jeo-code 0.9.10 → 0.9.12

package/src/agent/session.ts

@@ -14,18 +14,25 @@ export interface SessionHeader {
    *  its own model independent of the global default (per-session model selection). */
   model?: string;
   /** Unsent input-box draft at last save, restored into the prompt on `/resume`
-   *  (gajae-code parity: an in-progress prompt survives a quit + resume instead
+   *  (gajae-code parity: an in-progress cursor survives a quit + resume instead
    *  of being silently lost). Absent/empty when there was nothing to restore. */
   draft?: string;
-
+  /** Source system marker for imported sessions (read-only session importer layer). */
+  sourceSystem?: "gjc";
+  /** Source session id for imported sessions. */
+  sourceSessionId?: string;
+  /** Source leaf id for imported sessions. */
+  sourceLeafId?: string;
+  /** SHA-256 hex of the exact imported source bytes. */
+  sourceSha256?: string;
+  /** Import timestamp for imported sessions (ISO-8601 UTC string). */
+  importTimestamp?: string;
 }
-
 export interface SessionEntry {
   type: "message";
   timestamp: string;
   message: Message;
 }
-
 export interface CompactionEntry {
   type: "compaction";
   timestamp: string;
@@ -45,6 +52,19 @@ export interface SessionSummary {
   title?: string;
   /** Model id pinned to this session (header `model`), if any. */
   model?: string;
+  /** GJC import provenance (present for imported sessions). */
+  sourceSystem?: "gjc";
+  sourceSessionId?: string;
+  sourceLeafId?: string;
+  sourceSha256?: string;
+  importTimestamp?: string;
+}
+
+export interface ImportedSessionLookup {
+  sourceSystem: "gjc";
+  sourceSessionId: string;
+  sourceLeafId: string;
+  sourceSha256: string;
 }
 
 export const SESSION_VERSION = 1;
@@ -183,15 +203,15 @@ export async function loadSession(
   if (compactions.length > 0) {
     const lastComp = compactions[compactions.length - 1];
     const { summary, replacesThrough } = lastComp;
-    
+
     const hasSystem = rawMessages.length > 0 && rawMessages[0].role === "system";
     const systemPrompt = hasSystem ? [rawMessages[0]] : [];
-    
+
     const summaryMessage: Message = {
       role: "user",
       content: `[Earlier conversation summary]\n${summary}`,
     };
-    
+
     const remaining = rawMessages.slice(replacesThrough + 1);
     messages = [...systemPrompt, summaryMessage, ...remaining];
   }
@@ -305,6 +325,11 @@ export async function listSessions(cwd = process.cwd()): Promise<SessionSummary[
         sizeBytes: stat.size,
         title: header.title,
         model: header.model,
+        sourceSystem: header.sourceSystem,
+        sourceSessionId: header.sourceSessionId,
+        sourceLeafId: header.sourceLeafId,
+        sourceSha256: header.sourceSha256,
+        importTimestamp: header.importTimestamp,
       });
     } catch {
       // Tolerate malformed files (skip them)
@@ -348,6 +373,22 @@ export async function resolveSessionRef(idOrPrefix: string, cwd = process.cwd())
   return { kind: "not-found" };
 }
 
+/**
+ * Locate an imported session by exact provenance match.
+ */
+export async function findImportedSessionByProvenance(
+  cwd = process.cwd(),
+  lookup: ImportedSessionLookup,
+): Promise<SessionSummary | undefined> {
+  const all = await listSessions(cwd);
+  return all.find(s =>
+    s.sourceSystem === lookup.sourceSystem &&
+    s.sourceSessionId === lookup.sourceSessionId &&
+    s.sourceLeafId === lookup.sourceLeafId &&
+    s.sourceSha256 === lookup.sourceSha256
+  );
+}
+
 /**
  * Locate the session's JSONL header, apply `mutate`, and rewrite the file in place.
  * `mutate` returns false to signal "no change needed" (skips the write). Shared by

package/src/ai/model-cache.ts

@@ -18,7 +18,9 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { jeoEnv } from "../util/env";
-import { recordLiveCodexModels, recordLiveProviderModels } from "./model-catalog";
+import { recordLiveCodexModels, recordLiveProviderModels, setOpenAIOauthAccountScope } from "./model-catalog";
+import { getStoredOAuth } from "../auth/storage";
+import { extractChatgptAccountId } from "./providers/openai-responses";
 import type { ProviderName } from "./types";
 
 /** How a provider's list was obtained; mirrors `ProviderModelsResult["source"]`. */
@@ -30,15 +32,17 @@ export interface CachedProviderModels {
   source: ModelCacheSource;
   /** Base URL the list came from, so an OpenAI-compatible endpoint's ids stay scoped to it. */
   baseUrl?: string;
+  /** Stable OpenAI OAuth account scope for this row; required for account-specific rehydration. */
+  accountId?: string;
 }
 
 export interface ModelCacheFile {
-  version: 1;
+  version: 2;
   updatedAt: number;
   providers: CachedProviderModels[];
 }
 
-const CACHE_VERSION = 1;
+const CACHE_VERSION = 2;
 /** Refresh in the background once the cache is older than this (6h). */
 export const MODEL_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
 /** Bound a single provider's persisted list so a pathological aggregator cannot bloat the file. */
@@ -52,7 +56,6 @@ function cachePath(): string {
   return path.join(cacheDir(), "model-catalog-cache.json");
 }
 
-/** Keep only well-formed entries; a hand-edited or partially-written file must not throw. */
 export function normalizeCacheEntries(raw: unknown): CachedProviderModels[] {
   if (!Array.isArray(raw)) return [];
   const out: CachedProviderModels[] = [];
@@ -61,11 +64,18 @@ export function normalizeCacheEntries(raw: unknown): CachedProviderModels[] {
     if (!row || typeof row.provider !== "string" || !Array.isArray(row.models)) continue;
     const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, MAX_MODELS_PER_PROVIDER);
     if (models.length === 0) continue;
+    const provider = row.provider as ProviderName;
+    const source: ModelCacheSource =
+      row.source === "oauth" || row.source === "api_key" || row.source === "keyless" || row.source === "none" ? row.source : "none";
+    const baseUrl = typeof row.baseUrl === "string" ? row.baseUrl.replace(/\/+$/, "") : undefined;
+    const accountId = typeof row.accountId === "string" ? row.accountId.trim() : "";
+    if (provider === "openai" && source === "oauth" && !accountId) continue;
     out.push({
-      provider: row.provider as ProviderName,
+      provider,
       models,
-      source: row.source === "oauth" || row.source === "api_key" || row.source === "keyless" ? row.source : "none",
-      ...(typeof row.baseUrl === "string" && row.baseUrl ? { baseUrl: row.baseUrl } : {}),
+      source,
+      ...(baseUrl ? { baseUrl } : {}),
+      ...(provider === "openai" && source === "oauth" ? { accountId } : {}),
     });
   }
   return out;
@@ -101,18 +111,29 @@ export function isModelCacheStale(cache: ModelCacheFile | null, now = Date.now()
  */
 export function mergeCacheEntries(
   previous: readonly CachedProviderModels[],
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
 ): CachedProviderModels[] {
   const byKey = new Map<string, CachedProviderModels>();
-  const keyOf = (provider: string, baseUrl?: string) => `${provider}\u0000${baseUrl ?? ""}`;
-  for (const entry of previous) byKey.set(keyOf(entry.provider, entry.baseUrl), entry);
+  const keyOf = (provider: string, baseUrl?: string, accountId?: string) =>
+    `${provider}\u0000${baseUrl ?? ""}\u0000${accountId ?? ""}`;
+  for (const entry of previous) {
+    const isOpenAIOAuth = entry.provider === "openai" && entry.source === "oauth";
+    if (isOpenAIOAuth && !entry.accountId) continue;
+    byKey.set(keyOf(entry.provider, entry.baseUrl, isOpenAIOAuth ? entry.accountId : undefined), entry);
+  }
   for (const result of results) {
     if (!result.ok || result.models.length === 0) continue;
-    byKey.set(keyOf(result.provider, result.baseUrl), {
+    const source: ModelCacheSource = result.source ?? "none";
+    const isOpenAIOAuth = result.provider === "openai" && source === "oauth";
+    const baseUrl = typeof result.baseUrl === "string" ? result.baseUrl.replace(/\/+$/, "") : undefined;
+    const accountId = typeof result.accountId === "string" ? result.accountId.trim() : "";
+    if (isOpenAIOAuth && !accountId) continue;
+    byKey.set(keyOf(result.provider, baseUrl, isOpenAIOAuth ? accountId : undefined), {
       provider: result.provider,
       models: [...result.models].slice(0, MAX_MODELS_PER_PROVIDER),
-      source: result.source ?? "none",
-      ...(result.baseUrl ? { baseUrl: result.baseUrl } : {}),
+      source,
+      ...(baseUrl ? { baseUrl } : {}),
+      ...(isOpenAIOAuth ? { accountId } : {}),
     });
   }
   return [...byKey.values()];
@@ -120,7 +141,7 @@ export function mergeCacheEntries(
 
 /** Persist discovery results (best-effort; never throws, never blocks a turn). */
 export async function writeModelCache(
-  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string }[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string; accountId?: string }[],
 ): Promise<void> {
   // Same hermeticity rule as saveGlobalConfig: a test run may only write into an
   // explicitly sandboxed JEO_CONFIG_DIR, never the developer's real ~/.jeo.
@@ -142,14 +163,21 @@ export async function writeModelCache(
  * routing, and — critically — the OAuth Codex gate know the account's real models
  * BEFORE the first network call of this launch. Returns the number of ids applied.
  */
-export function applyCachedModels(cache: ModelCacheFile | null): number {
+export function applyCachedModels(cache: ModelCacheFile | null, openAIOauthAccountId?: string): number {
   if (!cache) return 0;
+  const accountId = typeof openAIOauthAccountId === "string" ? openAIOauthAccountId.trim() : "";
   let applied = 0;
   for (const entry of cache.providers) {
-    recordLiveProviderModels(entry.provider, entry.models, { source: entry.source, baseUrl: entry.baseUrl });
-    // An OAuth-sourced OpenAI list IS the Codex allow-list; without this the gate
-    // still rejects any model newer than the maintained static snapshot.
-    if (entry.provider === "openai" && entry.source === "oauth") recordLiveCodexModels(entry.models);
+    const isOpenAIOAuth = entry.provider === "openai" && entry.source === "oauth";
+    if (isOpenAIOAuth && (!accountId || entry.accountId !== accountId)) continue;
+    recordLiveProviderModels(entry.provider, entry.models, {
+      source: entry.source,
+      baseUrl: entry.baseUrl,
+      ...(isOpenAIOAuth && entry.accountId ? { accountId: entry.accountId } : {}),
+    });
+    if (isOpenAIOAuth && entry.accountId) {
+      recordLiveCodexModels(entry.models, entry.accountId);
+    }
     applied += entry.models.length;
   }
   return applied;
@@ -158,6 +186,15 @@ export function applyCachedModels(cache: ModelCacheFile | null): number {
 /** Read + apply in one step. Returns the cache so callers can decide about refreshing. */
 export async function rehydrateLiveModels(): Promise<ModelCacheFile | null> {
   const cache = await readModelCache();
-  applyCachedModels(cache);
+  let accountId: string | undefined;
+  try {
+    const stored = await getStoredOAuth("openai");
+    const jwtAccountId = stored ? extractChatgptAccountId(stored.access) : undefined;
+    accountId = jwtAccountId || stored?.accountId;
+  } catch {
+    accountId = undefined;
+  }
+  setOpenAIOauthAccountScope(accountId);
+  applyCachedModels(cache, accountId);
   return cache;
 }

package/src/ai/model-catalog.ts

@@ -186,42 +186,75 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
 export const CODEX_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
 
 /**
- * Session-lifetime cache of OpenAI Codex model ids OBSERVED live from the account's
- * own `codex/models` response (see `listProviderModels` in model-discovery.ts, which
- * calls `recordLiveCodexModels` on every successful OAuth discovery). `CODEX_MODELS`
- * above is a maintained snapshot that WILL drift the moment OpenAI ships a new Codex
- * model — that drift is exactly the bug class this closes: the picker shows a model
- * (from the SAME live endpoint) that the static gate then hard-rejects at call time
- * ("OAuth doesn't support this model") even though the account can serve it. Any
- * successful discovery this session widens the gate immediately, no release needed;
- * a fresh process starts empty and falls back to the static list until the first
- * discovery call (picker open, `jeo doctor`, or model resolution) populates it.
+ * Session-lifetime Codex model observations. The maintained `CODEX_MODELS` list
+ * above is deliberately static; live-only ids are accepted only after the
+ * current OAuth account's Codex Responses model list confirms them.
+ *
+ * An identity-less observation uses the ephemeral scope and is never persisted.
+ * Account changes evict prior OAuth observations so a model from one account
+ * cannot authorize a call for another account.
  */
-const liveCodexModels = new Set<string>();
+const EPHEMERAL_OPENAI_OAUTH_SCOPE = "__jeo-openai-oauth-ephemeral__";
+let activeOpenAIOauthScope = EPHEMERAL_OPENAI_OAUTH_SCOPE;
+const liveCodexModels = new Map<string, Set<string>>();
+
+function normalizeOpenAIOauthScope(scope: string | undefined): string {
+  return typeof scope === "string" ? scope.trim() : "";
+}
+
+function oauthScope(scope: string | undefined): string {
+  return normalizeOpenAIOauthScope(scope) || EPHEMERAL_OPENAI_OAUTH_SCOPE;
+}
 
-/** Record model ids OpenAI's live Codex endpoint returned for the current account
- *  this session. Additive only — never removes a previously-observed id (a transient
- *  discovery hiccup should never narrow what a call is allowed to reach). */
-export function recordLiveCodexModels(ids: readonly string[]): void {
-  for (const id of ids) liveCodexModels.add(id);
+function removeLiveProviderRecord(recordKey: string, record: LiveProviderModelRecord): void {
+  liveProviderModels.delete(recordKey);
+  for (const id of [record.row.canonical, record.row.providerModel]) {
+    const indexKey = liveIndexKey(record.row.provider, id);
+    const bucket = liveModelIdIndex.get(indexKey);
+    if (!bucket) continue;
+    bucket.delete(recordKey);
+    if (bucket.size === 0) liveModelIdIndex.delete(indexKey);
+  }
 }
 
-/** True when `model` is a Codex-servable id — either in the maintained static list,
- *  or observed live this session (see `recordLiveCodexModels`). Accepts a bare or
- *  `openai/`-qualified id. */
+/** Select the current OAuth account and evict every other account's live rows. */
+export function setOpenAIOauthAccountScope(accountId: string | undefined): void {
+  const nextScope = oauthScope(accountId);
+  activeOpenAIOauthScope = nextScope;
+  for (const scope of [...liveCodexModels.keys()]) {
+    if (scope !== nextScope) liveCodexModels.delete(scope);
+  }
+  for (const [recordKey, record] of liveProviderModels.entries()) {
+    if (record.row.provider === "openai" && record.source === "oauth" && oauthScope(record.accountId) !== nextScope) {
+      removeLiveProviderRecord(recordKey, record);
+    }
+  }
+}
+
+/** Record ids confirmed by the current account's Codex Responses endpoint. */
+export function recordLiveCodexModels(ids: readonly string[], accountId?: string): void {
+  const explicitScope = normalizeOpenAIOauthScope(accountId);
+  if (explicitScope) setOpenAIOauthAccountScope(explicitScope);
+  const scope = explicitScope || EPHEMERAL_OPENAI_OAUTH_SCOPE;
+  const bucket = liveCodexModels.get(scope) ?? new Set<string>();
+  for (const id of ids) {
+    const trimmed = id.trim();
+    if (trimmed) bucket.add(trimmed);
+  }
+  liveCodexModels.set(scope, bucket);
+}
+
+/** True for the static Codex snapshot or a live id confirmed for the active scope. */
 export function isCodexModel(model: string): boolean {
   const wire = model.startsWith("openai/") ? model.slice(7) : model;
-  return CODEX_MODELS.includes(wire) || liveCodexModels.has(wire);
+  return CODEX_MODELS.includes(wire) || (liveCodexModels.get(activeOpenAIOauthScope)?.has(wire) ?? false);
 }
 
-/** Test-only: clear the live-observed Codex model cache (mirrors `resetPromptRouterWarnings`
- *  / `resetAppearanceCache`). Bun runs test files in one process, so this module-level Set
- *  would otherwise leak an `oauth`-source `listProviderModels("openai", …)` call's observed
- *  ids into unrelated tests in the same run. */
+/** Test-only reset for live Codex observations and the active account scope. */
 export function resetLiveCodexModels(): void {
   liveCodexModels.clear();
+  activeOpenAIOauthScope = EPHEMERAL_OPENAI_OAUTH_SCOPE;
 }
-
 /** Live provider model ids observed from authenticated/keyless `/models` endpoints during
  *  this process. Unlike `liveCodexModels`, this is NOT an OAuth allow-list; it is a
  *  routing supplement so API-key and OpenAI-compatible catalogs discovered at runtime
@@ -231,6 +264,7 @@ interface LiveProviderModelRecord {
   row: CatalogModel;
   source: LiveProviderModelSource;
   baseUrl?: string;
+  accountId?: string;
 }
 const liveProviderModels = new Map<string, LiveProviderModelRecord>();
 
@@ -291,8 +325,14 @@ function liveCanonicalId(provider: ProviderName, id: string): string {
     : trimmed;
 }
 
-function liveModelRecordKey(provider: ProviderName, canonical: string, baseUrl: string | undefined): string {
-  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${canonical}`;
+function liveModelRecordKey(
+  provider: ProviderName,
+  canonical: string,
+  baseUrl: string | undefined,
+  accountId?: string,
+): string {
+  const normalizedAccountId = provider === "openai" ? normalizeOpenAIOauthScope(accountId) : "";
+  return `${provider}\u0000${normalizeBaseUrl(baseUrl) ?? ""}\u0000${normalizedAccountId}\u0000${canonical}`;
 }
 
 function liveModelFallbackRow(provider: ProviderName, canonical: string, providerModel: string): CatalogModel {
@@ -316,9 +356,16 @@ function liveModelFallbackRow(provider: ProviderName, canonical: string, provide
 export function recordLiveProviderModels(
   provider: ProviderName,
   ids: readonly string[],
-  opts: { source?: LiveProviderModelSource; baseUrl?: string } = {},
+  opts: { source?: LiveProviderModelSource; baseUrl?: string; accountId?: string } = {},
 ): void {
+  const source = opts.source ?? "none";
   const baseUrl = normalizeBaseUrl(opts.baseUrl);
+  const scopedAccountId = provider === "openai" && source === "oauth"
+    ? normalizeOpenAIOauthScope(opts.accountId) || undefined
+    : undefined;
+  if (provider === "openai" && source === "oauth" && scopedAccountId) {
+    setOpenAIOauthAccountScope(scopedAccountId);
+  }
   for (const id of ids) {
     const canonical = liveCanonicalId(provider, id);
     if (!canonical) continue;
@@ -327,26 +374,34 @@ export function recordLiveProviderModels(
     const row = known
       ? { ...known, canonical, provider, providerModel }
       : liveModelFallbackRow(provider, canonical, providerModel);
-    const recordKey = liveModelRecordKey(provider, canonical, baseUrl);
+    const recordKey = liveModelRecordKey(provider, canonical, baseUrl, scopedAccountId);
     liveProviderModels.set(recordKey, {
       row,
-      source: opts.source ?? "none",
+      source,
       baseUrl,
+      ...(scopedAccountId ? { accountId: scopedAccountId } : {}),
     });
     addToLiveIndex(provider, canonical, recordKey);
     addToLiveIndex(provider, providerModel, recordKey);
   }
 }
 
-function liveRecordMatchesConfig(record: LiveProviderModelRecord, config?: { openaiBaseUrl?: string }): boolean {
+function liveRecordMatchesConfig(
+  record: LiveProviderModelRecord,
+  config?: { openaiBaseUrl?: string; openaiOauthScope?: string },
+): boolean {
   if (record.row.provider !== "openai") return true;
   const wanted = normalizeBaseUrl(config?.openaiBaseUrl);
-  if (wanted || record.baseUrl) return wanted === record.baseUrl;
-  return true;
+  if (wanted || record.baseUrl) {
+    if (wanted !== record.baseUrl) return false;
+  }
+  if (record.source !== "oauth") return true;
+  const wantedScope = oauthScope(config?.openaiOauthScope ?? activeOpenAIOauthScope);
+  return oauthScope(record.accountId) === wantedScope;
 }
 
 /** Live-discovered catalog rows usable for routing under the current config. */
-export function liveProviderCatalogModels(config?: { openaiBaseUrl?: string }): CatalogModel[] {
+export function liveProviderCatalogModels(config?: { openaiBaseUrl?: string; openaiOauthScope?: string }): CatalogModel[] {
   return [...liveProviderModels.values()]
     .filter(record => liveRecordMatchesConfig(record, config))
     .map(record => record.row);
@@ -363,7 +418,9 @@ export function liveProviderCatalogModels(config?: { openaiBaseUrl?: string }):
  *  large), so a linear scan is cheap — same access pattern as `liveProviderCatalogModels`. */
 export function findLiveCatalogModel(canonical: string): CatalogModel | undefined {
   for (const record of liveProviderModels.values()) {
-    if (record.row.canonical === canonical) return record.row;
+    if (record.row.canonical !== canonical) continue;
+    if (record.row.provider === "openai" && record.source === "oauth" && !liveRecordMatchesConfig(record)) continue;
+    return record.row;
   }
   return undefined;
 }
@@ -372,7 +429,7 @@ export function findLiveCatalogModel(canonical: string): CatalogModel | undefine
  *  O(1) average case via `liveModelIdIndex` — see that Map's doc comment for why
  *  this must not be an O(n) scan over every live-discovered model (it runs once
  *  per STATIC catalog row inside `isAutoSelectCandidate`). */
-export function isLiveProviderModel(provider: ProviderName, model: string, config?: { openaiBaseUrl?: string }): boolean {
+export function isLiveProviderModel(provider: ProviderName, model: string, config?: { openaiBaseUrl?: string; openaiOauthScope?: string }): boolean {
   const candidates = new Set([model, liveCanonicalId(provider, model), stripProviderPrefix(provider, model)]);
   for (const candidate of candidates) {
     const recordKeys = liveModelIdIndex.get(liveIndexKey(provider, candidate));

package/src/ai/model-discovery.ts

@@ -11,8 +11,16 @@ import { readGlobalConfig, type Config } from "../agent/state";
 import { resolveCredential, type AuthProvider, type Credential } from "../auth";
 import type { ProviderName } from "./types";
 import { PROVIDER_NAMES } from "./provider-status";
-import { catalogByProvider, CODEX_MODELS, KIMI_CODE_MODELS, recordLiveCodexModels, recordLiveProviderModels } from "./model-catalog";
+import {
+  catalogByProvider,
+  CODEX_MODELS,
+  KIMI_CODE_MODELS,
+  recordLiveCodexModels,
+  recordLiveProviderModels,
+  setOpenAIOauthAccountScope,
+} from "./model-catalog";
 import { extractChatgptAccountId } from "./providers/openai-responses";
+import { getStoredOAuth } from "../auth/storage";
 import { openaiCompatDef } from "./providers/openai-compatible-catalog";
 
 export interface ProviderModelsResult {
@@ -22,6 +30,8 @@ export interface ProviderModelsResult {
   ok: boolean;
   /** How the request authenticated (for display). */
   source: "oauth" | "api_key" | "keyless" | "none";
+  /** Stable OpenAI OAuth account scope for account-specific cache rows. */
+  accountId?: string;
   /** Present on failure: a short, human-readable reason. */
   error?: string;
   /** True when the live endpoint was unusable and ids came from the static catalog. */
@@ -334,6 +344,7 @@ export async function listProviderModels(
   const limit = opts.limit ?? DEFAULT_LIMIT;
 
   let cred: Credential | undefined;
+  let oauthAccountId: string | undefined;
   let source: ProviderModelsResult["source"] = "keyless";
   if (provider === "xai") {
     // xAI (Grok) is API-key only and not an OAuth AuthProvider: resolve its key
@@ -376,6 +387,12 @@ export async function listProviderModels(
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";
     }
+    if (provider === "openai" && source === "oauth" && cred.kind === "oauth") {
+      const stored = await getStoredOAuth("openai").catch(() => undefined);
+      const jwtAccountId = extractChatgptAccountId(cred.token);
+      oauthAccountId = jwtAccountId || stored?.accountId;
+      setOpenAIOauthAccountScope(oauthAccountId);
+    }
     // Gemini models are exposed ONLY under API-key auth: a gemini OAuth token can
     // still list models from generativelanguage.googleapis.com, but it can no
     // longer SERVE them (the gemini-cli/Cloud Code Assist masquerade was removed
@@ -419,9 +436,19 @@ export async function listProviderModels(
     // Record live ids for routing supplements. For OpenAI OAuth, keep the
     // existing Codex allow-list widening separate: API-key/custom-base discovery
     // must not make OAuth Codex calls accept unrelated API models.
-    recordLiveProviderModels(provider, models, { source, baseUrl: opts.baseUrl });
-    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models);
-    return { provider, models, ok: true, source };
+    recordLiveProviderModels(provider, models, {
+      source,
+      baseUrl: opts.baseUrl,
+      ...(provider === "openai" && source === "oauth" && oauthAccountId ? { accountId: oauthAccountId } : {}),
+    });
+    if (provider === "openai" && source === "oauth") recordLiveCodexModels(models, oauthAccountId);
+    return {
+      provider,
+      models,
+      ok: true,
+      source,
+      ...(oauthAccountId ? { accountId: oauthAccountId } : {}),
+    };
   } catch (err) {
     const msg = (err as Error)?.name === "TimeoutError" || (err as Error)?.name === "AbortError" ? "timeout" : "unreachable";
     return { provider, models: [], ok: false, source, error: msg };

package/src/commands/launch/input.ts

@@ -384,17 +384,35 @@ function feedLivePromptSegment(state: PromptInputQueue, segment: string): boolea
   return accepted;
 }
 
-function feedLivePromptPasteBody(state: PromptInputQueue, body: string): boolean {
+/** Pasted body captured while a TURN is running: pure DATA appended verbatim to the
+ *  draft the box will show when the turn ends.
+ *
+ *  Line breaks fold to {@link MULTILINE_SENTINEL} — the SAME contract the idle key
+ *  filter uses — so a pasted code block / stack trace keeps its structure (and its
+ *  indentation) instead of being flattened into one space-joined line. `multiline:
+ *  false` (JEO_NO_MULTILINE=1, no sentinel expansion on submit) degrades to a single
+ *  space so the sentinel can never leak into the model's input.
+ *
+ *  Nothing is trimmed and no separator is inserted between chunks: a large paste is
+ *  delivered over SEVERAL stdin reads, and the old per-chunk `trim()` + `join(" ")`
+ *  both dropped leading indentation and spliced a stray space into whatever word the
+ *  read boundary happened to split ("hello wo" + "rld" → "hello wo rld"). */
+function feedLivePromptPasteBody(state: PromptInputQueue, body: string, multiline: boolean): boolean {
   if (!body) return false;
   const normalized = stripPasteEscapes(body).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-  const flattened = normalized.split("\n").map(part => part.trim()).filter(Boolean).join(" ");
-  if (!flattened) return false;
-  state.partial = state.partial ? `${state.partial} ${flattened}` : flattened;
+  const folded = normalized.split("\n").join(multiline ? MULTILINE_SENTINEL : " ");
+  if (!folded) return false;
+  state.partial += folded;
   return true;
 }
 
-export function captureLivePromptInputChunk(state: PromptInputQueue, chunk: string): boolean {
+export function captureLivePromptInputChunk(
+  state: PromptInputQueue,
+  chunk: string,
+  opts: { multiline?: boolean } = {},
+): boolean {
   if (!chunk) return false;
+  const multiline = opts.multiline !== false;
   let accepted = false;
   let rest = chunk;
   while (rest.length > 0) {
@@ -403,7 +421,7 @@ export function captureLivePromptInputChunk(state: PromptInputQueue, chunk: stri
       const body = end === -1 ? rest : rest.slice(0, end);
       if (end !== -1) state.inPaste = false;
       rest = end === -1 ? "" : rest.slice(end + PASTE_END.length);
-      if (feedLivePromptPasteBody(state, body)) accepted = true;
+      if (feedLivePromptPasteBody(state, body, multiline)) accepted = true;
     } else {
       const start = rest.indexOf(PASTE_START);
       const plain = start === -1 ? rest : rest.slice(0, start);
@@ -863,6 +881,7 @@ export function filterPromptInputChunk(
   // or a `\r\n` straddling this read boundary — is never half-interpreted. Carrying is
   // safe: the concatenation is re-parsed next call, so a tail that turns out NOT to be a
   // marker is simply emitted one chunk later.
+  const carriedEsc = state.carry === "\u001b";
   data = (state.carry ?? "") + data;
   state.carry = "";
   const markerTail = pasteMarkerTailLength(data);
@@ -890,6 +909,19 @@ export function filterPromptInputChunk(
   let out = "";
   let i = 0;
   while (i < data.length) {
+    // A lone Esc keystroke that the PREVIOUS chunk carried, now followed by bytes that
+    // cannot continue an escape sequence (`ESC [` / `ESC O`): drop the ESC instead of
+    // forwarding it. readline's key decoder otherwise holds a dangling ESC as a pending
+    // META prefix and merges it with the NEXT keystroke (Esc, then "z" → meta-z), which
+    // SWALLOWS that character — the "Esc 로 지운 뒤 첫 글자가 안 먹힘" bug (a pasted
+    // block's first character disappeared the same way). jeo owns Esc itself on the raw
+    // process.stdin keypress listener (clearTypedInput), so readline never needs the byte.
+    // Only a CARRIED Esc is dropped: an `ESC x` pair that arrived in ONE chunk is a real
+    // Alt/Meta chord (Alt+b, Alt+f, …) and still reaches readline untouched.
+    if (carriedEsc && i === 0 && data[0] === "\u001b" && (data.length === 1 || (data[1] !== "[" && data[1] !== "O"))) {
+      i += 1;
+      continue;
+    }
     if (!state.inPaste && data.startsWith(PASTE_START, i)) { state.inPaste = true; out += PASTE_START; i += PASTE_START.length; continue; }
     if (state.inPaste && data.startsWith(PASTE_END, i)) { state.inPaste = false; out += PASTE_END; i += PASTE_END.length; continue; }
     if (state.inPaste) {