jeo-code 0.9.7 → 0.9.8

package/CHANGELOG.md

@@ -8,6 +8,21 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.9.8] - 2026-07-27
+_The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity)._
+
+### Added
+- **Persistent live model catalog** (`src/ai/model-cache.ts`) — every successful discovery is written to `~/.jeo/model-catalog-cache.json` and rehydrated at the next launch, before any network call. `jeo auth login openai` persists the account's Codex list immediately.
+
+### Fixed
+- **Newly released OpenAI models were rejected at cold start** (`src/ai/model-cache.ts`, `src/commands/launch.ts`) — the OAuth Codex gate only knew the maintained static snapshot until this launch's own discovery landed, so an account that already serves `gpt-5.6-luna`/`-sol`/`-terra` could not select them for the first seconds of a session. Rehydration seeds the gate, routing, and the pickers from the account's own last-reported list.
+- **Cold-start model completion fell back to the static catalog** (`src/commands/launch.ts`) — tab completion and `modelsForProvider` now use the persisted per-provider lists until live discovery replaces them.
+
+### Verified
+- Model cache suite: 11 pass / 0 fail (round-trip, gate rehydration, api_key vs oauth scoping, offline/merge safety, corrupt-file degradation, test-write hermeticity).
+- Model/provider suite: 169 pass / 0 fail across discovery, catalog, routing, pickers, `/model`, OpenAI OAuth, and autocomplete.
+- Live account check: discovery persisted 4 providers; a fresh process turned `gpt-5.6-luna` from rejected into servable purely from disk.
+
 ## [0.9.7] - 2026-07-27
 _Fixes the broken 0.9.3-0.9.6 npm releases: `jeo` and `jeo --tmux` crashed at startup right after `jeo update`._
 

package/README.ja.md

@@ -285,10 +285,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 - **[0.9.7]** (2026-07-27) — Fixes the broken 0.9.3-0.9.6 npm releases: `jeo` and `jeo --tmux` crashed at startup right after `jeo update`.
 - **[0.9.6]** (2026-07-27) — Resize-safe ledger flush and terminal clear handling after viewport shrink.
 - **[0.9.5]** (2026-07-27) — Resize-safe live TUI rendering for terminal viewport shrink/grow transitions.
-- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -286,10 +286,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 - **[0.9.7]** (2026-07-27) — Fixes the broken 0.9.3-0.9.6 npm releases: `jeo` and `jeo --tmux` crashed at startup right after `jeo update`.
 - **[0.9.6]** (2026-07-27) — Resize-safe ledger flush and terminal clear handling after viewport shrink.
 - **[0.9.5]** (2026-07-27) — Resize-safe live TUI rendering for terminal viewport shrink/grow transitions.
-- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -293,10 +293,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 - **[0.9.7]** (2026-07-27) — Fixes the broken 0.9.3-0.9.6 npm releases: `jeo` and `jeo --tmux` crashed at startup right after `jeo update`.
 - **[0.9.6]** (2026-07-27) — Resize-safe ledger flush and terminal clear handling after viewport shrink.
 - **[0.9.5]** (2026-07-27) — Resize-safe live TUI rendering for terminal viewport shrink/grow transitions.
-- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -285,10 +285,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.9.8]** (2026-07-27) — The provider model list now persists and rehydrates, so an account's live models survive across launches (gjc parity).
 - **[0.9.7]** (2026-07-27) — Fixes the broken 0.9.3-0.9.6 npm releases: `jeo` and `jeo --tmux` crashed at startup right after `jeo update`.
 - **[0.9.6]** (2026-07-27) — Resize-safe ledger flush and terminal clear handling after viewport shrink.
 - **[0.9.5]** (2026-07-27) — Resize-safe live TUI rendering for terminal viewport shrink/grow transitions.
-- **[0.9.4]** (2026-07-27) — Real OpenAI/Codex model discovery after login, npm package-content hardening, and pinned self-update support.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/ai/index.ts

@@ -2,6 +2,7 @@ export * from "./types";
 export * from "./model-manager";
 export * from "./provider-status";
 export * from "./model-discovery";
+export * from "./model-cache";
 export * from "./model-picker";
 export * from "./model-catalog";
 export * from "./model-enrich";

package/src/ai/model-cache.ts

@@ -0,0 +1,163 @@
+/**
+ * Persistent cache of the model lists providers reported from their OWN endpoints.
+ *
+ * Live discovery (`listProviderModels`) already asks each authenticated provider
+ * what it serves, but the answer only ever lived in this process: every launch
+ * started blind, showed the maintained static snapshot until the network call
+ * returned, and — worse — the OAuth Codex gate (`isCodexModel`) rejected any model
+ * newer than that snapshot, so an account that had `gpt-5.6-*` could not select it
+ * until discovery happened to finish first.
+ *
+ * Persisting the discovered lists (gjc parity) closes both gaps: the next launch
+ * rehydrates the account's REAL model set from disk before any network call, and a
+ * background refresh keeps it current. The cache is an optimization — a missing,
+ * corrupt, or stale file only means "fall back to live discovery + static catalog",
+ * never an error.
+ */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { jeoEnv } from "../util/env";
+import { recordLiveCodexModels, recordLiveProviderModels } from "./model-catalog";
+import type { ProviderName } from "./types";
+
+/** How a provider's list was obtained; mirrors `ProviderModelsResult["source"]`. */
+export type ModelCacheSource = "oauth" | "api_key" | "keyless" | "none";
+
+export interface CachedProviderModels {
+  provider: ProviderName;
+  models: string[];
+  source: ModelCacheSource;
+  /** Base URL the list came from, so an OpenAI-compatible endpoint's ids stay scoped to it. */
+  baseUrl?: string;
+}
+
+export interface ModelCacheFile {
+  version: 1;
+  updatedAt: number;
+  providers: CachedProviderModels[];
+}
+
+const CACHE_VERSION = 1;
+/** Refresh in the background once the cache is older than this (6h). */
+export const MODEL_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
+/** Bound a single provider's persisted list so a pathological aggregator cannot bloat the file. */
+const MAX_MODELS_PER_PROVIDER = 500;
+
+function cacheDir(): string {
+  return jeoEnv("CONFIG_DIR") || path.join(os.homedir(), ".jeo");
+}
+
+function cachePath(): string {
+  return path.join(cacheDir(), "model-catalog-cache.json");
+}
+
+/** Keep only well-formed entries; a hand-edited or partially-written file must not throw. */
+export function normalizeCacheEntries(raw: unknown): CachedProviderModels[] {
+  if (!Array.isArray(raw)) return [];
+  const out: CachedProviderModels[] = [];
+  for (const entry of raw) {
+    const row = entry as Partial<CachedProviderModels>;
+    if (!row || typeof row.provider !== "string" || !Array.isArray(row.models)) continue;
+    const models = row.models.filter((m): m is string => typeof m === "string" && m.trim().length > 0).slice(0, MAX_MODELS_PER_PROVIDER);
+    if (models.length === 0) continue;
+    out.push({
+      provider: row.provider as ProviderName,
+      models,
+      source: row.source === "oauth" || row.source === "api_key" || row.source === "keyless" ? row.source : "none",
+      ...(typeof row.baseUrl === "string" && row.baseUrl ? { baseUrl: row.baseUrl } : {}),
+    });
+  }
+  return out;
+}
+
+/** Read the persisted lists, or null when absent/unreadable/incompatible. */
+export async function readModelCache(): Promise<ModelCacheFile | null> {
+  try {
+    const parsed = JSON.parse(await readFile(cachePath(), "utf-8")) as Partial<ModelCacheFile>;
+    if (!parsed || parsed.version !== CACHE_VERSION) return null;
+    const providers = normalizeCacheEntries(parsed.providers);
+    if (providers.length === 0) return null;
+    return {
+      version: CACHE_VERSION,
+      updatedAt: typeof parsed.updatedAt === "number" ? parsed.updatedAt : 0,
+      providers,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** True when the cache is missing or older than the TTL, i.e. a refresh is worth doing. */
+export function isModelCacheStale(cache: ModelCacheFile | null, now = Date.now(), ttlMs = MODEL_CACHE_TTL_MS): boolean {
+  if (!cache) return true;
+  return now - cache.updatedAt >= ttlMs;
+}
+
+/**
+ * Merge fresh discovery results over the existing cache. Providers absent from
+ * `results` (not logged in this run, or a transient failure) keep their previous
+ * entry, so one offline launch never erases a known-good list.
+ */
+export function mergeCacheEntries(
+  previous: readonly CachedProviderModels[],
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string }[],
+): CachedProviderModels[] {
+  const byKey = new Map<string, CachedProviderModels>();
+  const keyOf = (provider: string, baseUrl?: string) => `${provider}\u0000${baseUrl ?? ""}`;
+  for (const entry of previous) byKey.set(keyOf(entry.provider, entry.baseUrl), entry);
+  for (const result of results) {
+    if (!result.ok || result.models.length === 0) continue;
+    byKey.set(keyOf(result.provider, result.baseUrl), {
+      provider: result.provider,
+      models: [...result.models].slice(0, MAX_MODELS_PER_PROVIDER),
+      source: result.source ?? "none",
+      ...(result.baseUrl ? { baseUrl: result.baseUrl } : {}),
+    });
+  }
+  return [...byKey.values()];
+}
+
+/** Persist discovery results (best-effort; never throws, never blocks a turn). */
+export async function writeModelCache(
+  results: readonly { provider: ProviderName; models: readonly string[]; ok: boolean; source?: ModelCacheSource; baseUrl?: string }[],
+): Promise<void> {
+  // Same hermeticity rule as saveGlobalConfig: a test run may only write into an
+  // explicitly sandboxed JEO_CONFIG_DIR, never the developer's real ~/.jeo.
+  if (process.env.NODE_ENV === "test" && !jeoEnv("CONFIG_DIR")) return;
+  try {
+    const existing = await readModelCache();
+    const providers = mergeCacheEntries(existing?.providers ?? [], results);
+    if (providers.length === 0) return;
+    const payload: ModelCacheFile = { version: CACHE_VERSION, updatedAt: Date.now(), providers };
+    await mkdir(cacheDir(), { recursive: true, mode: 0o700 });
+    await writeFile(cachePath(), JSON.stringify(payload, null, 2), { encoding: "utf-8", mode: 0o600 });
+  } catch {
+    // A cache write failure must never surface to the user.
+  }
+}
+
+/**
+ * Feed cached lists into the in-process registries so pickers, autocomplete,
+ * routing, and — critically — the OAuth Codex gate know the account's real models
+ * BEFORE the first network call of this launch. Returns the number of ids applied.
+ */
+export function applyCachedModels(cache: ModelCacheFile | null): number {
+  if (!cache) return 0;
+  let applied = 0;
+  for (const entry of cache.providers) {
+    recordLiveProviderModels(entry.provider, entry.models, { source: entry.source, baseUrl: entry.baseUrl });
+    // An OAuth-sourced OpenAI list IS the Codex allow-list; without this the gate
+    // still rejects any model newer than the maintained static snapshot.
+    if (entry.provider === "openai" && entry.source === "oauth") recordLiveCodexModels(entry.models);
+    applied += entry.models.length;
+  }
+  return applied;
+}
+
+/** Read + apply in one step. Returns the cache so callers can decide about refreshing. */
+export async function rehydrateLiveModels(): Promise<ModelCacheFile | null> {
+  const cache = await readModelCache();
+  applyCachedModels(cache);
+  return cache;
+}

package/src/commands/auth.ts

@@ -6,6 +6,7 @@ import { createInterface } from "node:readline/promises";
 import { readGlobalConfig } from "../agent/state";
 import { jeoEnv } from "../util/env";
 import { listProviderModels, CODEX_MODELS_URL } from "../ai/model-discovery";
+import { writeModelCache } from "../ai/model-cache";
 import {
   OAUTH_FLOWS,
   OAUTH_FLOW_REGISTRY,
@@ -152,6 +153,10 @@ async function reportOpenAiCodexModels(): Promise<void> {
   try {
     const result = await listProviderModels("openai", { preferOAuth: true });
     if (result.ok) {
+      // Persist immediately: the very next `jeo` launch then knows this account's
+      // real model set (including ids newer than the maintained static snapshot)
+      // before it makes any network call.
+      await writeModelCache([result]);
       console.log(`Live Codex models (${result.models.length}): ${result.models.join(", ")}`);
     } else {
       console.log(`[WARN] Could not verify live Codex models from ${CODEX_MODELS_URL}: ${result.error ?? "unknown error"} (non-fatal — login succeeded).`);

package/src/commands/launch.ts

@@ -55,6 +55,7 @@ import { friendlyProviderError } from "../util/provider-error";
 import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/state";
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
+import { rehydrateLiveModels, writeModelCache } from "../ai/model-cache";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
 import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, credentialScopeFor, resolveVerifierModel, type PromptTier, type RouteDecision, type RoutingConfig } from "../agent/prompt-router";
@@ -692,10 +693,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let sessionComputerOverride: boolean | undefined;
 
   // Cache of live, credential-validated models per provider (refreshed by live pickers).
+  // Every successful discovery is also persisted (`writeModelCache`), so the NEXT launch
+  // starts from the account's real model set instead of the maintained static snapshot.
   let liveModelsCache: ProviderModelsResult[] | null = null;
   const getLiveModels = async (force = false): Promise<ProviderModelsResult[]> => {
     if (force || !liveModelsCache) {
       liveModelsCache = await discoverModels({ timeoutMs: 4000 });
+      void writeModelCache(liveModelsCache);
     }
     return liveModelsCache;
   };
@@ -2352,7 +2356,14 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // Tab autocomplete: alias names snapshotted once; live models come from the
   // background-warmed cache (logged-in/OAuth accounts). The completer is sync, so
   // it never blocks on the network — it reads whatever the cache currently holds.
+  //
+  // Disk rehydration runs FIRST and synchronously-awaited: it costs one small file
+  // read but makes the account's real model set (including ids newer than the
+  // maintained static snapshot) available to the picker, autocomplete, routing, and
+  // the OAuth Codex gate from the first keystroke, instead of only after the network
+  // discovery below happens to land.
   const aliasNames = Object.keys(await listAliases());
+  const cachedModels = await rehydrateLiveModels().catch(() => null);
   void getLiveModels()
     .then(r => {
       liveModelsCache ??= r;
@@ -2361,13 +2372,20 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const mentionPaths = (prefix: string): string[] => mentionPathsIn(cwd, prefix);
   const completionContext = (): CompletionContext => {
     const base = staticCompletionContext();
+    // Until this launch's own discovery lands, completion falls back to the models
+    // the account reported on a PREVIOUS run. Without the fallback a cold start
+    // offered only the static catalog, so freshly released ids the user already has
+    // access to were un-completable for the first seconds of every session.
+    const liveFromDiscovery = liveModelsCache ? flattenModels(liveModelsCache).map(e => e.model) : null;
+    const cachedFor = (p: string): string[] =>
+      cachedModels?.providers.filter(entry => entry.provider === p).flatMap(entry => entry.models) ?? [];
     return {
       ...base,
       slashCommands: [...base.slashCommands, ...skillSlashDetails.map(d => d.command)],
-      liveModels: liveModelsCache ? flattenModels(liveModelsCache).map(e => e.model) : [],
+      liveModels: liveFromDiscovery ?? (cachedModels?.providers.flatMap(entry => entry.models) ?? []),
       aliases: aliasNames,
       skillNames: resolvedSkillTokens,
-      modelsForProvider: p => liveModelsCache?.find(r => r.provider === p)?.models ?? [],
+      modelsForProvider: p => liveModelsCache?.find(r => r.provider === p)?.models ?? cachedFor(p),
       mentionPaths,
     };
   };