jeo-code 0.9.11 → 0.9.13

package/CHANGELOG.md

@@ -8,6 +8,38 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.9.13] - 2026-08-03
+_The provider-login browser tab now actually goes away — by itself on macOS, by a working button everywhere else._
+
+### Fixed
+- **The OAuth login tab stayed open after "Login complete"** (`src/auth/callback-server.ts`, new `src/auth/browser-tab.ts`) — two separate defects:
+  - The page decided whether the close worked from `window.close()`'s return value, which is `undefined` on EVERY browser. The failure branch therefore always ran and hid the "Close" button on the first countdown tick, so the tab was left open with its only manual control gone. Success is now inferred from the document actually going away (`pagehide` / `document.hidden`); the button stays visible and re-attempts on every press, and the countdown hint is replaced by an explicit "press ⌘W / Ctrl+W" instruction only when the browser refuses.
+  - `window.close()` cannot close a tab the page's own script did not open, and jeo hands the auth URL to the OS (`open` / `xdg-open` / `start`), so the request was always ignored. jeo now closes the tab from the OUTSIDE on macOS: after the callback page is served, it lists running processes (no Automation permission needed), builds an AppleScript naming ONLY the browsers that are actually running, and closes just the tabs whose URL contains this login's `localhost:<port>/callback`. `window.open("","_self")` is also tried first for the engines that still honor the legacy self-adopt, and the countdown is 3s instead of 5s.
+- **A single missing browser silently disabled the whole close script** — AppleScript resolves app terminology at COMPILE time, which `try` cannot guard, so one static `tell application "Arc"` block on a machine without Arc made the entire script fail to compile and close nothing (`osacompile`: "Expected class name but found property"). The script is now generated only for browsers found in the live process list.
+
+### Added
+- `JEO_AUTH_TAB_CLOSE=0` opts out of the OS-level tab close entirely; the attempt is hard-capped at 2s, never surfaces an error, and is skipped when the login finished through a manual code paste (no tab of ours was ever rendered).
+
+### Verified
+- Real Chromium (Playwright) against the actual served page: the scripted close is refused exactly as it is for a real OAuth tab, and the page survives intact — URL unchanged (`window.open("","_self")` does not blank it), "Login complete ✓" still rendered, countdown hint swapped for the manual instruction, Close button still visible; `window.close()` is invoked once by the countdown and again on every button press (the old build stopped after the first).
+- `osacompile` on the generated AppleScript: fails on the full browser list (reproducing the compile bug) and compiles cleanly for the running-process-derived list.
+- `closeAuthTab` against a live loopback callback URL returns in ~2s without hanging when macOS withholds Automation permission, so a login can never stall behind it.
+- Suites: oauth, browser-tab, openai-oauth, antigravity-login, kimi-oauth, oauth-lock, auth-matrix, doctor — 53 pass / 0 fail. `bun run typecheck` clean, `bun run pack:check` 283 files.
+
+## [0.9.12] - 2026-08-02
+_Fixes the boxed prompt's stolen keystrokes, drifting caret, and paste/attachment spacing under `jeo --tmux`._
+
+### Fixed
+- **A lone `Esc` swallowed the next keystroke — including the first character of a command or a paste** (`src/commands/launch/input.ts`) — a standalone `Esc` byte is a valid bracketed-paste-marker prefix, so the prompt filter carried it and re-prepended it to the NEXT stdin chunk. Forwarded that way, readline's key decoder read `ESC` + `z` as meta-z and consumed the character: after clearing the box with Esc, typing `zebra` produced `ebra`, and typing `/route off` produced `route off` — no longer a slash command, so it was sent to the model as a prompt and routing stayed on (the "`jeo --tmux` 에서 `/route off` 가 안 먹힌다" report). A carried `Esc` that cannot begin an escape sequence is now dropped before readline sees it (jeo already owns Esc on its own raw-stdin keypress listener); an `ESC x` pair delivered in ONE chunk is still a real Alt/Meta chord and passes through untouched.
+- **The painted caret drifted right of the real insertion point in any draft containing emoji** (`src/tui/components/input-box.ts`) — the box mapped `rl.cursor` (UTF-16 code units) onto a CODE-POINT index, so every surrogate pair before the caret shifted it one column and `←` after an emoji appeared not to move at all. `wrapWithCursor`/`caretCells` now index by code unit (a surrogate pair keeps both offsets addressable), and every offset returned to readline by the Up/Down and row-Home/End helpers snaps to a whole character.
+- **A drag-and-dropped image left the next typed word glued to its tag** (`src/util/file-attachment.ts`) — `attachImagePaths` trimmed the tag's trailing space, so `[image #1]` + typing became `[image #1]please`, while the Ctrl+V path (`insertImageTag`) kept one space. Both attach paths now leave exactly one trailing space at end-of-draft with the caret parked after it. Dropped/typed `~/…` paths are also expanded to the home directory (gjc parity), so `~/Downloads/shot.png` attaches instead of being sent to the model as literal text.
+- **A paste made WHILE a turn was running lost its line structure** (`src/commands/launch/input.ts`, `src/commands/launch.ts`) — the live-turn capture trimmed every pasted line and space-joined them, so a pasted code block/stack trace arrived at the next prompt as one flattened line with its indentation gone, and a large paste split across stdin reads gained a stray space wherever the read boundary fell (`hello wo` + `rld` → `hello wo rld`). Mid-turn pastes now fold line breaks to the same `MULTILINE_SENTINEL` the idle path uses and append verbatim; the live box and the mid-turn steering/command paths expand that sentinel, so the model never sees the private-use character. `JEO_NO_MULTILINE=1` degrades to the old space join, which is the only mode where the sentinel is not expanded on submit.
+
+### Verified
+- Live in tmux (`jeo --tmux` inner process, real PTY, caret cell read back with `tmux display-message -p '#{cursor_x},#{cursor_y}'`): Esc → `zebra` stays `zebra`; Esc → `/route off` prints `routing: off (this session)`; `←` after `안녕하세요 테스트😀😀` steps 24 → 22 → 20 columns; a dropped `assets/icon.png` renders `look at [image #1] please` with the caret exactly at column 28; `~/…` and backslash-escaped paths attach.
+- Suites: input-box, vertical-cursor, box-vertical-nav, prompt-key-filter, row-home-end-filter, extended-key-decode, mouse/terminal-report filters, file-attachment, image-attachments, input-history, new-input-first, launch-flags, slash, tmux — 215 pass / 0 fail. `bun run typecheck` clean. (`test/team-subagent.test.ts` timeouts are pre-existing and reproduce with these changes stashed.)
+- Mid-turn paste: a bracketed paste delivered WHILE a turn runs kept its line breaks and indentation in the live box (`def run():` / `    return 1`), and a paste split across stdin reads no longer gains a stray space at the boundary.
+
 ## [0.9.11] - 2026-07-30
 _Imports GJC v5 sessions safely, exposes bounded slash controls, and gates the release artifact before publication._
 

package/README.ja.md

@@ -287,10 +287,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.13]** (2026-08-03) — The provider-login browser tab now actually goes away — by itself on macOS, by a working button everywhere else.
+- **[0.9.12]** (2026-08-02) — Fixes the boxed prompt's stolen keystrokes, drifting caret, and paste/attachment spacing under `jeo --tmux`.
 - **[0.9.11]** (2026-07-30) — Imports GJC v5 sessions safely, exposes bounded slash controls, and gates the release artifact before publication.
 - **[0.9.10]** (2026-07-27) — `jeo update` now verifies the binary you actually run, and recovers from bun's stale registry cache.
-- **[0.9.9]** (2026-07-27) — Root-causes the frozen `jeo --tmux` TUI: the window was pinned to its launch size, so resizing the terminal only cut the view.
-- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -288,10 +288,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.13]** (2026-08-03) — The provider-login browser tab now actually goes away — by itself on macOS, by a working button everywhere else.
+- **[0.9.12]** (2026-08-02) — Fixes the boxed prompt's stolen keystrokes, drifting caret, and paste/attachment spacing under `jeo --tmux`.
 - **[0.9.11]** (2026-07-30) — Imports GJC v5 sessions safely, exposes bounded slash controls, and gates the release artifact before publication.
 - **[0.9.10]** (2026-07-27) — `jeo update` now verifies the binary you actually run, and recovers from bun's stale registry cache.
-- **[0.9.9]** (2026-07-27) — Root-causes the frozen `jeo --tmux` TUI: the window was pinned to its launch size, so resizing the terminal only cut the view.
-- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -295,10 +295,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.13]** (2026-08-03) — The provider-login browser tab now actually goes away — by itself on macOS, by a working button everywhere else.
+- **[0.9.12]** (2026-08-02) — Fixes the boxed prompt's stolen keystrokes, drifting caret, and paste/attachment spacing under `jeo --tmux`.
 - **[0.9.11]** (2026-07-30) — Imports GJC v5 sessions safely, exposes bounded slash controls, and gates the release artifact before publication.
 - **[0.9.10]** (2026-07-27) — `jeo update` now verifies the binary you actually run, and recovers from bun's stale registry cache.
-- **[0.9.9]** (2026-07-27) — Root-causes the frozen `jeo --tmux` TUI: the window was pinned to its launch size, so resizing the terminal only cut the view.
-- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -287,10 +287,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.13]** (2026-08-03) — The provider-login browser tab now actually goes away — by itself on macOS, by a working button everywhere else.
+- **[0.9.12]** (2026-08-02) — Fixes the boxed prompt's stolen keystrokes, drifting caret, and paste/attachment spacing under `jeo --tmux`.
 - **[0.9.11]** (2026-07-30) — Imports GJC v5 sessions safely, exposes bounded slash controls, and gates the release artifact before publication.
 - **[0.9.10]** (2026-07-27) — `jeo update` now verifies the binary you actually run, and recovers from bun's stale registry cache.
-- **[0.9.9]** (2026-07-27) — Root-causes the frozen `jeo --tmux` TUI: the window was pinned to its launch size, so resizing the terminal only cut the view.
-- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/auth/browser-tab.ts

@@ -0,0 +1,182 @@
+/**
+ * Best-effort closing of the OAuth callback TAB the login opened.
+ *
+ * Why this exists: the callback page already asks the browser to close itself
+ * (`window.close()` after a short countdown), but every current browser REFUSES
+ * that for a tab the page's own script did not open. jeo hands the auth URL to
+ * the OS (`open` / `xdg-open` / `start`), so the tab is user-opened by that rule
+ * and the request is silently ignored — the login succeeds in the terminal while
+ * a dead "Login complete" tab lingers in the browser (the reported bug).
+ *
+ * The only reliable way to close such a tab is to drive the browser from the
+ * outside. macOS exposes exactly that through AppleScript, so this module builds
+ * a targeted script that closes ONLY tabs whose URL contains the loopback
+ * callback (e.g. `localhost:1455/callback`) — never any other tab — in whichever
+ * of the common browsers is ALREADY running (`is running` never launches one).
+ *
+ * Everything here is best effort and failure-silent: no automation permission, a
+ * browser without an AppleScript dictionary (Firefox), Linux/Windows, or a user
+ * who already closed the tab all end as a no-op. `JEO_AUTH_TAB_CLOSE=0` opts out.
+ */
+import { jeoEnv } from "../util/env";
+
+/** Chromium-family browsers whose AppleScript dictionary exposes `windows`/`tabs`
+ *  with a `URL` property and a `close` command. Safari uses the same shape and is
+ *  appended by {@link closeAuthTabScript}. Firefox has no tab-level dictionary at
+ *  all, so it cannot be driven this way — its tab keeps the page's own fallback. */
+export const APPLESCRIPT_BROWSERS: readonly string[] = [
+  "Google Chrome",
+  "Google Chrome Beta",
+  "Google Chrome Canary",
+  "Chromium",
+  "Brave Browser",
+  "Microsoft Edge",
+  "Vivaldi",
+  "Arc",
+  "Safari",
+];
+
+/** Escape a string for embedding inside an AppleScript double-quoted literal. */
+function escapeAppleScript(value: string): string {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+
+/**
+ * The AppleScript that closes every tab whose URL contains `fragment`.
+ *
+ * One STATIC `tell` block per browser (never a dynamic `tell application appName`):
+ * app-specific terms like `URL of t` only compile inside a literal tell block, so a
+ * variable-driven loop would fail to compile and close nothing.
+ *
+ * Pass ONLY browsers that are actually running (see {@link runningBrowserApps}). A
+ * block naming an app that is not INSTALLED cannot resolve its terminology and
+ * fails at COMPILE time — which `try` cannot catch, since `try` guards runtime
+ * errors only — so one missing browser would sink the whole script and close
+ * nothing (verified with `osacompile`: "Expected class name but found property").
+ * Each block keeps its own `try` + `is running` guard for the runtime races: a
+ * browser quitting mid-script, or a window that refuses the query.
+ */
+export function closeAuthTabScript(fragment: string, browsers: readonly string[] = APPLESCRIPT_BROWSERS): string {
+  const frag = escapeAppleScript(fragment);
+  const blocks = browsers.map(
+    app => `try
+  if application "${escapeAppleScript(app)}" is running then
+    tell application "${escapeAppleScript(app)}"
+      repeat with w in (every window)
+        repeat with t in (every tab of w)
+          try
+            if (URL of t) contains "${frag}" then close t
+          end try
+        end repeat
+      end repeat
+    end tell
+  end if
+end try`,
+  );
+  return blocks.join("\n");
+}
+
+/** The subset of {@link APPLESCRIPT_BROWSERS} currently running, derived from
+ *  `ps -Ax -o comm=` output (each line is an executable path such as
+ *  `/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`). Reading the
+ *  process list needs no Automation permission, so this narrows the generated
+ *  script — and with it the compile surface and the number of permission prompts —
+ *  to the browsers that could actually be holding the callback tab. */
+export function runningBrowserApps(psOutput: string, browsers: readonly string[] = APPLESCRIPT_BROWSERS): string[] {
+  const lines = psOutput.split("\n");
+  return browsers.filter(app => lines.some(line => line.includes(`/${app}.app/`)));
+}
+
+/** The command to run for `platform`, or null when the platform has no reliable
+ *  way to close a tab it did not open (Linux/Windows: no scriptable, browser-
+ *  agnostic tab API — the callback page's own message is the fallback there). */
+export function browserTabCloseCommand(
+  platform: NodeJS.Platform,
+  fragment: string,
+  browsers: readonly string[] = APPLESCRIPT_BROWSERS,
+): string[] | null {
+  if (platform !== "darwin") return null;
+  if (!fragment) return null;
+  return ["osascript", "-e", closeAuthTabScript(fragment, browsers)];
+}
+
+/** The `host:port/path` slice of a redirect URI — the narrowest fragment that still
+ *  identifies THIS login's callback tab (the port is unique per flow/run), so no
+ *  unrelated tab can ever match. Returns "" when the URI cannot be parsed. */
+export function callbackUrlFragment(redirectUri: string): string {
+  try {
+    const url = new URL(redirectUri);
+    return `${url.host}${url.pathname}`;
+  } catch {
+    return "";
+  }
+}
+
+export interface CloseAuthTabOptions {
+  platform?: NodeJS.Platform;
+  env?: Record<string, string | undefined>;
+  /** Hard cap so a hung/permission-prompting osascript can never stall the login.
+   *  The FIRST close on a machine raises macOS's "control Google Chrome" Automation
+   *  prompt; if the user does not answer in time this kills the helper and the page's
+   *  own fallback message takes over. Answering it once makes later logins instant. */
+  timeoutMs?: number;
+  /** Injected for tests; defaults to the real spawn. */
+  spawn?: (cmd: string[]) => { exited: Promise<number>; kill: () => void };
+  /** Running-process listing (`ps -Ax -o comm=`); injected for tests. Returning ""
+   *  means "cannot tell", which is treated as "no known browser running". */
+  listProcesses?: () => string;
+}
+
+/**
+ * Close the browser tab still showing this login's callback page. Resolves `true`
+ * only when the OS accepted the request; every other outcome (unsupported
+ * platform, opt-out, spawn failure, timeout, non-zero exit) resolves `false` and
+ * is silent — the terminal already reported the login result, so this must never
+ * surface an error of its own.
+ */
+export async function closeAuthTab(redirectUri: string, opts: CloseAuthTabOptions = {}): Promise<boolean> {
+  const env = opts.env ?? process.env;
+  if (jeoEnv("AUTH_TAB_CLOSE", env) === "0") return false;
+  const platform = opts.platform ?? process.platform;
+  if (platform !== "darwin") return false;
+  const fragment = callbackUrlFragment(redirectUri);
+  if (!fragment) return false;
+  const listProcesses =
+    opts.listProcesses ??
+    (() => {
+      try {
+        return Bun.spawnSync(["ps", "-Ax", "-o", "comm="], { stdout: "pipe", stderr: "ignore" }).stdout.toString();
+      } catch {
+        return "";
+      }
+    });
+  // Never script a browser that is not running: an uninstalled app breaks the whole
+  // script at compile time, and a running-only list keeps the Automation prompt to
+  // the browser the user actually has open.
+  const browsers = runningBrowserApps(listProcesses());
+  if (browsers.length === 0) return false;
+  const cmd = browserTabCloseCommand(platform, fragment, browsers);
+  if (!cmd) return false;
+  const timeoutMs = opts.timeoutMs ?? 2000;
+  const spawn =
+    opts.spawn ??
+    ((c: string[]) => {
+      const proc = Bun.spawn(c, { stdout: "ignore", stderr: "ignore", stdin: "ignore" });
+      return { exited: proc.exited, kill: () => proc.kill() };
+    });
+  try {
+    const proc = spawn(cmd);
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<number>(resolve => {
+      timer = setTimeout(() => {
+        try { proc.kill(); } catch { /* already gone */ }
+        resolve(-1);
+      }, timeoutMs);
+    });
+    const code = await Promise.race([proc.exited, timeout]);
+    if (timer) clearTimeout(timer);
+    return code === 0;
+  } catch {
+    return false;
+  }
+}

package/src/auth/callback-server.ts

@@ -9,6 +9,7 @@
  */
 import type { OAuthController, OAuthCredentials } from "./types";
 import { generateState } from "./pkce";
+import { closeAuthTab } from "./browser-tab";
 
 const DEFAULT_TIMEOUT_MS = 300_000;
 // Loopback callback host. `localhost` (not the 127.0.0.1 IP literal) is the intentional
@@ -64,34 +65,58 @@ button:hover{background:#1b1c27}
 <img class="wordmark" alt="jeo" src="${JEO_WORDMARK_DATA_URI}">
 <h1 class="__STATUS__">__TITLE__</h1>
 <p>__MSG__</p>
-<button id="jeo-close" type="button">Close</button>
-<p class="hint">Closing automatically in <span id="jeo-countdown">__SECONDS__</span>s…</p>
-<p class="hint closed" id="jeo-closed-msg">Window closed. You can close this tab.</p>
+<button id="jeo-close" type="button">Close this tab</button>
+<p class="hint" id="jeo-countdown-msg">Closing automatically in <span id="jeo-countdown">__SECONDS__</span>s…</p>
+<p class="hint closed" id="jeo-closed-msg">This browser refuses to close a tab it opened itself — press \u2318W (Ctrl+W) to close it.</p>
 </div>
 <script>__SCRIPT__</script>
 </body></html>`;
 
-// Seconds before the tab auto-closes — applies to BOTH the success and the
-// failure page now (previously only success auto-closed). Pressing "Close"
-// closes immediately without waiting out the countdown. `window.close()` only
-// succeeds on tabs the script itself opened; browsers may ignore it for
-// OS-launched OAuth tabs, so the button remains as the reliable fallback.
-const AUTO_CLOSE_SECONDS = 5;
+// Seconds before the tab tries to close itself — applies to BOTH the success and
+// the failure page (each is a final page that should not linger). Pressing
+// "Close this tab" runs the same attempt immediately, without waiting out the
+// countdown, and stays clickable afterwards.
+const AUTO_CLOSE_SECONDS = 3;
 
 function renderHtml(ok: boolean, msg: string): string {
+  // Closing contract, in order of what actually works:
+  //  1. `window.open("","_self")` before `window.close()` — the legacy self-adopt
+  //     trick that still lets Firefox (and older engines) close an OS-opened tab.
+  //  2. `window.close()` — succeeds only where the tab counts as script-opened.
+  //  3. If the tab is still here a moment later, the browser refused: tell the
+  //     user how to close it and KEEP the button working.
+  //
+  // The old code branched on `window.close()`'s return value — that call returns
+  // `undefined` ALWAYS, so the failure branch fired unconditionally and hid the
+  // Close button on the first tick. That left the tab open with its only manual
+  // control gone (the "인증 브라우저가 종료되지 않는다" report). Success is now
+  // detected by observing that the document is actually going away
+  // (`document.hidden` / the `pagehide` unload path), never by a return value.
+  //
+  // The CLI side additionally closes the tab through the OS on macOS once the
+  // callback lands (`closeAuthTab` in ./browser-tab.ts), which is the only path
+  // that works when the browser refuses the scripted close outright.
   const script = `(function(){
-    var n=${AUTO_CLOSE_SECONDS},el=document.getElementById("jeo-countdown"),btn=document.getElementById("jeo-close"),closedMsg=document.getElementById("jeo-closed-msg"),t;
-    function closeNow(){
-      clearInterval(t);
-      var closed=window.close();
-      if(!closed){
-        btn.style.display="none";
-        el.parentElement.style.display="none";
-        closedMsg.classList.remove("closed");
-      }
+    var n=${AUTO_CLOSE_SECONDS},
+        el=document.getElementById("jeo-countdown"),
+        countdownMsg=document.getElementById("jeo-countdown-msg"),
+        btn=document.getElementById("jeo-close"),
+        closedMsg=document.getElementById("jeo-closed-msg"),
+        t,gone=false;
+    window.addEventListener("pagehide",function(){gone=true;});
+    function showManual(){
+      if(gone||document.hidden)return;
+      if(countdownMsg)countdownMsg.style.display="none";
+      if(closedMsg)closedMsg.classList.remove("closed");
+    }
+    function attemptClose(){
+      if(t){clearInterval(t);t=null;}
+      try{window.open("","_self");}catch(e){}
+      try{window.close();}catch(e){}
+      setTimeout(showManual,250);
     }
-    t=setInterval(function(){n-=1;if(el)el.textContent=String(Math.max(n,0));if(n<=0)closeNow();},1000);
-    if(btn)btn.addEventListener("click",closeNow);
+    t=setInterval(function(){n-=1;if(el)el.textContent=String(Math.max(n,0));if(n<=0)attemptClose();},1000);
+    if(btn)btn.addEventListener("click",attemptClose);
   })();`;
   return PAGE_HTML
     .replace("__STATUS__", ok ? "ok" : "fail")
@@ -110,6 +135,9 @@ export abstract class OAuthCallbackFlow {
   protected fixedRedirectUri?: string;
   #resolve?: (r: CallbackResult) => void;
   #reject?: (e: Error) => void;
+  /** Set for the duration of one `login()`; fired the moment the callback PAGE is
+   *  served, which is the only proof a browser tab of ours exists to close. */
+  #onPageServed?: () => void;
 
   constructor(ctrl: OAuthController, opts: number | OAuthCallbackFlowOptions, callbackPath = DEFAULT_CALLBACK_PATH) {
     this.ctrl = ctrl;
@@ -131,6 +159,11 @@ export abstract class OAuthCallbackFlow {
   async login(): Promise<OAuthCredentials> {
     const state = generateState();
     const { server, redirectUri } = this.#startServer(state);
+    // Whether the browser actually reached the callback page. A manual paste (or a
+    // cancelled/timed-out flow) never rendered a tab of ours, so there is nothing to
+    // close and no reason to pay for an osascript spawn.
+    let servedCallbackPage = false;
+    this.#onPageServed = () => { servedCallbackPage = true; };
     try {
       const { url, instructions } = await this.generateAuthUrl(state, redirectUri);
       this.ctrl.onAuth?.({ url, instructions });
@@ -140,9 +173,23 @@ export abstract class OAuthCallbackFlow {
       return await this.exchangeToken(code, returnedState || state, redirectUri);
     } finally {
       server.stop();
+      this.#onPageServed = undefined;
+      // Close the leftover callback tab from the OUTSIDE (macOS only; see
+      // ./browser-tab.ts). Awaited — a one-shot `jeo auth login` exits as soon as
+      // this returns, so a fire-and-forget spawn would be killed before it ran —
+      // but hard-capped, silent, and never able to fail the login it follows.
+      if (servedCallbackPage) {
+        try { await this.closeBrowserTab(redirectUri); } catch { /* best effort only */ }
+      }
     }
   }
 
+  /** OS-level close of the callback tab (see ./browser-tab.ts). Overridable so tests
+   *  can observe the attempt without driving a real browser. */
+  protected closeBrowserTab(redirectUri: string): Promise<boolean> {
+    return closeAuthTab(redirectUri);
+  }
+
   #startServer(expectedState: string): { server: Bun.Server<unknown>; redirectUri: string } {
     const serve = (port: number) =>
       Bun.serve({
@@ -186,6 +233,7 @@ export abstract class OAuthCallbackFlow {
       message = "Authentication succeeded. Return to the terminal — jeo is ready.";
     }
 
+    this.#onPageServed?.(); // a real browser tab now holds this page — it can be closed
     const resolve = this.#resolve;
     const reject = this.#reject;
     queueMicrotask(() => {

package/src/commands/launch/input.ts

@@ -384,17 +384,35 @@ function feedLivePromptSegment(state: PromptInputQueue, segment: string): boolea
   return accepted;
 }
 
-function feedLivePromptPasteBody(state: PromptInputQueue, body: string): boolean {
+/** Pasted body captured while a TURN is running: pure DATA appended verbatim to the
+ *  draft the box will show when the turn ends.
+ *
+ *  Line breaks fold to {@link MULTILINE_SENTINEL} — the SAME contract the idle key
+ *  filter uses — so a pasted code block / stack trace keeps its structure (and its
+ *  indentation) instead of being flattened into one space-joined line. `multiline:
+ *  false` (JEO_NO_MULTILINE=1, no sentinel expansion on submit) degrades to a single
+ *  space so the sentinel can never leak into the model's input.
+ *
+ *  Nothing is trimmed and no separator is inserted between chunks: a large paste is
+ *  delivered over SEVERAL stdin reads, and the old per-chunk `trim()` + `join(" ")`
+ *  both dropped leading indentation and spliced a stray space into whatever word the
+ *  read boundary happened to split ("hello wo" + "rld" → "hello wo rld"). */
+function feedLivePromptPasteBody(state: PromptInputQueue, body: string, multiline: boolean): boolean {
   if (!body) return false;
   const normalized = stripPasteEscapes(body).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-  const flattened = normalized.split("\n").map(part => part.trim()).filter(Boolean).join(" ");
-  if (!flattened) return false;
-  state.partial = state.partial ? `${state.partial} ${flattened}` : flattened;
+  const folded = normalized.split("\n").join(multiline ? MULTILINE_SENTINEL : " ");
+  if (!folded) return false;
+  state.partial += folded;
   return true;
 }
 
-export function captureLivePromptInputChunk(state: PromptInputQueue, chunk: string): boolean {
+export function captureLivePromptInputChunk(
+  state: PromptInputQueue,
+  chunk: string,
+  opts: { multiline?: boolean } = {},
+): boolean {
   if (!chunk) return false;
+  const multiline = opts.multiline !== false;
   let accepted = false;
   let rest = chunk;
   while (rest.length > 0) {
@@ -403,7 +421,7 @@ export function captureLivePromptInputChunk(state: PromptInputQueue, chunk: stri
       const body = end === -1 ? rest : rest.slice(0, end);
       if (end !== -1) state.inPaste = false;
       rest = end === -1 ? "" : rest.slice(end + PASTE_END.length);
-      if (feedLivePromptPasteBody(state, body)) accepted = true;
+      if (feedLivePromptPasteBody(state, body, multiline)) accepted = true;
     } else {
       const start = rest.indexOf(PASTE_START);
       const plain = start === -1 ? rest : rest.slice(0, start);
@@ -863,6 +881,7 @@ export function filterPromptInputChunk(
   // or a `\r\n` straddling this read boundary — is never half-interpreted. Carrying is
   // safe: the concatenation is re-parsed next call, so a tail that turns out NOT to be a
   // marker is simply emitted one chunk later.
+  const carriedEsc = state.carry === "\u001b";
   data = (state.carry ?? "") + data;
   state.carry = "";
   const markerTail = pasteMarkerTailLength(data);
@@ -890,6 +909,19 @@ export function filterPromptInputChunk(
   let out = "";
   let i = 0;
   while (i < data.length) {
+    // A lone Esc keystroke that the PREVIOUS chunk carried, now followed by bytes that
+    // cannot continue an escape sequence (`ESC [` / `ESC O`): drop the ESC instead of
+    // forwarding it. readline's key decoder otherwise holds a dangling ESC as a pending
+    // META prefix and merges it with the NEXT keystroke (Esc, then "z" → meta-z), which
+    // SWALLOWS that character — the "Esc 로 지운 뒤 첫 글자가 안 먹힘" bug (a pasted
+    // block's first character disappeared the same way). jeo owns Esc itself on the raw
+    // process.stdin keypress listener (clearTypedInput), so readline never needs the byte.
+    // Only a CARRIED Esc is dropped: an `ESC x` pair that arrived in ONE chunk is a real
+    // Alt/Meta chord (Alt+b, Alt+f, …) and still reaches readline untouched.
+    if (carriedEsc && i === 0 && data[0] === "\u001b" && (data.length === 1 || (data[1] !== "[" && data[1] !== "O"))) {
+      i += 1;
+      continue;
+    }
     if (!state.inPaste && data.startsWith(PASTE_START, i)) { state.inPaste = true; out += PASTE_START; i += PASTE_START.length; continue; }
     if (state.inPaste && data.startsWith(PASTE_END, i)) { state.inPaste = false; out += PASTE_END; i += PASTE_END.length; continue; }
     if (state.inPaste) {

package/src/commands/launch.ts

@@ -1398,7 +1398,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             !chunk.includes(PASTE_END);
           const captured = queueBusyInput?.(chunk) ?? false;
           if (typedEnter) {
-            const line = (queueBusySnapshot?.().text ?? "").trim();
+            // Expand the sentinel here too: a mid-turn paste keeps its line breaks in the
+            // draft, and the steering inbox / command dispatcher both take REAL text — a
+            // raw private-use sentinel would otherwise reach the model verbatim.
+            const line = expandSentinel(queueBusySnapshot?.().text ?? "").trim();
             if (line) {
               // A mid-turn /command or $skill is NOT a query for the model — steering it
               // would send the literal "/model" / "$skill" text to the LLM. Recognize it
@@ -1440,7 +1443,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           // inbox and surfaces as a `user` card (above). JEO_NO_LIVE_DRAFT=1 opts out.
           if (captured && jeoEnv("NO_LIVE_DRAFT") !== "1") {
             const draft = queueBusySnapshot?.().text ?? "";
-            tui.setLivePromptInput(draft);
+            // The live box renders REAL text: expand the sentinel (as the idle box and the
+            // highlight pass below already do) so a mid-turn pasted block shows as separate
+            // rows instead of a run of unprintable private-use glyphs.
+            tui.setLivePromptInput(expandSentinel(draft));
             // Mid-turn command preview: as you type a /command or $skill DURING a turn,
             // show its matches above the input box so command input visibly reacts
             // (idle-prompt parity). Cleared the moment the draft stops being command-shaped.
@@ -2557,7 +2563,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // (the user explicitly invoked them — no second Enter).
   const pendingMidTurnCommands: string[] = [];
   const queuedPromptInput: PromptInputQueue = { pendingLines: pendingStdinLines, partial: startupDraft ?? "", pastedLines: [], inPaste: false };
-  queueBusyInput = (chunk: string) => captureLivePromptInputChunk(queuedPromptInput, chunk);
+  // `multilineInput` gates the SENTINEL contract end to end: a mid-turn paste keeps its
+  // line breaks only when the submit path expands them again (it always does unless
+  // JEO_NO_MULTILINE=1, which degrades the same paste to space-joined text).
+  queueBusyInput = (chunk: string) => captureLivePromptInputChunk(queuedPromptInput, chunk, { multiline: multilineInput });
   queueBusyPasteActive = () => queuedPromptInput.inPaste;
   queueBusySnapshot = () => ({
     text: queuedPromptInput.partial,

package/src/tui/components/input-box.ts

@@ -11,7 +11,8 @@ export interface InputBoxOptions {
   attachmentLabel?: string;
   placeholder?: string;
   maxBodyRows?: number;
-  /** Caret offset in CHARACTERS into `line` (readline's rl.cursor). Defaults to end. */
+  /** Caret offset into `line` in UTF-16 CODE UNITS — exactly `rl.cursor`'s unit, so an
+   *  emoji/astral character before the caret no longer shifts it. Defaults to end. */
   cursor?: number;
   /** Accent painter for the border + `>` prompt mark (theme accent); default red/blue. */
   accent?: (s: string) => string;
@@ -47,6 +48,13 @@ export interface InputFrame {
  * caret's character offset to its (row, columnWidth) cell in the same pass — so the
  * box prompt can place the real terminal cursor exactly where the next glyph lands,
  * and arrow-key movement (readline updates rl.cursor) repositions it visibly.
+ *
+ * `cursor` is a UTF-16 CODE-UNIT offset — the same unit `rl.cursor` uses. Iteration is
+ * per CODE POINT (so an astral char/emoji is one glyph of its own display width), and
+ * the caret is matched against a parallel code-unit counter: without that, every
+ * surrogate pair BEFORE the caret shifted the painted caret one column right of the
+ * real insertion point (the "이모지가 있으면 입력 포인트가 밀려 보임" bug).
+ * `highlights` ranges stay CODE-POINT indexed (see `triggerHighlight` in launch.ts).
  */
 function wrapWithCursor(
   text: string,
@@ -59,8 +67,11 @@ function wrapWithCursor(
   let curW = 0;
   let row = 0;
   let col = 0;
-  const chars = Array.from(text.replace(/\r/g, ""));
-  const pos = Math.max(0, Math.min(cursor, chars.length));
+  const src = text.replace(/\r/g, "");
+  const chars = Array.from(src);
+  const pos = Math.max(0, Math.min(cursor, src.length));
+  let unit = 0; // UTF-16 offset of chars[i], matching `pos`
+  let placed = false;
   for (let i = 0; i <= chars.length; i++) {
     const ch = i < chars.length ? chars[i]! : "";
     const rendered = ch === "\t" ? "  " : ch;
@@ -71,7 +82,10 @@ function wrapWithCursor(
       cur = "";
       curW = 0;
     }
-    if (i === pos) {
+    // `>=` (not `===`) so a caret offset that lands INSIDE a surrogate pair — readline
+    // never parks there, but a resized/derived offset can — still resolves to a cell.
+    if (!placed && unit >= pos) {
+      placed = true;
       row = rows.length;
       col = curW;
     }
@@ -79,14 +93,20 @@ function wrapWithCursor(
       rows.push(cur);
       cur = "";
       curW = 0;
+      unit += 1;
       continue;
     }
     if (ch !== "") {
       const hl = highlights?.find(r => i >= r.start && i < r.end);
       cur += hl ? hl.paint(rendered) : rendered;
       curW += w;
+      unit += ch.length;
     }
   }
+  if (!placed) {
+    row = rows.length;
+    col = curW;
+  }
   rows.push(cur);
   return { rows, row, col };
 }
@@ -202,9 +222,12 @@ export function renderInputBox(line: string, opts: InputBoxOptions = {}): string
   return renderInputFrame(line, opts).lines;
 }
 /** Visual (row, display-col) of every caret position 0..N of `text` wrapped at `width`,
- *  using the SAME wrapping rule as the input box (`wrapWithCursor`). Index i is the caret
- *  sitting BEFORE char i (N = end of text); `cursor` offsets are code points, matching how
- *  `renderInputFrame` clamps `opts.cursor` against `Array.from(text)`. */
+ *  using the SAME wrapping rule as the input box (`wrapWithCursor`). Indexing is by
+ *  UTF-16 CODE UNIT — the unit `rl.cursor` uses — so `cells[rl.cursor]` is always the
+ *  cell readline's caret actually sits on, even in text containing astral characters
+ *  (emoji). A surrogate PAIR contributes two entries with the SAME cell: the pair's
+ *  start, plus the (never-parked-on) mid-pair offset, so every later index stays aligned
+ *  with the string's own offsets. */
 export interface CaretCell {
   row: number;
   col: number;
@@ -221,16 +244,29 @@ export function caretCells(text: string, width: number): CaretCell[] {
     // exact order wrapWithCursor uses, so cell rows match the rendered box rows.
     if (w > 0 && curW + w > width && curW > 0) { row += 1; curW = 0; }
     cells.push({ row, col: curW });
+    // Keep one entry PER CODE UNIT: the extra entry for a surrogate pair's low half
+    // repeats the pair's own cell, so it can never render (or return) a half-character
+    // caret position while keeping `cells[i]` addressable by a raw string offset.
+    for (let extra = 1; extra < ch.length; extra++) cells.push({ row, col: curW });
     if (ch === "\n") { row += 1; curW = 0; continue; }
     if (ch !== "") curW += w;
   }
   return cells;
 }
 
+/** Snap a derived caret offset off the low half of a surrogate pair (a full character is
+ *  the smallest unit the caret may sit on) — `caretCells` deliberately keeps those
+ *  offsets addressable, so every offset RETURNED to readline passes through here. */
+function snapToCharBoundary(text: string, offset: number): number {
+  const code = text.charCodeAt(offset);
+  return offset > 0 && code >= 0xdc00 && code <= 0xdfff ? offset - 1 : offset;
+}
+
 /** New caret offset after an Up/Down move within the wrapped input box, keeping the
  *  display column (textarea convention: snap to the nearest column ≤ the current one on the
  *  target row). Returns null when already on the top row (Up) or bottom row (Down), so the
- *  caller can fall through to readline's input-history recall. */
+ *  caller can fall through to readline's input-history recall. `cursor` and the returned
+ *  offset are UTF-16 code units (`rl.cursor`'s unit), never split a surrogate pair. */
 export function verticalCursorOffset(
   text: string,
   cursor: number,
@@ -255,7 +291,8 @@ export function verticalCursorOffset(
     // Largest column not past the current one — the standard column-preserving snap.
     if (c <= curCol && c > bestCol) { best = p; bestCol = c; }
   }
-  return best !== -1 ? best : firstOnRow;
+  const target = best !== -1 ? best : firstOnRow;
+  return snapToCharBoundary(text, target);
 }
 /** Caret offset at the START or END of the VISUAL ROW containing `cursor`, using the
  *  SAME wrapping rule as the input box (`caretCells`/`wrapWithCursor`). This is the
@@ -282,5 +319,5 @@ export function rowBoundaryOffset(
     if (p < start) start = p;
     if (p > end) end = p;
   }
-  return edge === "start" ? start : end;
+  return snapToCharBoundary(text, edge === "start" ? start : end);
 }

package/src/types/playwriter.d.ts

@@ -0,0 +1,15 @@
+// src/types/playwriter.d.ts
+// Declaration file to allow TypeScript to recognize the optional Playwriter CLI module.
+// This is only needed for the example automation script in scripts/playwriter-apply.ts.
+// The actual Playwriter package is expected to be installed globally or run via npx.
+
+declare module "playwriter" {
+  export class Playwriter {
+    /** Connect to the running Chrome extension bridge */
+    connect(): Promise<void>;
+    /** Open a new page (tab) in the connected browser */
+    newPage(): Promise<any>;
+    /** Disconnect from the bridge */
+    disconnect(): Promise<void>;
+  }
+}

package/src/util/file-attachment.ts

@@ -13,6 +13,8 @@
  * Only paths with a known image extension are considered, so ordinary prose is
  * never mistaken for a file. Non-image / unreadable paths are left untouched.
  */
+import * as os from "node:os";
+import * as path from "node:path";
 import { readFile, stat } from "node:fs/promises";
 import type { ImageAttachment } from "../ai/types";
 
@@ -108,13 +110,16 @@ export function attachmentFromImageBytes(bytes: Uint8Array): ImageAttachment | n
  * Decode one drag-and-drop path token into a usable filesystem path:
  *  - strips matching single/double quotes,
  *  - unescapes backslash-escaped characters (macOS escapes spaces as `\ `),
- *  - resolves a `file://` URI (with percent-decoding).
+ *  - resolves a `file://` URI (with percent-decoding),
+ *  - expands a leading `~` / `~/` to the home directory (gjc parity: a TYPED or
+ *    shell-copied `~/Downloads/shot.png` is a real, attachable path — without this it
+ *    silently failed to resolve and the raw text was sent to the model instead).
  * Returns the cleaned path.
  */
-export function decodeDroppedPath(token: string): string {
+export function decodeDroppedPath(token: string, home: string = os.homedir()): string {
   let s = token.trim();
   if ((s.startsWith("'") && s.endsWith("'")) || (s.startsWith('"') && s.endsWith('"'))) {
-    return s.slice(1, -1);
+    return expandHomePath(s.slice(1, -1), home);
   }
   if (s.startsWith("file://")) {
     let rest = s.slice("file://".length);
@@ -123,7 +128,15 @@ export function decodeDroppedPath(token: string): string {
     try { return decodeURIComponent(rest); } catch { return rest; }
   }
   // Bare token: unescape `\<char>` (shell-style drag escaping).
-  return s.replace(/\\(.)/g, "$1");
+  return expandHomePath(s.replace(/\\(.)/g, "$1"), home);
+}
+
+/** `~` / `~/rest` → the home directory. A bare `~user` form is left alone (jeo cannot
+ *  resolve another account's home portably). */
+function expandHomePath(p: string, home: string): string {
+  if (p === "~") return home;
+  if (p.startsWith("~/")) return path.join(home, p.slice(2));
+  return p;
 }
 
 export interface PathToken {
@@ -222,7 +235,14 @@ export async function attachImagePaths(
   out += text.slice(cursor);
   if (images.length === 0) return { text: out, images, cursor: out.length };
   // Collapse the spacing terminals add around a dropped path so the swapped-in tag
-  // (and the caret parked after it) is not pushed several columns to the right.
-  const normalized = normalizeImageTags(out);
+  // (and the caret parked after it) is not pushed several columns to the right, then
+  // guarantee EXACTLY ONE trailing space when the last tag ends the draft — identical
+  // to `insertImageTag`'s Ctrl+V contract. Without it `normalizeImageTags`'s trim left
+  // the caret hard against `]` and the next typed word glued onto the tag
+  // ("[image #1]please"); with it, both attach paths behave the same.
+  let normalized = normalizeImageTags(out);
+  const lastTag = `[image #${n - 1}]`;
+  const lastIdx = normalized.indexOf(lastTag);
+  if (lastIdx >= 0 && lastIdx + lastTag.length >= normalized.length) normalized += " ";
   return { text: normalized, images, cursor: caretAfterTag(normalized, n - 1) };
 }