jeo-code 0.11.1 → 0.11.3

package/src/commands/approve.ts

@@ -67,11 +67,6 @@ export async function approvePlan(planPathInput: string, cwd: string): Promise<A
     };
   }
 
-  // Idempotency: check if already approved
-  if (ralplanState.approved) {
-    return { ok: true, message: `[SUCCESS] Plan is already approved.` };
-  }
-
   // Round-10 #4 (architect ref 8-Round10Planning): approval is a GATE, not a
   // rubber stamp — validate the plan against the exact contract `jeo team`
   // enforces, so a schema-invalid/unknown-role plan is refused HERE instead of
@@ -118,17 +113,27 @@ export async function approvePlan(planPathInput: string, cwd: string): Promise<A
     };
   }
 
-  // Round-13: verify the plan's hash matches the consensus hash to prevent silent edits
-  if (ralplanState.consensus_hash) {
-    const currentHash = createHash("sha256").update(planContent).digest("hex");
-    if (currentHash !== ralplanState.consensus_hash) {
-      return {
-        ok: false,
-        message:
-          `[ERROR] Refusing to approve: the plan file has been modified since the consensus critic reviewed it.\n` +
-          `  Re-run 'jeo ralplan' to let the critic review the updated plan, then approve again.`,
-      };
-    }
+  // Approval and idempotent re-approval both require the exact reviewed bytes.
+  if (!ralplanState.consensus_hash) {
+    return {
+      ok: false,
+      message:
+        `[ERROR] Refusing to approve: the plan lacks a consensus review hash.\n` +
+        `  Re-run 'jeo ralplan' so the consensus critic can review the plan, then approve again.`,
+    };
+  }
+  const currentHash = createHash("sha256").update(planContent).digest("hex");
+  if (currentHash !== ralplanState.consensus_hash) {
+    return {
+      ok: false,
+      message:
+        `[ERROR] Refusing to approve: the plan file has been modified since the consensus critic reviewed it.\n` +
+        `  Re-run 'jeo ralplan' to let the critic review the updated plan, then approve again.`,
+    };
+  }
+
+  if (ralplanState.approved) {
+    return { ok: true, message: `[SUCCESS] Plan is already approved.` };
   }
 
   // Update ralplan-state.json to approved: true

package/src/commands/daemon.ts

@@ -1,5 +1,5 @@
 /**
- * `jeo daemon status|start|stop|reload` — manage the background Telegram
+ * `jeo daemon status|start|stop|reload` — manage the shared Telegram/Discord/Slack
  * notification/subagent-control daemon (gjc `gjc daemon` parity, scoped to
  * jeo's one daemon kind). See `src/agent/notify/daemon-control.ts`.
  */
@@ -10,8 +10,10 @@ async function printStatus(): Promise<void> {
   if (!status.configured) {
     console.log("notifications not configured — run 'jeo notify setup' first.");
   }
-  if (status.running) {
-    console.log(`running (pid ${status.pid}, started ${new Date(status.startedAt!).toISOString()})`);
+  if (status.pairing) {
+    console.log(`pairing owns polling (pid ${status.pid}); daemon not running`);
+  } else if (status.running) {
+    console.log(`process ${status.ready ? "initialized" : "initializing"} (pid ${status.pid}, started ${new Date(status.startedAt!).toISOString()}); platform connectivity not checked`);
     // Say so when the PID-reuse guard could not actually run. On a host with no `/proc`
     // and no usable `ps` (distroless images, seccomp-hardened sandboxes) "running" is an
     // existence-only guess: the pid is alive, but it may belong to an unrelated process

package/src/commands/launch/agents-slash.ts

@@ -54,12 +54,12 @@ function providerDefaultModel(p: ProviderName): string {
   return openaiCompatDef(p)?.defaultModel ?? STATIC_PROVIDER_DEFAULT[p] ?? "";
 }
 
-// Pick-list entries for ONE provider, with static fallbacks so the list is
-// never empty. Pure function — mirrors launch.ts's exported `providerPickEntries`
+// Pick-list entries for ONE provider. Antigravity requires live availability;
+// other providers retain static fallbacks. Mirrors launch.ts's `providerPickEntries`
 // (duplicated here rather than imported to avoid a launch.ts <-> launch/*.ts cycle).
 function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
-  if (fromLive.length) return fromLive;
+  if (fromLive.length || want === "antigravity") return fromLive;
   const catalog = catalogByProvider(want);
   if (catalog.length) {
     return catalog.map((m, i) => ({ index: i + 1, provider: want, model: qualifyModelId(m.providerModel, want) }));
@@ -253,6 +253,11 @@ export async function runAgentsSlash(input: string, ctx: AgentsSlashCtx): Promis
     const forProvider = providerPickEntries(live, want);
     const liveForProvider = live.some(r => r.ok && r.provider === want && r.models.length > 0);
     const explicit = tokens[3];
+    if (want === "antigravity" && !forProvider.length && (!explicit || explicit.startsWith("#"))) {
+      const reason = live.find(r => r.provider === want)?.error ?? "no account-available models returned";
+      console.log(`Cannot list ${want} models: ${reason}. Retry discovery or specify an explicit model id.`);
+      return result();
+    }
     let chosenModel: string;
     if (explicit && forProvider.length) {
       const sel = resolveSelection(forProvider, explicit);

package/src/commands/launch.ts

@@ -55,7 +55,7 @@ import { callLlm, type Message } from "../agent/loop";
 import { friendlyProviderError } from "../util/provider-error";
 import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/state";
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
-import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
+import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, liveProviderCatalogModels, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import { rehydrateLiveModels, writeModelCache } from "../ai/model-cache";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
 import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
@@ -335,19 +335,22 @@ function providerDefaultModel(p: ProviderName): string {
 }
 
 /**
- * Pick-list entries for ONE provider, with static fallbacks so the list is never
- * empty.
+ * Pick-list entries for ONE provider. OpenAI and Antigravity availability comes
+ * only from live results; other providers retain their offline catalog fallbacks.
  *
  * Live discovery yields ids only for a logged-in, reachable provider, and
  * `catalogOr` backfills the static catalog for OAuth sources and for API-key
  * providers whose models-list endpoint is absent (HTTP 404, e.g. Tencent MaaS).
  * A not-yet-configured provider still has an empty live list, so prefer live ids;
  * else the provider's capability catalog; else its single known default model (all
- * 24 OpenAI-compat providers carry one) so the user always sees at least one id.
+ * 24 OpenAI-compat providers carry one). Antigravity never uses these fallbacks.
  */
 export function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
   if (fromLive.length) return fromLive;
+  // An OpenAI or Antigravity empty/error response is authoritative for this picker.
+  // Offering the static capability catalog here would fabricate account availability.
+  if (want === "openai" || want === "antigravity") return [];
   const catalog = catalogByProvider(want);
   if (catalog.length) {
     return catalog.map((m, i) => ({ index: i + 1, provider: want, model: qualifyModelId(m.providerModel, want) }));
@@ -1516,15 +1519,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
           const goalState = await readGoalState(cwd);
           if (goalState && goalState.condition) {
-            const reBlockCount = goalState.verdicts.filter(v => v.verdict === "NOT_MET" || v.verdict === "IMPOSSIBLE").length;
-            const MAX_RE_BLOCKS = 2;
-
-            if (reBlockCount >= MAX_RE_BLOCKS) {
-              if (tui) tui.events().onNotice?.(`[Goal Verifier] Re-block cap of ${MAX_RE_BLOCKS} reached. Auto-allowing done.`);
-              else console.log(`[Goal Verifier] Re-block cap of ${MAX_RE_BLOCKS} reached. Auto-allowing done.`);
-              return null;
-            }
-
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
             const llmVerdict = await verifyGoal(goalState.condition, history, resolveVerifierModel(turnConfig));
             // Deterministic downgrade: a fresh MET from the transcript-only LLM
@@ -2427,7 +2421,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // the OAuth Codex gate from the first keystroke, instead of only after the network
   // discovery below happens to land.
   const aliasNames = Object.keys(await listAliases());
-  const cachedModels = await rehydrateLiveModels().catch(() => null);
+  await rehydrateLiveModels().catch(() => null);
+  const completionConfig = await readGlobalConfig();
+  const cachedCompletionModels = liveProviderCatalogModels({ openaiBaseUrl: completionConfig.openaiBaseUrl ?? process.env.OPENAI_BASE_URL });
   void getLiveModels()
     .then(r => {
       liveModelsCache ??= r;
@@ -2442,14 +2438,16 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // access to were un-completable for the first seconds of every session.
     const liveFromDiscovery = liveModelsCache ? flattenModels(liveModelsCache).map(e => e.model) : null;
     const cachedFor = (p: string): string[] =>
-      cachedModels?.providers.filter(entry => entry.provider === p).flatMap(entry => entry.models) ?? [];
+      cachedCompletionModels.filter(entry => entry.provider === p).map(entry => entry.canonical);
     return {
       ...base,
       slashCommands: [...base.slashCommands, ...skillSlashDetails.map(d => d.command)],
-      liveModels: liveFromDiscovery ?? (cachedModels?.providers.flatMap(entry => entry.models) ?? []),
+      liveModels: liveFromDiscovery ?? cachedCompletionModels.map(entry => entry.canonical),
       aliases: aliasNames,
       skillNames: resolvedSkillTokens,
-      modelsForProvider: p => liveModelsCache?.find(r => r.provider === p)?.models ?? cachedFor(p),
+      modelsForProvider: p => liveModelsCache
+        ? flattenModels(liveModelsCache.filter(r => r.provider === p)).map(entry => entry.model)
+        : cachedFor(p),
       mentionPaths,
     };
   };
@@ -4190,35 +4188,36 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // `rl`/`promptInput`'s `pendingRemoteInject`, and `pendingStdinLines`, all
   // established by now. See the Tier 2 contract's "Session-side routing".
   if (sessionNotifyEndpoint) {
-    sessionNotifyEndpoint.onUserMessage = (msg): void => {
-      void (async () => {
-        // Resolve any attached photo/document paths (already downloaded to
-        // local temp files by the daemon) into real ImageAttachments via the
-        // SAME path `attachImagePaths` uses for local drag-drop — one image
-        // ingestion mechanism, not a parallel one. Bare paths never contain
-        // whitespace here (daemon-generated temp names), so simple whitespace
-        // joining is a safe token boundary for the path-token scanner.
-        const withPaths = msg.imagePaths?.length ? `${msg.text} ${msg.imagePaths.join(" ")}`.trim() : msg.text;
-        const attached = await attachImagePaths(withPaths, pendingImages.length + 1);
-        const cleanedText = attached.images.length ? attached.text : msg.text;
-        if (attached.images.length) pendingImages.push(...attached.images);
-
-        if (interactiveTurnActive && currentTurnSteer) {
-          // Busy: steer the running turn exactly like a local mid-turn Enter.
-          currentTurnSteer.push(cleanedText);
-          currentTurnSteer.flushCard(cleanedText);
-          return;
-        }
-        // Idle: never hijack text the user is actively typing locally — only
-        // abort+inject when the readline buffer is confirmed empty (verified
-        // empirically: aborting mid-partial-type corrupts the buffer).
-        const rli = rl as unknown as { line?: string };
-        if (rli.line === "" && pendingRemoteInject?.(cleanedText)) return;
-        // No question pending, or the user is mid-type: queue for the NEXT
-        // prompt cycle instead (same queue `pendingMidTurnCommands`/paste-merge
-        // already feed — consumed at the top of the next `promptInput` call).
-        pendingStdinLines.push(cleanedText);
-      })();
+    sessionNotifyEndpoint.onUserMessage = async (msg): Promise<void | boolean> => {
+      // Resolve any attached photo/document paths (already downloaded to
+      // local temp files by the daemon) into real ImageAttachments via the
+      // SAME path `attachImagePaths` uses for local drag-drop — one image
+      // ingestion mechanism, not a parallel one. Bare paths never contain
+      // whitespace here (daemon-generated temp names), so simple whitespace
+      // joining is a safe token boundary for the path-token scanner.
+      const withPaths = msg.imagePaths?.length ? `${msg.text} ${msg.imagePaths.join(" ")}`.trim() : msg.text;
+      const attached = await attachImagePaths(withPaths, pendingImages.length + 1);
+      const cleanedText = attached.images.length ? attached.text : msg.text;
+      // Attachment normalization must not expose a remote slash command that
+      // bypasses the local approval prompt or changes local execution policy.
+      if (cleanedText.trimStart().startsWith("/")) return false;
+      if (attached.images.length) pendingImages.push(...attached.images);
+
+      if (interactiveTurnActive && currentTurnSteer) {
+        // Busy: steer the running turn exactly like a local mid-turn Enter.
+        currentTurnSteer.push(cleanedText);
+        currentTurnSteer.flushCard(cleanedText);
+        return;
+      }
+      // Idle: never hijack text the user is actively typing locally — only
+      // abort+inject when the readline buffer is confirmed empty (verified
+      // empirically: aborting mid-partial-type corrupts the buffer).
+      const rli = rl as unknown as { line?: string };
+      if (rli.line === "" && pendingRemoteInject?.(cleanedText)) return;
+      // No question pending, or the user is mid-type: queue for the NEXT
+      // prompt cycle instead (same queue `pendingMidTurnCommands`/paste-merge
+      // already feed — consumed at the top of the next `promptInput` call).
+      pendingStdinLines.push(cleanedText);
     };
     sessionNotifyEndpoint.onConfigCommand = (cmd): void => {
       if (cmd.verbosity !== undefined) notifyVerbosity = cmd.verbosity;

package/src/commands/notify.ts

@@ -1,109 +1,241 @@
-/**
- * `jeo notify setup|status` — configure and inspect the remote subagent
- * notification/control channel (gjc `gjc notify setup`/`gjc notify status`
- * parity, scoped to jeo's Telegram + subagent surface; see `src/agent/notify/`).
- */
+/** Configure and inspect Telegram, Discord, and Slack notification channels. */
 import { createInterface } from "node:readline/promises";
 import { readGlobalConfig, saveConfigPatch } from "../agent/state";
-import { TelegramApi, maskToken } from "../agent/notify/telegram-api";
-import { daemonStatus } from "../agent/notify/daemon-control";
+import { TelegramApi } from "../agent/notify/telegram-api";
+import { DiscordApi, DiscordApiError } from "../agent/notify/discord-api";
+import { SlackApi, SlackApiError } from "../agent/notify/slack-api";
+import { acquireDaemonLock, daemonStatus } from "../agent/notify/daemon-control";
 
-function parseFlags(args: string[]): { token?: string; chatId?: string } {
-  const out: { token?: string; chatId?: string } = {};
+type Provider = "telegram" | "discord" | "slack";
+interface NotifyOptions {
+  fetchImpl?: typeof fetch;
+  prompt?: (question: string) => Promise<string>;
+  pairingChallenge?: () => string;
+  now?: () => number;
+}
+interface Flags {
+  provider: Provider;
+  token?: string;
+  tokenEnv?: string;
+  appTokenEnv?: string;
+  chatId?: string;
+  channelId?: string;
+  allowedUserIds?: string[];
+}
+
+function parseFlags(args: string[]): Flags {
+  const out: Flags = { provider: "telegram" };
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--token" && args[i + 1]) out.token = args[++i];
-    else if (args[i] === "--chat-id" && args[i + 1]) out.chatId = args[++i];
+    const flag = args[i];
+    const value = args[++i];
+    if (!value || value.startsWith("--")) throw new Error("Missing value for notify option (use --token-env NAME for credentials)");
+    if (flag === "--provider" || flag === "--platform") {
+      if (value !== "telegram" && value !== "discord" && value !== "slack") throw new Error("Provider must be telegram, discord or slack");
+      out.provider = value;
+    } else if (flag === "--token") out.token = value;
+    else if (flag === "--token-env") out.tokenEnv = value;
+    else if (flag === "--app-token-env") out.appTokenEnv = value;
+    else if (flag === "--chat-id") out.chatId = value;
+    else if (flag === "--channel-id") out.channelId = value;
+    else if (flag === "--allowed-user-ids") {
+      out.allowedUserIds = [...new Set(value.split(",").map(id => id.trim()))];
+    } else throw new Error("Unknown notify option; use --provider, --token-env, --app-token-env, --chat-id, --channel-id or --allowed-user-ids");
+  }
+  if (out.chatId && !/^-?[1-9]\d*$/.test(out.chatId)) throw new Error("Telegram chat ID must be a nonzero decimal ID");
+  if (out.provider === "slack") {
+    if (out.channelId && !/^[CGD][A-Z0-9]+$/.test(out.channelId)) throw new Error("Slack channel ID must start with C, G or D and contain uppercase letters and digits");
+    if (out.allowedUserIds && !out.allowedUserIds.every(id => /^[UW][A-Z0-9]+$/.test(id))) throw new Error("Slack allowed user IDs must start with U or W and contain uppercase letters and digits");
+  } else {
+    if (out.channelId && !/^[1-9]\d{0,19}$/.test(out.channelId)) throw new Error("Discord channel ID must be a positive decimal ID of at most 20 digits");
+    if (out.allowedUserIds && !out.allowedUserIds.every(id => /^[1-9]\d{0,19}$/.test(id))) throw new Error("Allowed user IDs must be positive decimal IDs (up to 20 digits) separated by commas");
   }
   return out;
 }
 
-async function runSetup(args: string[]): Promise<void> {
-  const flags = parseFlags(args);
-  let token = flags.token;
-  let chatId = flags.chatId;
+async function question(text: string, opts: NotifyOptions): Promise<string> {
+  if (opts.prompt) return (await opts.prompt(text)).trim();
+  if (!process.stdin.isTTY) throw new Error("Missing setup arguments; use --token-env and explicit destination/user IDs without a TTY");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try { return (await rl.question(text)).trim(); } finally { rl.close(); }
+}
 
-  if (!token || !chatId) {
-    if (!process.stdin.isTTY) {
-      console.log(
-        "jeo notify setup needs an interactive terminal (TTY) unless both --token and --chat-id are given.\n" +
-          "Non-interactive: jeo notify setup --token <botToken> --chat-id <chatId>",
-      );
-      return;
+// Telegram puts credentials in request URLs. Never print underlying fetch errors.
+function boundedFetch(opts: NotifyOptions): typeof fetch {
+  return ((input, init) => (opts.fetchImpl ?? fetch)(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(15_000) })) as typeof fetch;
+}
+
+async function verifySlack(api: SlackApi, channelId: string): Promise<void> {
+  const me = await api.getMe();
+  const channel = await api.getChannel(channelId);
+  if (channel.id !== channelId || (channel.context_team_id && channel.context_team_id !== me.team_id)) throw new Error("Slack bot and destination workspace validation failed");
+  await api.openConnection();
+}
+
+async function runSetup(flags: Flags, opts: NotifyOptions): Promise<void> {
+  const envName = flags.tokenEnv ?? `JEO_${flags.provider.toUpperCase()}_BOT_TOKEN`;
+  let token = flags.token ?? process.env[envName]?.trim();
+  if (!token) {
+    const name = await question(`Set the bot token in an environment variable, then enter its NAME (default ${envName}): `, opts);
+    token = process.env[name || envName]?.trim();
+  }
+  if (!token) throw new Error(`Bot token environment variable is empty; use --token-env NAME (preferred over --token)`);
+  const existing = (await readGlobalConfig()).notifications;
+  let allowedUserIds = flags.allowedUserIds;
+  if (flags.provider === "slack") {
+    const appEnvName = flags.appTokenEnv ?? "SLACK_APP_TOKEN";
+    let appToken = process.env[appEnvName]?.trim();
+    if (!appToken) {
+      const name = await question(`Set the Slack app token in an environment variable, then enter its NAME (default ${appEnvName}): `, opts);
+      appToken = process.env[name || appEnvName]?.trim();
     }
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    if (!appToken) throw new Error("Slack app token environment variable is empty; use --app-token-env NAME");
+    const channelId = flags.channelId ?? existing?.slack?.channelId ?? await question("Slack channel ID: ", opts);
+    if (!/^[CGD][A-Z0-9]+$/.test(channelId)) throw new Error("Slack requires a valid channel ID");
+    const sameDestination = existing?.slack?.botToken === token && existing.slack.appToken === appToken && existing.slack.channelId === channelId;
+    if (!allowedUserIds?.length && (!sameDestination || !existing?.slack?.allowedUserIds.length)) allowedUserIds = (await question("Allowed Slack human user IDs (comma separated; required after token/destination changes): ", opts)).split(",").map(id => id.trim());
+    const api = new SlackApi(token, appToken, { fetchImpl: boundedFetch(opts) });
     try {
-      console.log("\n=== jeo notify setup (Telegram) ===");
-      console.log("Create a bot with @BotFather (https://core.telegram.org/bots/features#botfather), then paste its token below.\n");
-      if (!token) token = (await rl.question("Telegram BotFather token: ")).trim();
-      if (!token) {
-        console.log("No token given — aborting.");
-        return;
-      }
-      const api = new TelegramApi(token);
-      const me = await api.getMe();
-      if (!me.ok || !me.result) {
-        console.log(`Telegram getMe failed: ${me.description ?? "invalid token"}. Re-copy the token from BotFather and retry.`);
-        return;
-      }
-      console.log(`Bot verified: @${me.result.username}`);
-
-      if (!chatId) {
-        console.log(`\nMessage @${me.result.username} from your Telegram account now (any text). Waiting...`);
+      await verifySlack(api, channelId);
+      await saveConfigPatch(raw => {
+        const previous = raw.notifications?.slack;
+        const unchanged = previous?.botToken === token && previous.appToken === appToken && previous.channelId === channelId;
+        const owners = allowedUserIds ?? (unchanged ? previous.allowedUserIds : undefined);
+        if (!owners?.length || !owners.every(id => /^[UW][A-Z0-9]+$/.test(id))) throw new Error("Slack requires explicit allowed human user IDs; repeat --allowed-user-ids after token or destination changes");
+        return { notifications: { ...raw.notifications, enabled: true, slack: { botToken: token, appToken, channelId, allowedUserIds: owners } } };
+      });
+    } finally { api.stop(); }
+    console.log(`Slack bot and channel verified; channelId=${channelId}. Notifications enabled. Setup did not send a message.`);
+    console.log("Socket Mode URL verified; app-token ownership and socket connectivity are checked by the daemon handshake. Token rotation requires an explicit user allowlist.");
+  } else if (flags.provider === "discord") {
+    const channelId = flags.channelId ?? existing?.discord?.channelId ?? await question("Discord channel ID: ", opts);
+    const sameDestination = existing?.discord?.botToken === token && existing.discord.channelId === channelId;
+    if (!allowedUserIds?.length && (!sameDestination || !existing?.discord?.allowedUserIds?.length)) allowedUserIds = (await question("Allowed Discord user IDs (comma separated; required after token/destination changes): ", opts)).split(",").map(id => id.trim());
+    if (!/^[1-9]\d{0,19}$/.test(channelId)) throw new Error("Discord requires a positive channel ID (up to 20 digits)");
+    const api = new DiscordApi(token, { fetchImpl: boundedFetch(opts) });
+    const me = await api.getMe();
+    if (!me.bot) throw new Error("Discord identity is not a bot");
+    const channel = await api.getChannel(channelId);
+    if (channel.id !== channelId || ![0, 1, 5, 10, 11, 12].includes(channel.type)) throw new Error("Discord destination must be a text channel, thread, or bot DM");
+    await saveConfigPatch(raw => {
+      const previous = raw.notifications?.discord;
+      const unchanged = previous?.botToken === token && previous.channelId === channelId;
+      const owners = allowedUserIds ?? (unchanged ? previous.allowedUserIds : undefined);
+      if (!owners?.length || !owners.every(id => /^[1-9]\d{0,19}$/.test(id))) throw new Error("Discord requires explicit allowed user IDs; repeat --allowed-user-ids after token or destination changes");
+      return { notifications: { ...raw.notifications, enabled: true, discord: { ...(unchanged ? previous : {}), botToken: token, channelId, allowedUserIds: owners } } };
+    });
+    console.log(`Discord bot verified; channelId=${channelId}. Notifications enabled.`);
+    console.log("Guild channels require MESSAGE CONTENT intent and View Channel/Send Messages permissions. Setup did not send a message.");
+    console.log("Token rotation or destination changes require an explicit user allowlist.");
+  } else {
+    const api = new TelegramApi(token, boundedFetch(opts));
+    const me = await api.getMe();
+    if (!me.ok || !me.result?.is_bot) throw new Error("Telegram getMe failed: invalid bot credentials or API unavailable");
+    const botId = String(me.result.id);
+    let chatId = flags.chatId;
+    let pairedUserId: string | undefined;
+    if (!chatId) {
+      if (!opts.prompt && !process.stdin.isTTY) throw new Error("Telegram auto-pairing requires a TTY; use explicit --chat-id otherwise");
+      const lock = await acquireDaemonLock("pairing");
+      if (!lock) throw new Error("A daemon or pairing process owns getUpdates; stop the daemon before auto-pairing, or use explicit --chat-id");
+      try {
+        const challenge = `/start jeo_${opts.pairingChallenge?.() ?? crypto.randomUUID()}`;
+        console.log(`Send exactly '${challenge}' to @${me.result.username} in a private chat within 120 seconds.`);
         let offset: number | undefined;
-        const deadline = Date.now() + 120_000;
-        while (Date.now() < deadline && !chatId) {
+        const now = opts.now ?? Date.now;
+        const startedAt = now();
+        const deadline = startedAt + 120_000;
+        while (now() < deadline && !chatId) {
           const updates = await api.getUpdates(offset, 5);
-          if (updates.ok) {
-            for (const u of updates.result) {
-              offset = u.update_id + 1;
-              const chat = u.message?.chat;
-              if (chat && chat.type === "private") {
-                chatId = String(chat.id);
-                break;
-              }
+          if (!updates.ok || !Array.isArray(updates.result)) throw new Error("Telegram pairing getUpdates failed (check bot polling ownership or credentials)");
+          for (const update of updates.result) {
+            if (!Number.isSafeInteger(update.update_id) || (offset !== undefined && update.update_id < offset)) continue;
+            offset = update.update_id + 1;
+            const msg = update.message;
+            if (msg?.chat.type === "private" && msg.date >= Math.floor(startedAt / 1000) && msg.text === challenge && msg.from && !msg.from.is_bot && String(msg.from.id) === String(msg.chat.id)) {
+              chatId = String(msg.chat.id);
+              pairedUserId = String(msg.from.id);
+              break;
             }
           }
         }
-        if (!chatId) {
-          console.log("Timed out waiting for a private message. Re-run 'jeo notify setup' and message the bot promptly.");
-          return;
-        }
-        console.log(`Paired private chat id ${chatId}.`);
-      }
-    } finally {
-      rl.close();
-    }
-  } else {
-    const api = new TelegramApi(token);
-    const me = await api.getMe();
-    if (!me.ok) {
-      console.log(`Telegram getMe failed: ${me.description ?? "invalid token"}.`);
-      return;
+        if (!chatId) throw new Error("Telegram pairing timed out; no matching private challenge received");
+      } finally { await lock.release(); }
     }
+    const chat = await api.getChat(chatId);
+    if (!chat.ok || !chat.result?.type) throw new Error("Telegram chat lookup failed; check chat ID and bot access");
+    await saveConfigPatch(raw => {
+      const previous = raw.notifications?.telegram;
+      const sameDestination = previous?.chatId === chatId && (
+        previous.botToken === token || previous.botToken?.match(/^([1-9]\d*):/)?.[1] === botId
+      );
+      const owners = allowedUserIds ?? (sameDestination ? previous.allowedUserIds : undefined) ?? (pairedUserId ? [pairedUserId] : undefined);
+      if (chat.result!.type !== "private" && !owners?.length) throw new Error("Telegram groups require explicit --allowed-user-ids");
+      return { notifications: { ...raw.notifications, enabled: true, telegram: { ...(sameDestination ? previous : {}), botToken: token, chatId, ...(owners ? { allowedUserIds: owners } : {}) } } };
+    });
+    console.log(`Telegram bot verified; chatId=${chatId}. Notifications enabled. Setup did not send a message.`);
   }
-
-  await saveConfigPatch(raw => ({
-    notifications: { ...raw.notifications, enabled: true, telegram: { botToken: token, chatId } },
-  }));
-  console.log(`\nNotifications enabled. botToken=${maskToken(token!)} chatId=${chatId}`);
-  console.log("Start the daemon with 'jeo daemon start', then run a detached subagent (task {detached:true}) to see it appear in Telegram.");
+  console.log("Run 'jeo daemon start' (or reload if already running) to apply. Use 'jeo notify health --provider " + flags.provider + "' for read-only API checks; 'jeo notify test --provider " + flags.provider + "' explicitly sends a test message.");
 }
 
-async function runStatus(): Promise<void> {
+async function runStatus(provider: Provider): Promise<void> {
   const config = await readGlobalConfig();
-  const enabled = Boolean(config.notifications?.enabled);
-  const botToken = config.notifications?.telegram?.botToken;
-  const chatId = config.notifications?.telegram?.chatId;
+  const n = config.notifications;
+  const channel = n?.[provider];
   const status = await daemonStatus();
-  console.log(`enabled=${enabled}`);
-  console.log(`botToken=${botToken ? maskToken(botToken) : "(not set)"}`);
-  console.log(`chatId=${chatId ?? "(not set)"}`);
-  console.log(`daemon=${status.running ? `running (pid ${status.pid})` : status.stale ? "stale (crashed without cleanup)" : "stopped"}`);
+  console.log(`provider=${provider} enabled=${Boolean(n?.enabled)}`);
+  console.log(`botToken=${channel?.botToken ? "(set)" : "(not set)"}`);
+  if (provider === "slack") console.log(`appToken=${n?.slack?.appToken ? "(set)" : "(not set)"}`);
+  console.log(provider === "telegram" ? `chatId=${n?.telegram?.chatId ?? "(not set)"}` : `channelId=${n?.[provider]?.channelId ?? "(not set)"}`);
+  console.log(`allowedUserIds=${channel?.allowedUserIds?.join(",") ?? (provider === "telegram" ? "private chat owner only" : "(not set; inbound disabled)")}`);
+  console.log(`daemon=${status.pairing ? "pairing owns polling (daemon not running)" : status.running ? `process ${status.ready ? "initialized" : "initializing"} (pid ${status.pid}; transport connectivity not checked)` : status.stale ? "stale" : "stopped"}`);
+  console.log("Channel health not checked; use 'jeo notify health --provider " + provider + "'.");
 }
 
-export async function runNotifyCommand(args: string[]): Promise<void> {
+async function runHealth(provider: Provider, send: boolean, opts: NotifyOptions): Promise<void> {
+  const n = (await readGlobalConfig()).notifications;
+  if (provider === "slack") {
+    const cfg = n?.slack;
+    if (!cfg?.botToken || !cfg.appToken || !cfg.channelId || !cfg.allowedUserIds?.length) throw new Error("Slack is incomplete: bot token, app token, channel ID and allowed user IDs are required");
+    const api = new SlackApi(cfg.botToken, cfg.appToken, { fetchImpl: boundedFetch(opts) });
+    try {
+      await verifySlack(api, cfg.channelId);
+      if (send) await api.sendMessage(cfg.channelId, "jeo notification test");
+    } finally { api.stop(); }
+    if (!send) console.log("Slack Socket Mode URL verified; app-token ownership, socket connectivity and send permissions are not tested until daemon handshake/test.");
+  } else if (provider === "discord") {
+    const cfg = n?.discord;
+    if (!cfg?.botToken || !cfg.channelId || !cfg.allowedUserIds?.length) throw new Error("Discord is incomplete: bot token, channel ID and allowed user IDs are required");
+    const api = new DiscordApi(cfg.botToken, { fetchImpl: boundedFetch(opts) });
+    const me = await api.getMe();
+    const channel = await api.getChannel(cfg.channelId);
+    if (!me.bot || channel.id !== cfg.channelId || ![0, 1, 5, 10, 11, 12].includes(channel.type)) throw new Error("Discord identity/channel validation failed");
+    if (send) await api.sendMessage(cfg.channelId, "jeo notification test");
+  } else {
+    const cfg = n?.telegram;
+    if (!cfg?.botToken || !cfg.chatId) throw new Error("Telegram is incomplete: bot token and chat ID are required");
+    const api = new TelegramApi(cfg.botToken, boundedFetch(opts));
+    const me = await api.getMe();
+    const chat = await api.getChat(cfg.chatId);
+    if (!me.ok || !me.result?.is_bot || !chat.ok || !chat.result?.type) throw new Error("Telegram bot/chat validation failed (check credentials and access)");
+    if (chat.result.type !== "private" && !cfg.allowedUserIds?.length) throw new Error("Telegram groups require an explicit user allowlist");
+    if (send && !(await api.sendMessage(cfg.chatId, "jeo notification test", { messageThreadId: cfg.topicId })).ok) throw new Error("Telegram test send failed (check permissions/rate limit)");
+  }
+  console.log(`${provider}: ${send ? "test message sent" : "bot identity and destination accessible (read-only; Gateway/poll connectivity and send permissions not tested)"}. enabled=${Boolean(n?.enabled)}`);
+}
+
+export async function runNotifyCommand(args: string[], opts: NotifyOptions = {}): Promise<void> {
   const sub = args[0] ?? "status";
-  if (sub === "setup") return runSetup(args.slice(1));
-  if (sub === "status") return runStatus();
-  console.log(`Unknown 'jeo notify' subcommand '${sub}'. Usage: jeo notify [setup|status]`);
+  try {
+    const flags = parseFlags(args.slice(1));
+    if (sub === "setup") return await runSetup(flags, opts);
+    if (sub === "status") return await runStatus(flags.provider);
+    if (sub === "health" || sub === "test") return await runHealth(flags.provider, sub === "test", opts);
+    throw new Error("Usage: jeo notify [setup|status|health|test] [--provider telegram|discord|slack]");
+  } catch (error) {
+    // Only emit our known configuration/API errors, never fetch URLs or token-bearing bodies.
+    const message = error instanceof Error ? error.message : "request failed";
+    const safe = /^(Missing |Unknown notify|Provider |Allowed user|Telegram |Discord |Slack |Bot token|Missing setup|A daemon|Notification lock recovery|Usage:)/.test(message) && !message.includes("https:") && !message.includes("http:");
+    console.error(`Notification ${sub} failed: ${safe ? message : "API or storage request failed; check credentials, connectivity and permissions"}${(error instanceof DiscordApiError || error instanceof SlackApiError) && error.status ? ` (HTTP ${error.status})` : ""}`);
+    process.exitCode = 1;
+  }
 }

package/src/commands/ralplan.ts

@@ -403,5 +403,6 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
 }
 
 export async function runRalplanCommand(): Promise<void> {
-  await runRalplanEngine();
+  const result = await runRalplanEngine();
+  if (!result.ok) process.exitCode = 1;
 }