAvailable`
+            // doc comment / commit history for why this predicate is paired with an
+            // actual model-switch loop everywhere else it's used.
             events: wrapEvents(withToolDetailCapture(tui ? tui.events() : streamEvents), opik),
           });
           const usage =
@@ -1634,12 +1775,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       const tags = Array.from(new Set(
         task.toLowerCase().match(/[a-z0-9][a-z0-9_-]{3,}/g) ?? [],
       )).slice(0, 8);
-      void recordFailedAttempt(cwd, {
-        title: `Stalled on: ${excerpt}`,
-        description: `A prior turn stalled (${why}) on this task — change approach before retrying.`,
-        body: `Task: ${task.slice(0, 240)}\n\nThe agent gave up after ${why} (${result.steps} steps) and could not recover. ` +
-          `Do NOT repeat the same line of attack; try a different decomposition, tool, or verification path.`,
-        tags,
+      const title = `Stalled on: ${excerpt}`;
+      const description = `A prior turn stalled (${why}) on this task — change approach before retrying.`;
+      const body = `Task: ${task.slice(0, 240)}\n\nThe agent gave up after ${why} (${result.steps} steps) and could not recover. ` +
+        `Do NOT repeat the same line of attack; try a different decomposition, tool, or verification path.`;
+      void recordFailedAttempt(cwd, { title, description, body, tags }).catch(() => {});
+      // Also offer the same failure to the skill-lessons system (deterministic
+      // free-text -> skill match; writes nothing when no skill clearly relates).
+      void recordSkillLesson(cwd, `${title} ${description}`, {
+        kind: "failure-mode",
+        title,
+        detail: body.slice(0, 300),
       }).catch(() => {});
     }
     const usage = result.usage ? `  (${result.usage.inputTokens} in / ${result.usage.outputTokens} out tokens)` : "";
@@ -1914,18 +2060,28 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     renderWelcome({ ...welcomeData, cols: terminalSize().cols });
   // gjc-style fresh-start clear so the banner opens atop a clean screen. TTY only,
   // never mid-turn (scrollback flood). ponytail: add an opt-out env if anyone misses their scrollback.
-  if (process.stdout.isTTY) process.stdout.write(clearScreen());
-  // Launch sweep: the forge mark's gradient loops seamlessly (default 2 full
-  // cycles, JEO_WELCOME_ANIM_CYCLES overrides), ending on the static banner.
-  // Truecolor TTYs only; JEO_NO_WELCOME_ANIM=1 opts out.
-  const sweepable =
-    !!process.stdout.isTTY &&
-    welcomeTheme.color &&
-    detectColorLevel(process.env, true) === ColorLevel.TrueColor &&
-    jeoEnv("NO_WELCOME_ANIM") !== "1";
-  const sweepCycles = Math.min(10, Math.max(1, Number(jeoEnv("WELCOME_ANIM_CYCLES")) || 2));
-  if (sweepable) await playWelcomeSweep(welcomeData, { cycles: sweepCycles });
-  else console.log(renderWelcome(welcomeData).join("\n"));
+  // SKIPPED on a resume that actually restored prior messages: the transcript ledger
+  // was already printed above (during session persistence, right after "Resumed
+  // session ... (N messages)"), so clearing here would wipe it and the generic
+  // "fresh start" banner below would bury the just-restored work — live-verified via
+  // a real pty run of `--resume <id>`, which showed exactly that: the resumed
+  // conversation flashed on screen then vanished under the welcome box a moment later.
+  if (!resumedWithHistory) {
+    if (process.stdout.isTTY) process.stdout.write(clearScreen());
+    // Launch sweep: the forge mark's gradient loops seamlessly (default 2 full
+    // cycles, JEO_WELCOME_ANIM_CYCLES overrides), ending on the static banner.
+    // Truecolor TTYs only; JEO_NO_WELCOME_ANIM=1 opts out.
+    const sweepable =
+      !!process.stdout.isTTY &&
+      welcomeTheme.color &&
+      detectColorLevel(process.env, true) === ColorLevel.TrueColor &&
+      jeoEnv("NO_WELCOME_ANIM") !== "1";
+    const sweepCycles = Math.min(10, Math.max(1, Number(jeoEnv("WELCOME_ANIM_CYCLES")) || 2));
+    if (sweepable) await playWelcomeSweep(welcomeData, { cycles: sweepCycles });
+    else console.log(renderWelcome(welcomeData).join("\n"));
+  }
+
+
 
   // Surface the "New version" banner reliably: render ONCE from the on-disk cache
   // instantly (no network wait, works offline — the common path after the first
@@ -2624,11 +2780,28 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     }
     return out;
   };
+  // Match the REAL terminal cursor's color to the theme accent (OSC 12) so the caret
+  // is never a same-toned block over the input box's typed text — the default terminal
+  // cursor color (usually solid white) otherwise reads as a stray light patch on every
+  // non-mono theme, especially the darker ones, making it hard to spot where typing
+  // lands. Colorless (`mono`) intentionally skips this and any terminal that ignores
+  // OSC 12 (rare) is unaffected either way. Reset on process exit (see below).
+  const applyCursorColor = (): void => {
+    if (isTTY() && uiTheme.color) {
+      try { process.stdout.write(setCursorColor(uiTheme.accent)); } catch { /* terminal gone */ }
+    }
+  };
   const refreshUiTheme = (): void => {
     uiTheme = resolveTheme(process.env);
     uiAccent = accentPaint(uiTheme);
     uiAccentShadow = accentShadowPaint(uiTheme);
+    applyCursorColor();
   };
+  applyCursorColor();
+  process.once("exit", () => {
+    try { process.stdout.write(resetCursorColor()); } catch { /* terminal gone */ }
+  });
+
   // The gjc-layout status bar pinned directly ABOVE the input box: bg-gradient
   // identity block (model · thinking / branch / cwd) left, live ctx% right.
   const statusBarLine = (cols: number): string => {
@@ -2945,7 +3118,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }, 16);
     };
     process.stdout.on("resize", onPickerResize);
+    // Poll-based safety net (same rationale as the idle footer's watchResize): a
+    // picker left open across a missed 'resize' event would otherwise stay pinned
+    // to its opening geometry until a keypress happened to trigger a repaint.
+    const stopPickerResizeWatch = watchResize(() => onPickerResize());
     try {
+
       await new Promise<void>(resolve => {
         const handler = (ch: string, key: { name?: string; ctrl?: boolean; meta?: boolean; shift?: boolean; sequence?: string } | undefined) => {
           // Same normalization as the footer handler: kitty CSI-u Esc/Ctrl+C must
@@ -2963,7 +3141,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       });
     } finally {
       process.stdout.off("resize", onPickerResize);
+      stopPickerResizeWatch();
       if (resizeTimer) clearTimeout(resizeTimer);
+
       if (process.stdin.setRawMode && !wasRaw) {
         process.stdin.setRawMode(false);
       }
@@ -3716,12 +3896,22 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }, RESIZE_THROTTLE_MS);
     };
     process.stdout.on("resize", idleResizeHandler);
+    // Poll-based safety net: the idle footer sits between turns for most of a
+    // session's wall-clock time, so a missed 'resize' event here (tmux pane switch
+    // while this pane isn't foreground, a SIGCONT race, etc. — see terminal.ts's
+    // watchResize doc) is the single biggest source of "screen stays at its
+    // starting size" reports. Cheap 300ms poll; idleResizeHandler already dedupes
+    // via lastIdleAt/reReserveFooter so this composes safely with the real event.
+    const stopIdleResizeWatch = watchResize(() => idleResizeHandler());
     promptListenerCleanups.push(() => {
       process.stdout.off("resize", idleResizeHandler);
       if (idleResizeTimer) clearTimeout(idleResizeTimer);
+      stopIdleResizeWatch();
     });
   }
 
+
+
   // Bare `--resume`/`-r` (no value) at cold startup (gjc-parity): show the SAME
   // interactive session picker `/session resume` (no arg) uses, in place of the
   // fresh session created above. TTY-only — non-TTY already fell back to

package/src/commands/ralplan.ts

@@ -19,6 +19,9 @@ import {
   resolveSubagentMaxSteps,
 } from "../agent/subagents";
 import { runAgentLoop } from "../agent/engine";
+import { inferTierForModel, tierModelPool, credentialScopeFor, selectFromPool } from "../agent/prompt-router";
+import { isRateLimitError } from "../util/retry";
+import { MAX_SUBAGENT_REROUTES } from "../agent/task-tool";
 
 /** Round-11 (architect ref 8-Round10Planning #1): the REAL consensus gate. A
  *  read-only critic SUBAGENT (repo access via read/search/find) reviews the
@@ -33,7 +36,7 @@ export async function runConsensusCriticGate(args: {
 }): Promise<{ verdict: "okay" | "iterate" | "reject" | "unverified"; detail: string }> {
   const role = getSubagentRole("critic")!;
   const config = await readGlobalConfig();
-  const model = resolveSubagentModel(role.id, config);
+  const initialModel = resolveSubagentModel(role.id, config);
   const maxSteps = resolveSubagentMaxSteps(role.id, config);
   const history: Message[] = [
     { role: "system", content: subagentSystemPrompt(role) },
@@ -48,14 +51,48 @@ export async function runConsensusCriticGate(args: {
         `Then call done — your reason MUST start with [OKAY], [ITERATE], or [REJECT] and include a 'Justification:' section.`,
     },
   ];
-  const result = await runAgentLoop(history, {
+  // Rate-limit fast fallback (see task-tool.ts's `runSubagentOnce` for the full
+  // design doc — same pattern, single-call variant: no fan-out here, so no
+  // batch-shared excludedCredentialScopes need apply). A bail-only predicate with
+  // no real reroute-and-retry loop around it is a net regression (02b7e59) — this
+  // gate pairs `rateLimitFallbackAvailable` with the actual switch-and-retry below.
+  const tier = inferTierForModel(initialModel);
+  const attemptedModels = new Set<string>([initialModel]);
+  const excludedCredentialScopes = new Set<string>();
+  const fallbackCandidates = (): string[] => {
+    const currentScope = credentialScopeFor(activeModel, config);
+    return tierModelPool(tier, config)
+      .filter(m => !attemptedModels.has(m))
+      .filter(m => {
+        const scope = credentialScopeFor(m, config);
+        if (!scope) return true; // API-key-served (or keyless) — independent budget
+        if (currentScope && scope.key === currentScope.key) return false; // same exhausted subscription
+        return !excludedCredentialScopes.has(scope.key);
+      });
+  };
+  const rateLimitFallbackAvailable = (): boolean => fallbackCandidates().length > 0;
+
+  let activeModel = initialModel;
+  const runOnce = () => runAgentLoop(history, {
     cwd: args.cwd,
-    model,
+    model: activeModel,
     maxSteps,
     budget: { maxExtensions: 0 },
     signal: args.signal,
     tools: subagentToolset(role),
+    rateLimitFallbackAvailable,
   });
+  let result = await runOnce();
+  for (let attempt = 0; attempt < MAX_SUBAGENT_REROUTES; attempt++) {
+    if (result.done || !isRateLimitError(new Error(result.doneReason ?? ""))) break;
+    const failedScope = credentialScopeFor(activeModel, config);
+    if (failedScope) excludedCredentialScopes.add(failedScope.key);
+    const candidates = fallbackCandidates();
+    if (candidates.length === 0) break;
+    activeModel = selectFromPool(candidates, undefined);
+    attemptedModels.add(activeModel);
+    result = await runOnce();
+  }
   const reason = result.doneReason?.trim() ?? "";
   if (!result.done) return { verdict: "unverified", detail: reason || `critic did not converge within ${result.steps} steps` };
   const contract = validateSubagentDoneReason(role, reason);