jeo-code 0.9.3 → 0.9.4

package/CHANGELOG.md

@@ -8,6 +8,21 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.9.4] - 2026-07-27
+_Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support._
+
+### Added
+- **Live OpenAI/Codex models after login** (`src/commands/auth.ts`, `src/ai/model-discovery.ts`) — immediately probes the authenticated account's Codex models endpoint after manual or interactive OpenAI login, prefers that OAuth credential for the report, and keeps login successful when discovery is unavailable.
+- **Pinned self-update targets** (`src/commands/update.ts`) — `jeo update --version <semver>` resolves and installs an exact published release without falling back to npm `latest`.
+
+### Fixed
+- **npm package-content CI guard** (`.github/workflows/npm-publish.yml`) — asserts `npm pack --dry-run --json` against git-tracked files, required release files, and forbidden test/runtime artifacts before publishing.
+
+### Verified
+- Release-focused suite: 148 pass / 0 fail across model discovery, update, package workflow, Codex responses, model manager, and catalog tests.
+- `bun run typecheck`: clean.
+- Clean-worktree package manifest excludes the previously leaked monitor/playwriter files.
+
 ## [0.9.3] - 2026-07-26
 _Released Telegram integration reliability improvements adapted from GJC v0.11.10, with safe jeo-native behavior and live verification._
 

package/README.ja.md

@@ -285,10 +285,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 - **[0.9.3]** (2026-07-26) — Released Telegram integration reliability improvements adapted from GJC v0.11.10, with safe jeo-native behavior and live verification.
 - **[0.9.2]** (2026-07-26) — Released the jeo-native GJC v0.11.6–v0.11.9 parity improvements after a complete cross-audit and live verification pass.
 - **[0.9.1]** (2026-07-24) — User request (paraphrased, Korean): "make the TUI resize responsively like gjc's TUI when terminal width/height changes, without breaking the layout — also borrow forge's layout and table components." Investigated the existing resize infrastructure first (already extensive: throttled live-frame resize repaint, a poll-based SIGWINCH safety net, resize-aware interactive pickers) before assuming a gap. Found one concrete un-responsive panel — `jeo doctor`'s Provider connectivity table — and, while rebuilding it on forge's own box-drawn table renderer, also found and fixed a real, previously-unknown overflow bug in `formatForgeBox` itself, shared by every tool card across the whole live TUI.
-- **[0.9.0]** (2026-07-22) — Session-scoped async execution, detached subagent control, background monitors, and parallel TUI activity are now documented and shipped for the gjc-parity release line.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -286,10 +286,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 - **[0.9.3]** (2026-07-26) — Released Telegram integration reliability improvements adapted from GJC v0.11.10, with safe jeo-native behavior and live verification.
 - **[0.9.2]** (2026-07-26) — Released the jeo-native GJC v0.11.6–v0.11.9 parity improvements after a complete cross-audit and live verification pass.
 - **[0.9.1]** (2026-07-24) — User request (paraphrased, Korean): "make the TUI resize responsively like gjc's TUI when terminal width/height changes, without breaking the layout — also borrow forge's layout and table components." Investigated the existing resize infrastructure first (already extensive: throttled live-frame resize repaint, a poll-based SIGWINCH safety net, resize-aware interactive pickers) before assuming a gap. Found one concrete un-responsive panel — `jeo doctor`'s Provider connectivity table — and, while rebuilding it on forge's own box-drawn table renderer, also found and fixed a real, previously-unknown overflow bug in `formatForgeBox` itself, shared by every tool card across the whole live TUI.
-- **[0.9.0]** (2026-07-22) — Session-scoped async execution, detached subagent control, background monitors, and parallel TUI activity are now documented and shipped for the gjc-parity release line.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -293,10 +293,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 - **[0.9.3]** (2026-07-26) — Released Telegram integration reliability improvements adapted from GJC v0.11.10, with safe jeo-native behavior and live verification.
 - **[0.9.2]** (2026-07-26) — Released the jeo-native GJC v0.11.6–v0.11.9 parity improvements after a complete cross-audit and live verification pass.
 - **[0.9.1]** (2026-07-24) — User request (paraphrased, Korean): "make the TUI resize responsively like gjc's TUI when terminal width/height changes, without breaking the layout — also borrow forge's layout and table components." Investigated the existing resize infrastructure first (already extensive: throttled live-frame resize repaint, a poll-based SIGWINCH safety net, resize-aware interactive pickers) before assuming a gap. Found one concrete un-responsive panel — `jeo doctor`'s Provider connectivity table — and, while rebuilding it on forge's own box-drawn table renderer, also found and fixed a real, previously-unknown overflow bug in `formatForgeBox` itself, shared by every tool card across the whole live TUI.
-- **[0.9.0]** (2026-07-22) — Session-scoped async execution, detached subagent control, background monitors, and parallel TUI activity are now documented and shipped for the gjc-parity release line.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -285,10 +285,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 - **[0.9.3]** (2026-07-26) — Released Telegram integration reliability improvements adapted from GJC v0.11.10, with safe jeo-native behavior and live verification.
 - **[0.9.2]** (2026-07-26) — Released the jeo-native GJC v0.11.6–v0.11.9 parity improvements after a complete cross-audit and live verification pass.
 - **[0.9.1]** (2026-07-24) — User request (paraphrased, Korean): "make the TUI resize responsively like gjc's TUI when terminal width/height changes, without breaking the layout — also borrow forge's layout and table components." Investigated the existing resize infrastructure first (already extensive: throttled live-frame resize repaint, a poll-based SIGWINCH safety net, resize-aware interactive pickers) before assuming a gap. Found one concrete un-responsive panel — `jeo doctor`'s Provider connectivity table — and, while rebuilding it on forge's own box-drawn table renderer, also found and fixed a real, previously-unknown overflow bug in `formatForgeBox` itself, shared by every tool card across the whole live TUI.
-- **[0.9.0]** (2026-07-22) — Session-scoped async execution, detached subagent control, background monitors, and parallel TUI activity are now documented and shipped for the gjc-parity release line.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/model-discovery.ts

@@ -39,6 +39,15 @@ export interface DiscoveryOptions {
   limit?: number;
   /** Config snapshot used for provider base URLs. */
   config?: Config;
+  /**
+   * Narrowly scoped for the post-login report (`jeo auth login openai`): keep
+   * the just-stored OAuth credential even when an unrelated `providers.openai`
+   * API key is also configured, so the report reflects the account that was
+   * JUST logged in rather than silently swapping to the API key. Does not
+   * change any other discovery caller — the TUI/`discoverModels` default
+   * (API key preferred when configured) is untouched.
+   */
+  preferOAuth?: boolean;
 }
 
 const DEFAULT_TIMEOUT = 5000;
@@ -48,7 +57,7 @@ const DEFAULT_LIMIT = 100;
 // to receive the full current list (verified live 2026-06-12: 0.46→[], 0.99→gpt-5.4,
 // 1.0/2.0→full gpt-5.5 set). On drift the catalog fallback keeps Codex usable.
 const CODEX_CLIENT_VERSION = "2.0.0";
-const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${CODEX_CLIENT_VERSION}`;
+export const CODEX_MODELS_URL = `https://chatgpt.com/backend-api/codex/models?client_version=${CODEX_CLIENT_VERSION}`;
 const ANTIGRAVITY_MODELS_URL = "https://daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels";
 const ANTIGRAVITY_MODEL_DENYLIST = new Set([
   "chat_20706",
@@ -360,7 +369,9 @@ export async function listProviderModels(
     const prov = authProvider!;
     // Antigravity's list endpoint accepts ONLY OAuth (the request builder sends
     // no api-key header), so never swap its credential to an api_key.
-    if (provider !== "antigravity" && cred.kind === "oauth" && config.providers?.[prov]) {
+    // `preferOAuth` (post-login report only) skips this swap so the report
+    // reflects the freshly stored OAuth credential, not an unrelated key.
+    if (provider !== "antigravity" && cred.kind === "oauth" && config.providers?.[prov] && !opts.preferOAuth) {
       // An API key is the broader, documented path — prefer it for live discovery.
       cred = { kind: "api_key", provider: prov, token: config.providers[prov]! };
       source = "api_key";

package/src/cli/runner.ts

@@ -217,7 +217,7 @@ export const COMMANDS: readonly CommandSpec[] = [
   {
     name: "update",
     summary: "Update jeo-code to the latest npm release (bare = install; --check only checks).",
-    usage: "update [--check|--install] [--json] [--strict]",
+    usage: "update [--check|--install] [--json] [--strict] [--version <semver>]",
     loader: async () => {
       const m = await import("../commands/update");
       return args => m.runUpdateCommand(args);

package/src/commands/auth.ts

@@ -5,6 +5,7 @@ import { type StoredOAuth } from "../agent/state";
 import { createInterface } from "node:readline/promises";
 import { readGlobalConfig } from "../agent/state";
 import { jeoEnv } from "../util/env";
+import { listProviderModels, CODEX_MODELS_URL } from "../ai/model-discovery";
 import {
   OAUTH_FLOWS,
   OAUTH_FLOW_REGISTRY,
@@ -121,6 +122,7 @@ async function runAuthLogin(rest: string[]): Promise<void> {
     rl.close();
     await loginOAuth(chosen, manualToken.trim());
     console.log(`[SUCCESS] Stored manual OAuth bearer for ${chosen} (no auto-refresh).`);
+    if (chosen === "openai") await reportOpenAiCodexModels();
     return;
   }
 
@@ -128,6 +130,7 @@ async function runAuthLogin(rest: string[]): Promise<void> {
     const { email } = await interactiveOAuthLogin(chosen, rl);
     console.log(`\n[SUCCESS] OAuth login complete for ${chosen}${email ? ` (${email})` : ""}.`);
     console.log("Stored access + refresh tokens in ~/.jeo/config.json; jeo will auto-refresh on expiry.");
+    if (chosen === "openai") await reportOpenAiCodexModels();
   } catch (err) {
     console.log(`\n[FAILED] ${(err as Error).message}`);
     console.log("Tip: paste the redirect URL when prompted, or use 'jeo auth login <provider> --token <bearer>'.");
@@ -137,6 +140,27 @@ async function runAuthLogin(rest: string[]): Promise<void> {
   }
 }
 
+/**
+ * Best-effort, timeout-bounded live Codex model check run immediately after a
+ * successful `jeo auth login openai`. Uses `preferOAuth` so the report reflects
+ * the account that was JUST logged in — never the catalog fallback, and never
+ * silently swapped to an unrelated pre-existing `providers.openai` API key.
+ * A failure here is NEVER fatal: login has already succeeded and is not rolled
+ * back by this check. Prints only model ids/count — no tokens/secrets.
+ */
+async function reportOpenAiCodexModels(): Promise<void> {
+  try {
+    const result = await listProviderModels("openai", { preferOAuth: true });
+    if (result.ok) {
+      console.log(`Live Codex models (${result.models.length}): ${result.models.join(", ")}`);
+    } else {
+      console.log(`[WARN] Could not verify live Codex models from ${CODEX_MODELS_URL}: ${result.error ?? "unknown error"} (non-fatal — login succeeded).`);
+    }
+  } catch (err) {
+    console.log(`[WARN] Could not verify live Codex models from ${CODEX_MODELS_URL}: ${(err as Error).message} (non-fatal — login succeeded).`);
+  }
+}
+
 async function runAuthImport(rest: string[]): Promise<void> {
   const provider = rest.find(a => a !== "--import") as AuthProvider | undefined;
   if (!provider) {

package/src/commands/update.ts

@@ -120,15 +120,42 @@ export async function runUpdateCommandWith(args: string[], deps: UpdateDeps): Pr
   const hasJson = args.includes("--json");
   const hasStrict = args.includes("--strict");
 
-  const KNOWN_FLAGS = new Set(["--check", "--install", "--json", "--strict", "-h", "--help"]);
+  const KNOWN_FLAGS = new Set(["--check", "--install", "--json", "--strict", "--version", "-h", "--help"]);
+  // A semver-ish shape: MAJOR.MINOR.PATCH with optional -prerelease and/or +build metadata,
+  // matching what the npm registry actually publishes (and what activeVersion() parses back out).
+  const SEMVER_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
 
   if (isHelp) {
     printUsage();
     return;
   }
 
-  // Check for unknown flags
-  for (const arg of args) {
+  // `--version <semver>` pins the exact npm release instead of always resolving `/latest`
+  // (the recurrence-prevention escape hatch: pin a known-good release, or roll back off a
+  // bad one). It consumes the following arg as its value, so unknown-flag scanning below
+  // must skip that value instead of flagging it.
+  const versionFlagIdx = args.indexOf("--version");
+  let pinnedVersion: string | undefined;
+  let pinnedVersionError: string | null = null;
+  if (versionFlagIdx !== -1) {
+    const value = args[versionFlagIdx + 1];
+    if (value === undefined || value.startsWith("--")) {
+      pinnedVersionError = "--version requires a semver value, e.g. --version 1.2.3";
+    } else if (!SEMVER_RE.test(value)) {
+      pinnedVersionError = `--version value "${value}" is not a valid semver (expected e.g. 1.2.3)`;
+    } else {
+      pinnedVersion = value;
+    }
+  }
+
+  // Check for unknown flags (skipping --version's consumed value, valid or not — it was
+  // already validated above, not a flag to re-check here).
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--version") {
+      i++;
+      continue;
+    }
     if (!KNOWN_FLAGS.has(arg)) {
       console.log(`Unknown flag: ${arg}`);
       printUsage();
@@ -138,18 +165,45 @@ export async function runUpdateCommandWith(args: string[], deps: UpdateDeps): Pr
   }
 
   const current = deps.localVersion();
+
+  if (pinnedVersionError) {
+    if (hasJson) {
+      console.log(JSON.stringify({
+        current,
+        latest: null,
+        upToDate: false,
+        error: pinnedVersionError
+      }));
+    } else {
+      console.error(`Error: ${pinnedVersionError}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+
   let latest: string | null = null;
   let upToDate = false;
 
+  const registryUrl = pinnedVersion
+    ? `https://registry.npmjs.org/jeo-code/${encodeURIComponent(pinnedVersion)}`
+    : "https://registry.npmjs.org/jeo-code/latest";
+
   try {
     const signal = AbortSignal.timeout(10000);
-    const data = await deps.fetchJson("https://registry.npmjs.org/jeo-code/latest", { signal });
+    const data = await deps.fetchJson(registryUrl, { signal });
     if (!data || typeof data.version !== "string") {
       throw new Error("Invalid response format from npm registry");
     }
+    if (pinnedVersion && data.version !== pinnedVersion) {
+      // Defensive: the registry must echo back exactly the pinned version we asked for —
+      // never silently install something else because of a registry quirk.
+      throw new Error(`Registry returned version ${data.version}, expected pinned ${pinnedVersion}`);
+    }
     latest = data.version as string;
     const cmp = compareVersions(current, latest);
-    upToDate = cmp >= 0;
+    // Choice: pinning is an exact-match target (rollback-capable) — only skip the install
+    // when current already equals the pin. Latest-mode keeps its "don't downgrade" rule.
+    upToDate = pinnedVersion ? cmp === 0 : cmp >= 0;
   } catch (err: any) {
     const is404 = err.status === 404 || String(err.message).includes("404") || String(err.message).toLowerCase().includes("not found");
     if (is404) {
@@ -157,28 +211,36 @@ export async function runUpdateCommandWith(args: string[], deps: UpdateDeps): Pr
         console.log(JSON.stringify({
           current,
           latest: null,
-          upToDate: true,
-          error: "Package not found on registry"
+          upToDate: pinnedVersion ? false : true,
+          error: pinnedVersion ? `Version ${pinnedVersion} not found on registry` : "Package not found on registry"
         }));
       } else {
-        console.log("Package not found on registry: jeo-code");
+        console.log(pinnedVersion ? `Version ${pinnedVersion} not found on registry: jeo-code` : "Package not found on registry: jeo-code");
+      }
+      // A pinned version that doesn't exist on the registry is a real, actionable error —
+      // unlike the bare-latest 404 case, this always exits nonzero regardless of --strict.
+      if (pinnedVersion) {
+        process.exitCode = 1;
       }
       return;
     } else {
       // Network failure
       const errMsg = err.message || String(err);
+      const contextMsg = pinnedVersion
+        ? `Network failure while resolving pinned version ${pinnedVersion}: ${errMsg}`
+        : `Network failure: ${errMsg}`;
       if (hasJson) {
         console.log(JSON.stringify({
           current,
           latest: null,
           upToDate: false,
-          error: `Network failure: ${errMsg}`
+          error: contextMsg
         }));
       } else {
         if (hasStrict) {
-          console.error(`Error: Network failure: ${errMsg}`);
+          console.error(`Error: ${contextMsg}`);
         } else {
-          console.warn(`Warning: Network failure: ${errMsg}`);
+          console.warn(`Warning: ${contextMsg}`);
         }
       }
       if (hasStrict) {
@@ -204,11 +266,15 @@ export async function runUpdateCommandWith(args: string[], deps: UpdateDeps): Pr
           installed: false
         }));
       } else {
-        console.log(`jeo-code is already up-to-date (${current}).`);
+        console.log(pinnedVersion
+          ? `jeo-code is already at the pinned version (${current}).`
+          : `jeo-code is already up-to-date (${current}).`);
       }
     } else {
       if (!hasJson) {
-        console.log(`Installing update: ${current} -> ${latest}...`);
+        console.log(pinnedVersion
+          ? `Installing pinned version: ${current} -> ${latest}...`
+          : `Installing update: ${current} -> ${latest}...`);
       }
       try {
         const result = await deps.install(latest ?? undefined);
@@ -294,7 +360,9 @@ export async function runUpdateCommandWith(args: string[], deps: UpdateDeps): Pr
           upToDate: true
         }));
       } else {
-        console.log(`jeo-code is up-to-date (${current}).`);
+        console.log(pinnedVersion
+          ? `jeo-code is already at the pinned version (${current}).`
+          : `jeo-code is up-to-date (${current}).`);
       }
     } else {
       if (hasJson) {
@@ -304,8 +372,12 @@ export async function runUpdateCommandWith(args: string[], deps: UpdateDeps): Pr
           upToDate: false
         }));
       } else {
-        console.log(`Newer version available: ${latest} (current: ${current}).`);
-        console.log("Run 'jeo update' to install it.");
+        console.log(pinnedVersion
+          ? `Pinned version ${latest} differs from current (${current}).`
+          : `Newer version available: ${latest} (current: ${current}).`);
+        console.log(pinnedVersion
+          ? `Run 'jeo update --version ${latest}' to install it.`
+          : "Run 'jeo update' to install it.");
       }
     }
   }
@@ -320,6 +392,8 @@ function printUsage() {
   console.log("  (default)    Check and install if a newer version is available");
   console.log("  --check      Only check; do not install");
   console.log("  --install    Force install if newer (also used with --json)");
+  console.log("  --version <semver>  Pin an exact npm release instead of resolving latest");
+  console.log("                      (e.g. --version 1.2.3); combine with --install to apply it");
   console.log("  --json       Output result in JSON format");
   console.log("  --strict     Exit with code 1 on network/registry errors");
   console.log("  -h, --help   Show this help message");