jeo-code 0.11.2 → 0.11.3

package/README.zh.md

@@ -38,7 +38,7 @@
 
 ## 亮点
 
-- **多提供商、单一循环** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio，以及 20+ 个 OpenAI、Anthropic 兼容云服务(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai 等)，统一在一个 JSON 工具循环中 — **还包括你自己注册的端点**: `jeo provider add --id my-proxy --base-url https://…`(或 `--preset litellm|vllm|sglang|azure-openai|…`)让 LiteLLM 代理、自托管 vLLM、企业内部 Anthropic 网关拥有各自的路由前缀、模型列表和凭据，而不是劫持内置的 `openai` 提供商。输入框内直接 OAuth 登录(`/provider login`)，模型选择即刻持久化为默认值。Prompt routing 只会自动选择真实可用的凭据路径: Gemini OAuth 会走 provider-qualified 的 `antigravity/*` 代理模型集(Gemini 3.5 Flash 各档、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6)，绝不选择需要 `GEMINI_API_KEY` 的 public `google/gemini-*` 行。
+- **多提供商、单一循环** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio，以及 20+ 个 OpenAI、Anthropic 兼容云服务(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai 等)，统一在一个 JSON 工具循环中 — **还包括你自己注册的端点**: `jeo provider add --id my-proxy --base-url https://…`(或 `--preset litellm|vllm|sglang|azure-openai|…`)让 LiteLLM 代理、自托管 vLLM、企业内部 Anthropic 网关拥有各自的路由前缀、模型列表和凭据，而不是劫持内置的 `openai` 提供商。输入框内直接 OAuth 登录(`/provider login`)，每次模型选择都会持久化为新的默认值，而 prompt routing 只会自动选择真实可用的凭据路径: Gemini OAuth 会走 provider-qualified 的 `antigravity/*` 代理模型集，**以账号当前实际提供的为准**(实时发现 — 例如 Gemini 3.6 Flash 各档、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6；非对话模型与已弃用的 id 会被过滤掉，列表为空时也不会用静态目录顶替)，绝不选择需要 `GEMINI_API_KEY` 的 public `google/gemini-*` 行；如果已配置的路由指向尚未就绪的提供商，jeo 会先切换到同层级的等价凭据模型，再退回默认模型。
 - **编辑完整性** — read 输出携带内容锚点(`42ab|`)；带锚点的编辑会与当前文件校验、行移动时自动重映射、不匹配时连同最新内容一起拒绝 — 绝不污染文件。
 - **自我修正的验证循环** — 配置 post-edit 钩子(tsc / eslint / 测试)，代理会*亲自读取*诊断并在循环内修复；钩子未通过时 `done` 会被阻断。
 - **没有表演的真实门禁** — `ralplan` 共识由真正读取仓库的 critic 子代理执行，`[OKAY]` 裁决被持久化且 `jeo approve` *强制要求*它；`ultragoal` 诚实报告(套件运行只是全局信号，绝不伪造逐条通过)。
@@ -49,7 +49,8 @@
 - **持续积累的技能** — 卡壳的一轮现在会把死胡同写入同一个技能的项目级文件(`.jeo/skills/<name>.md`,首次写入时从内置技能播种,采用确定性关键词匹配,不使用 LLM),因此下一个会话的 `$<skill>` 调用会带上累积的"Known Failure Modes"/"Anti-Patterns"知识,而不是让内置文档永远保持静态。手动记录用 `jeo skills lesson <skill> <failure|anti-pattern> "<title>" "<detail>"`;`jeo skills eval <skill>` 会运行一次真正的 LLM 判断,检查每条已记录的经验是否仍被技能当前的指引覆盖,还是已经过时。
 - **低价位评分模型路由** — `/goal` 验证器、`critic` 子代理角色,以及未锁定的 `task` 扇出批次,现在默认使用低价位、已配置凭证的模型,而不是悄悄搭乘与它们所评分/执行的工作相同的全价模型(`resolveVerifierModel`,针对浏览器 `verify` 动作按视觉能力过滤,确保纯文本的低价模型不会悄悄丢弃附带的截图)。
 - **`jeo routine init`** — 生成一个 GitHub Actions 工作流,在 schedule/issue/PR 触发器上以无头模式运行 jeo(`jeo "<prompt>" -p`),运行在 GitHub 自己的 runner 上 — 不需要笔记本电脑,并且不会给 jeo 自身增加任何新的攻击面(没有进程内调度器或 webhook 监听器)。`--dry-run` 可预览,`--no-pr` 则改为直接提交而非默认的每次运行一个 PR。
-- **远程子代理可见性(Telegram)** — 配对一次机器人(`jeo notify setup`)后，`jeo daemon start` 会在子代理每次状态变化(启动 → 完成/失败/取消)时推送消息，并接受 `/subagents`、`/steer <id> <subagentId> <msg>`、`/cancel <id> <subagentId>` 回传。现在提供 Telegram 论坛主题、内联键盘、图片附件等完整 `gjc` parity；命令仅对配对的聊天授权。
+- **远程监控与控制(Telegram、Discord、Slack)** — 配对一次机器人(`jeo notify setup --provider telegram|discord|slack`)后，一个共享的 `jeo daemon start` 会在所有活跃会话中、子代理每次状态变化(启动 → 完成/失败/取消)时推送消息，并接受来自人类 allowlist 的 `/subagents`、`/steer`、`/cancel`(Discord/Slack 上还有 `/sessions` 和 `/send`)回传。Telegram 额外提供论坛主题、内联键盘和图片附件；Discord 使用 REST + Gateway WebSocket；Slack 使用 Web API + Socket Mode。每一条远程控制都由本地会话确认收到，绝不假定已执行。
+- **无法绕过的门禁** — `approve` 会重新校验它正在批准的那份计划的精确摘要，`team` 会拒绝已审阅摘要发生变化的计划；`done` 调用会对照最新的验证证据重新检查(后来的失败检查会使先前的通过失效，三次纠正往返后硬性拒绝)；`autopilot` ratchet 会把失败的回滚记录为 `rollback_failed` 并以非零状态停止，而不是声称该步骤已回退。
 - **不阻塞回合的会话级异步执行** — 通过 `task` 工具真实的 `tasks` 数组扇出独立工作，不阻塞父回合。detached 子代理、后台 job 和逐行 monitor 可在后续回合中继续使用 `subagent`/`job`/`monitor` 的 `list`、`inspect`、`await`、`cancel`、`tail` 控制。内联 TUI 为每个 worker 保留独立的实时 activity 槽位，并在会话退出或 Ctrl-C 时清理全部 registry。
 - **独立验证器，真正强制执行** — 计划再也无法跳过 architect/critic 步骤: `PlanSchema` 会拒绝任何以未验证变更结尾的计划(把验证器放在它该检查的变更之前也不算数)，在 `ralplan` 起草阶段和 `team`/`approve` 执行阶段都强制生效。每一次 architect/critic 裁决也都必须展示真实证据 — 观测到的 `read`/`search`/`find`/`ast_grep`/`lsp` 调用为零，无论文本怎么声称，裁决都会被拦下。
 - **安全边界自动模型回退** — 未分类的安全拒绝(可能是分类器误报，而非真实的内容策略命中)现在会切换到真正不同提供商的模型，而不是在同一个模型上无限退让 — 与现有的 rate-limit 快速回退是同一套模式。`Refusal (<category>)` 这种形态的确定性拒绝不受影响，仍然零回退硬失败。
@@ -85,27 +86,45 @@ jeo --tmux               # 在独立 tmux 会话中运行
 
 | 命令 | 说明 |
 | --- | --- |
-| `/model` · `/provider` | 选择模型/提供商；`/model` 在一个流程内显示默认/角色徽章、Ralph 风格嵌套角色·thinking 选择与 OpenAI Codex 角色预设 |
+| `/model` · `/provider` | 选择模型/提供商；`/model` 在一个流程内显示默认/角色徽章、Ralph 风格嵌套的"设为角色"thinking 选择与 OpenAI Codex 角色预设 |
 | `/provider login <name>` · `/logout` | 在输入框内 OAuth 登录/登出 |
 | `/provider add` · `list` · `remove` · `presets` | 将 OpenAI/Anthropic 兼容端点注册为一等提供商(15 个网关预设) |
 | `/agents [role]` · `/subagent` | 按角色(executor/planner/architect/critic)配置模型·thinking·步数 |
 | `/thinking [level]` | 查看/设置默认推理预算(low…xhigh) |
-| `/route [status\|on\|off\|why\|history [n]]` | 切换本会话的基于提示词的模型路由 · 解释最近一次路由决策 · `history [n]` 列出本会话最近 n 条(默认 10 条)路由决策(仅在已配置凭证 — OAuth 或 API 密钥 — 实际可用的模型内自动路由) |
+| `/route [status\|on\|off\|why\|history [n]]` | 切换本会话基于提示词的模型路由 · 解释最近一次路由决策 · `history [n]` 列出本会话最近 n 条(默认 10 条)路由决策(每轮自动路由到与层级匹配的模型，且只在你已配置的凭证 — OAuth 或 API 密钥 — 实际可用的模型中选择；已配置的路由未就绪时会切换到同层级的等价模型) |
 | `/fast [on\|off\|status]` | 当前模型支持 low 推理时切换 fast thinking 模式 |
 | `/skill` · `$<skill> [intent]` | 列出/运行工作流技能(`$team "任务"` 风格) |
 | `/view` · `/diff` · `/find` · `/search` | 代码查看、git diff、文件/模式搜索 |
-|| `/new` · `/sessions` | 开始新会话或列出已保存会话 |
-|| `/resume [id|gajae:<session-id>[#<leaf>]] [--any-cwd]` | 恢复 Jeo 会话，或将只读的精确版本 GJC v5 分支导入新的 Jeo 会话 |
-|| `/changelog [--full]` · `/jobs [list|tail|await|cancel]` | 显示发布说明 · 查看、等待或取消当前会话的后台任务 |
+| `/computer [status\|on\|off]` | 切换本会话的 fail-closed 桌面自动化工具 |
+| `/new` · `/sessions` | 开始新会话或列出已保存会话 |
+| `/resume [id\|gajae:<session-id>[#<leaf>]] [--any-cwd]` | 恢复 Jeo 会话，或将只读的精确版本 GJC v5 分支导入新的 Jeo 会话 |
+| `/changelog [--full]` · `/jobs [list\|tail\|await\|cancel]` | 显示发布说明 · 查看、等待或取消当前会话的后台任务 |
 | `/history [n\|all]` · `/export` | 将可读的工作活动历史重新输出到滚动区 · 导出记录 |
-| `/retry` · `/btw <问题>` | 重试上次请求 · 不写入历史的旁路提问 |
+| `/retry` · `/btw <q>` | 重试上次请求 · 不写入历史的旁路提问 |
 | `/usage` · `/context` · `/compact` | Token 用量、上下文明细、手动压缩 |
 | `/theme` · `/config` · `/help` | 主题、运行时配置、帮助 |
-| `jeo autopilot status` | 显示分数方向、keep/revert 次数和下一步动作的 ratchet 状态字段 |
 
 > [!CAUTION]
 > **通过 `/model <name>` 手动指定模型后，路由会在本会话内保持锁定。** Prompt routing(`/route`)只在没有手动锁定模型时才会逐轮重新评估。用 `/model <name>` 选定具体模型后，该选择会被锁定 — 直到你运行 `/model auto`(彻底解除锁定)，或运行 `/route on`(不会清除锁定，只是优先级更高 — 一旦运行 `/route off`，锁定会立刻恢复)之前，路由都不会再切换。未配置 `roles.*` 条目时，只有 `standard` 层级会确定性地退回到 `defaultModel`；`high`/`complex` 层级通常会先实时扫描已配置凭证中最强的可用模型再决定是否回退，所以即使未配置，也可能每轮落到不同的模型上。**例外:** 通过 Antigravity 或 Gemini OAuth 授权的会话会用同一个凭证重新导出 Anthropic/Google/OpenAI 的模型 —此时 `high`/`complex` 会按公司各选一个模型、以会话为单位稳定分布(不一定是最强的那个)，因此在同一会话内保持固定，而不是逐轮变化。
 
+## CLI 命令
+
+`jeo --help` 是权威列表；下面是你最常用到的:
+
+| 命令 | 用途 |
+| --- | --- |
+| `jeo [prompt] [--resume [id]] [--tmux] [--worktree <path>] [-p] [-q]` | 交互式代理(默认)；`-p`/`--print` 用于无头单次输出，`--worktree` 用于隔离的同级检出 |
+| `jeo setup` · `jeo auth login\|logout\|refresh\|status [provider]` · `jeo doctor` | 提供商、自动刷新的 OAuth(PKCE)令牌、实时连通性 + 过期模型锁定检查 |
+| `jeo provider list\|add\|remove\|presets\|test` | 具名的自定义 OpenAI/Anthropic 兼容提供商(与 `/provider` 共用同一套 planner) |
+| `jeo deep-interview` → `ralplan` → `approve` → `team` → `ultragoal` | Spec-first 工作流(见下文)；`jeo state <skill> read\|write\|clear\|handoff` 用于检查回执 |
+| `jeo notify setup\|status\|health\|test` · `jeo daemon start\|stop\|status\|reload` | Telegram / Discord / Slack 通知与共享控制守护进程 |
+| `jeo autopilot <subcommand>` · `jeo ledger <subcommand>` | 带分数 ratchet 的自主构建循环(`status` 显示方向、keep/revert 次数和下一步动作) · 跨计划的只追加账本 |
+| `jeo routine init …` | 生成一个 GitHub Actions 工作流，按计划或仓库事件以无头模式运行 jeo |
+| `jeo skills list\|read\|sync\|lesson\|eval` | 内置、用户和项目技能；漂移检查；已记录的经验 |
+| `jeo mcp serve\|tools` · `jeo computer <action>` | 供外部控制器使用的 MCP stdio 服务器 · 桌面自动化动作 |
+| `jeo session list\|attach\|rm` · `jeo export [id]` · `jeo chat "<msg>"` | tmux 会话管理 · 导出记录 · 无工具的流式聊天 |
+| `jeo update [--check]` · `jeo whats-new` · `jeo memory-migrate` | 从 npm 自更新 · 内置发布说明 · 旧版 `MEMORY.md` → OKF 概念包 |
+
 ## Spec-first 工作流
 
 需求 → 计划 → 批准 → 执行 → 验证，经由 `.jeo/state/` 串联，每次交接都有**可阻断的真实门禁**:
@@ -182,32 +201,45 @@ jeo ultragoal
 
 `--worktree <name>` 在隔离的同级 git worktree 中运行 jeo（路径存在则复用，否则以 basename 分支创建），因此有风险或需审查的工作绝不会触及您的主检出。`jeo mcp serve` 通过 stdio 向任何支持 MCP 的控制器公开 jeo 的工具（用 `jeo mcp tools` 列出）。添加 `-q`/`--quiet`（或 `JEO_QUIET=1`）可抑制启动横幅、欢迎动画、发布说明和恢复提示，使 jeo 能够与其他代理并行运行或由机器人驱动。`-p`/`--print` 隐含 quiet。
 
-## 远程监控与控制 (Telegram)
+## 远程监控与控制 (Telegram, Discord & Slack)
+
+可选功能: 一个共享守护进程监视本机上所有活跃的 `jeo` 会话，并在每次**子代理状态变化**(启动 → 完成/失败/取消)时推送消息，另附会话身份头、回合开始/结束摘要以及最终的回合文本 — 绝不会重复"仍在运行"之类的通知。allowlist 中的人类可以在聊天里列出、发送、引导和取消；每一条控制都会转发给本地会话，并报告为**已确认(已接受，未必已完成)**或**未确认** — 守护进程绝不声称某条命令已执行。
 
 ```bash
-jeo notify setup        # 配对一次 BotFather 机器人(getMe 校验 + chat-id 配对)
-jeo notify status       # 已遮蔽的令牌、已配对 chat id、守护进程状态
-jeo daemon start        # 启动单例后台守护进程
-jeo daemon status       # 检查是否正在运行
-jeo daemon stop         # 发送 SIGTERM 停止
+jeo notify setup  [--provider telegram|discord|slack] [--token-env NAME] [--app-token-env NAME] [--chat-id ID | --channel-id ID] [--allowed-user-ids ID,ID,...]
+jeo notify status [--provider …]   # masked token, destination, allowlist, daemon state (stopped / stale / initializing / initialized / pairing)
+jeo notify health [--provider …]   # read-only: bot identity + destination access, nothing sent
+jeo notify test   [--provider …]   # sends one real test message
+jeo daemon start|stop|status|reload   # the shared daemon has no provider selector
 ```
 
+| | Telegram(默认) | Discord | Slack |
+| --- | --- | --- | --- |
+| 凭证 | 机器人 token(`JEO_TELEGRAM_BOT_TOKEN` 或 `--token-env`) | 机器人 token(`JEO_DISCORD_BOT_TOKEN` 或 `--token-env`)+ **Message Content** intent | 机器人 `xoxb` token(`JEO_SLACK_BOT_TOKEN` 或 `--token-env`)+ 应用 `xapp` token(`SLACK_APP_TOKEN` 或 `--app-token-env`)，并启用 Socket Mode |
+| 目标 | 通过挑战配对的私聊(在 120 秒内把显示的 `/start jeo_<code>` 发给机器人)或显式 `--chat-id`；群组需要 `--allowed-user-ids` | 显式 `--channel-id`(文字频道、DM、公告频道或已有线程) | 机器人已加入的显式 `--channel-id`(`C…`)；工作区固定为 token 所属的团队 |
+| Allowlist | 私聊可选，群组必需 | 必需(人类用户 ID；机器人会被忽略) | 必需(人类用户 ID) |
+| 传输 | 直接调用 Bot API `getUpdates` 长轮询，每个机器人 token 只有一个轮询所有者 | 发送走 REST，入站走 Gateway WebSocket | 发送走 Web API，入站走 Socket Mode WebSocket |
+| 附加能力 | 论坛主题、内联取消按钮、图片附件、可选的每会话主题(`notifications.telegram.perSessionTopics`，仅限开启 Threaded Mode 的私聊) | 回复某条会话通知即可向该会话发送文本(24 小时内) | 在会话通知的线程中回复即可向该会话发送文本(24 小时内)；已注册的 Slack 斜杠命令或 `@bot /command` 均可用 |
+| 命令 | `/subagents` `/steer <session> <subagent> <msg>` `/cancel <session> <subagent>` `/help` | `/sessions` `/subagents` `/send <session> <text>` `/steer …` `/cancel …` `/help` | 与 Discord 相同 |
+
+这些词不可互换，所以说明一下它们各自的含义:
+
+- **Setup** 会通过官方 API 验证机器人身份和目标访问权限(Telegram `getMe`，Discord 机器人 + 频道查询，Slack `auth.test`/`bots.info`/`conversations.info` 以及一个 Socket Mode URL)，并把结果存入 `~/.jeo/config.json` 的 `notifications.<provider>` 下 — **明文**；请保持该文件私有。它不会发送消息，也不会打开 socket。
+- **`initialized`**(`jeo daemon status`)表示守护进程已持有自己的锁并启动了各传输层；它并不证明 Telegram 轮询、Discord Gateway 握手或 Slack Socket Mode 连接已经成功。要验证这些请使用 `notify health` / `notify test`。
+- **更改 token 或目标**会重置 Discord 和 Slack 的 allowlist(你必须再次传入 `--allowed-user-ids`)以及 Telegram 的每会话主题映射；用完全相同的凭证和目标重新运行 setup 则会保留它们。
+- **远程命令是字面文本**(`/subagents` 等)，仅对已配置的聊天/频道和 allowlist 授权；Slack 还额外接受同名的已注册斜杠命令。allowlist 中的操作者实际上拥有本地代理的全部能力 — 请把这份名单当作信任边界对待。
+- **重试按提供商有界**: Telegram 遵守 429 的 `retry_after` 冷却(限制在 1 秒–1 小时之间)并使用独立的轮询退避；Discord 和 Slack 在 429 时按服务器的 `Retry-After` 最多重试 3 次，且绝不重发结果未知的 POST(平台可能已经收到了它)。
+- **孤儿恢复**: 守护进程崩溃后，其锁会变为 `stale`；下一次 `jeo daemon start` 会回收它。当宿主机能够报告进程启动时间时，`jeo daemon stop` 会拒绝向已被复用的 PID 发送信号；无法报告时也会明确说明。
+- **目前已验证**: Telegram 端到端(真实发送、轮询、干净关闭)。Discord 和 Slack 基于同一个守护进程实现，配有离线的传输/接线测试以及代码、安全和类型审查；尚未用真实的机器人/应用凭证进行实际连通性验证。
+
 ```
-┌─────────────────────┐        ┌─────────────────────┐         ┌─────────────────────┐
-│   interactive turn  │◄──ws──►│    notify daemon    │◄─poll──►│     Telegram bot    │
-│   SubagentRegistry  │        │     (singleton)     │         │    (paired chat)    │
-└─────────────────────┘        └─────────────────────┘         └─────────────────────┘
+┌─────────────────────┐        ┌──────────────────┐        ┌───────────────────────────┐
+│   interactive turn  │◄──ws──►│  notify daemon   │◄──────►│ Telegram Bot API (poll)   │
+│  SubagentRegistry   │  (one  │   (singleton)    │        │ Discord REST + Gateway WS │
+│  session endpoint   │  per   │                  │        │ Slack Web API + Socket WS │
+└─────────────────────┘ session└──────────────────┘        └───────────────────────────┘
 ```
 
-默认关闭、延迟绑定:只有设置了 `notifications.enabled` 且真正运行了一个 detached 子代理(`task {detached:true}`)才会绑定。守护进程扫描存活的会话发现文件,为每个会话建立一条回环 WebSocket,并且只在子代理状态发生*变化*时(启动 → 完成/失败/取消)推送消息 — 绝不会重复推送"仍在运行"这类状态。收到的 Telegram 命令仅对已配对的聊天授权,其余一律静默丢弃。
-
-| 命令 | 效果 |
-| --- | --- |
-| `/subagents` | 列出所有已连接会话中正在运行/最近的子代理 |
-| `/steer <sessionId> <subagentId> <message>` | 向正在运行的子代理发送实时消息 |
-| `/cancel <sessionId> <subagentId>` | 取消正在运行的子代理 |
-| `/help` | 显示命令参考 |
-
 ## 例行任务 (GitHub Actions)
 
 ```bash
@@ -317,10 +349,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.11.3]** (2026-10-01) — Remote control grew from one Telegram bot into one shared daemon serving Telegram, Discord, and Slack — and the workflow gates that were meant to block unverified work (`approve`/`team` plan identity, `done` re-checks, the autopilot ratchet) now actually block it.
 - **[0.11.2]** (2026-09-30) — OpenAI model pickers now follow the authenticated API and Codex catalogs, including subscription-only models, without hidden or stale entries.
 - **[0.11.1]** (2026-08-25) — Every non-interactive `jeo` run hung forever once Telegram notifications were configured — `echo "..." | jeo`, `jeo -p "..."` in CI, any scripted use. The work completed and the command returned; the process just never exited.
 - **[0.11.0]** (2026-08-25) — One bad boundary check was corrupting agent context, subagent fan-out, and the Telegram daemon's kill safety at the same time — and none of the three looked related from the outside.
-- **[0.10.0]** (2026-08-25) — jeo could only be pointed at ONE user-supplied endpoint (`config.openaiBaseUrl`), and doing so rebound the built-in `openai` provider: it stole the `openai/` routing prefix, collided with real OpenAI model ids, and could not speak the Anthropic Messages protocol at all. There was no way to run a company LiteLLM proxy and a self-hosted vLLM box at the same time, or to reach either from a script.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/config-schema.ts

@@ -104,11 +104,8 @@ export const ConfigSchema = z
         onAsk: z.boolean().optional(),
       })
       .optional(),
-    /** Remote subagent visibility/control over Telegram (gjc Telegram-daemon
-     *  parity, scoped to subagents — see `src/agent/notify/`). `enabled` is the
-     *  master toggle; a session only starts publishing its loopback endpoint
-     *  when this is true, and `jeo notify-daemon-run` refuses to poll Telegram
-     *  without a stored botToken + chatId. */
+    /** Remote session visibility/control. `enabled` is the master toggle;
+     *  each configured transport is hosted by the single notification daemon. */
     notifications: z
       .object({
         enabled: z.boolean().optional(),
@@ -123,18 +120,34 @@ export const ConfigSchema = z
           .object({
             botToken: z.string().optional(),
             chatId: z.string().optional(),
+            allowedUserIds: z.array(z.string().regex(/^[1-9]\d*$/)).optional(),
             /** Forum-topic thread id (message_thread_id) for supergroups with
              *  topics enabled — daemon pushes go into this topic. Ignored for a
              *  session-owned topic when `perSessionTopics` is true. */
             topicId: z.number().optional(),
             /** Auto-create and manage ONE forum topic per interactive session
              *  (gjc per-session-thread parity), instead of the single flat/global
-             *  `topicId` above. Requires the paired chat to be a supergroup with
-             *  Topics enabled AND private (fail-closed — see `TopicRegistry`).
+             *  `topicId` above. Requires a private chat with Threaded Mode
+             *  enabled (fail-closed — see `TopicRegistry`).
              *  Off by default; existing flat-topic/no-topic setups are unaffected. */
             perSessionTopics: z.boolean().optional(),
           })
           .optional(),
+        discord: z
+          .object({
+            botToken: z.string().optional(),
+            channelId: z.string().regex(/^[1-9]\d{0,19}$/).optional(),
+            allowedUserIds: z.array(z.string().regex(/^[1-9]\d{0,19}$/)).optional(),
+          })
+          .optional(),
+        slack: z
+          .object({
+            botToken: z.string().min(1),
+            appToken: z.string().min(1),
+            channelId: z.string().regex(/^[CGD][A-Z0-9]+$/),
+            allowedUserIds: z.array(z.string().regex(/^[UW][A-Z0-9]+$/)).min(1),
+          })
+          .optional(),
       })
       .optional(),
 

package/src/agent/debug-session.ts

@@ -236,12 +236,16 @@ export class DebugSession {
     const decoder = new TextDecoder();
     let buf = "";
     const deadline = Date.now() + CONNECT_TIMEOUT_MS;
+    let pendingRead: ReturnType<typeof reader.read> | undefined;
     try {
       while (Date.now() < deadline) {
-        const { value, done } = await Promise.race([
-          reader.read(),
-          new Promise<{ value: undefined; done: false }>((r) => setTimeout(() => r({ value: undefined, done: false }), 200)),
+        const result = await Promise.race([
+          pendingRead ??= reader.read(),
+          new Promise<undefined>((r) => setTimeout(() => r(undefined), 200)),
         ]);
+        if (!result) continue;
+        pendingRead = undefined;
+        const { value, done } = result;
         if (done) break;
         if (value) {
           const text = decoder.decode(value, { stream: true });

package/src/agent/engine.ts

@@ -276,15 +276,12 @@ export interface AgentLoopEvents {
   /** Step-budget change (gjc-style retry flow): the limit was extended because the
    *  turn is making progress. `limit` is the new max; `reason` is display-ready. */
   onBudget?(limit: number, reason: string): void;
-  /** Consulted when a lone `done` arrives. Return a corrective message to bounce
-   *  the done ONCE (e.g. "todo list still shows unfinished items — update it
-   *  first"); return null to let the turn finish. The engine guarantees at most
-   *  one bounce per turn, so a stubborn model can never loop here. `evidence` is
-   *  the SAME mutation/verification signal the engine's own done-gate already
-   *  computed (see `classifyDoneGate` above) — a caller-owned gate (e.g. the goal
-   *  verifier) can use it to deterministically downgrade an LLM-judged MET verdict
-   *  when the turn mutated files without a fresh passing verification, instead of
-   *  trusting the transcript self-report alone. */
+  /** Consulted on every completion attempt, including salvaged prose. Return a
+   *  corrective message to defer completion; null approves the caller-owned gate.
+   *  Corrections are bounded by GUARD_LIMITS.MAX_DONE_CORRECTIONS, after which a
+   *  rejected attempt stops incomplete. `evidence` is the SAME mutation/verification
+   *  signal the engine's own done-gate uses, so callers can reject unsupported
+   *  transcript-only success claims. */
   onBeforeDone?(
     reason: string,
     evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean }
@@ -583,10 +580,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   // calls (bad edits, failing commands) would otherwise burn the whole step budget.
   const MAX_FAILURES = GUARD_LIMITS.MAX_FAILURES;
   let consecutiveFailures = 0;
-  // done-verification guard (plan/gjc-inheritance.md B4, gjc ultragoal-guard 경량 계승):
-  // a turn that MUTATED files but shows no verification signal gets ONE pushback on
-  // `done` — run the relevant test/build, or call done again (the escape hatch for
-  // doc/config changes where verification is genuinely not applicable).
+  // Completion requires fresh passing verification after a successful mutation.
   let sawMutation = false;
   let sawVerification = false;
   // Monotonic ordering of mutation vs. verification events so the done gate can
@@ -595,16 +589,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   let mutVerSeq = 0;
   let lastMutationSeq = 0;
   let lastVerificationSeq = 0;
-  let donePushbackUsed = false;
-  // Abuse guard for the done-pushback escape hatch: the "second done always
-  // passes" latch below is meant for turns where verification is genuinely
-  // not applicable (docs/config-only changes) — not for a model that just
-  // resends `done` immediately with zero intervening action. Reset to false
-  // when the first pushback fires; any executed tool step (even read-only)
-  // sets it back to true, so the escape hatch requires at least one attempt.
-  let sawActionSincePushback = true;
-  // Caller-owned done gate (onBeforeDone) — also strictly once per turn.
-  let beforeDoneNudgeUsed = false;
+  let doneCorrections = 0;
   // F1 (round 4): the run-command of the most recent post-turn hook FAILURE whose
   // diagnostics the model saw but has not yet resolved (a later clean hook run
   // clears it). The done guard treats this as "verification missing" — the hook
@@ -981,6 +966,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     if (sawUsage) ev.onUsage?.({ ...acc }, lastCallUsage ? { ...lastCallUsage } : undefined);
 
     let invocation: any;
+    let salvagedAnswer = false;
     try {
       const extracted = extractJsonObjectWithSpan<any>(responseText, { preferKeys: ["tool", "tools"] });
       invocation = extracted.value;
@@ -991,30 +977,27 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       // would reinforce the corruption instead of self-correcting.
       responseText = extracted.matched;
     } catch (err) {
-      ev.onAssistant?.(responseText, null);
-      // Prose salvage: a reply with no JSON object at all is a chat-style final
-      // answer, not a malformed tool call. Bouncing it back only made the model
-      // apologize for the format — and that apology surfaced as the visible reply.
-      // Same salvage after repeated bounces: the text we have IS the best answer.
+      // Preserve chat-style final answers, but subject them to the same completion
+      // gates as explicit done calls rather than treating prose as proof of success.
       const trimmed = responseText.trim();
       parseFailures++;
       if (trimmed && (!trimmed.includes("{") || parseFailures > MAX_PARSE_BOUNCES)) {
+        salvagedAnswer = true;
+        invocation = { tool: "done", arguments: { reason: stripLeakedReasoningTags(trimmed) || trimmed } };
+      } else {
+        ev.onAssistant?.(responseText, null);
         pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-        // Strip leaked <think>/<parameter>/Harmony scaffolding some API-entered
-        // models emit inline so the salvaged answer doesn't surface raw tags.
-        return finish({ done: true, steps: step, doneReason: stripLeakedReasoningTags(trimmed) || trimmed });
+        history.push({
+          role: "user",
+          content:
+            `Your last reply was not a valid tool call (${(err as Error).message}). ` +
+            `Do NOT apologize or explain the formatting mistake. If that reply was your final answer, ` +
+            `resend it as {"tool":"done","arguments":{"reason":"<that answer, verbatim>"}}; ` +
+            `otherwise reply with exactly one JSON tool call: {"tool":"<name>","arguments":{...}}.`,
+        });
+        step++;
+        continue;
       }
-      pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-      history.push({
-        role: "user",
-        content:
-          `Your last reply was not a valid tool call (${(err as Error).message}). ` +
-          `Do NOT apologize or explain the formatting mistake. If that reply was your final answer, ` +
-          `resend it as {"tool":"done","arguments":{"reason":"<that answer, verbatim>"}}; ` +
-          `otherwise reply with exactly one JSON tool call: {"tool":"<name>","arguments":{...}}.`,
-      });
-      step++;
-      continue;
     }
     // A successfully parsed reply ends any bounce streak: MAX_PARSE_BOUNCES is a
     // CONSECUTIVE-failure salvage, not a cumulative one — without this reset a long
@@ -1066,64 +1049,27 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       toolCalls = toolCalls.slice(0, 6);
     }
 
-    ev.onAssistant?.(responseText, toolCalls[0]);
+    ev.onAssistant?.(responseText, salvagedAnswer ? null : toolCalls[0]);
 
     if (toolCalls.length === 1 && toolCalls[0].tool === "done") {
-      // done-verification gate — jeo's descendant of gjc's ultragoal-guard completion
-      // state machine (plan/gjc-inheritance.md B4). The classifier owns the JUDGMENT
-      // (which named state, which message); the loop owns the once-pushback latch.
-      const doneGate = classifyDoneGate({
+      const evidence = {
         sawMutation,
         sawVerification,
         verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
-        pendingHookFailure,
-      });
-      if (doneGate.block) {
-        if (!donePushbackUsed) {
-          donePushbackUsed = true;
-          sawActionSincePushback = false; // require a real attempt before the 2nd done is honored
-          pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-          history.push({ role: "user", content: doneGate.message });
-          step++;
-          continue;
-        }
-        if (!sawActionSincePushback) {
-          // Abuse guard: the model re-sent `done` immediately with zero intervening
-          // tool calls — not the intended "verification genuinely not applicable"
-          // escape hatch. Bounce once more instead of silently accepting it.
-          pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-          history.push({
-            role: "user",
-            content:
-              `${doneGate.message}\n\nYou called 'done' again without taking any further action. ` +
-              `Either run the relevant verification (test/build/lint) or take another concrete step, ` +
-              `then call done — do not resend 'done' unchanged.`,
-          });
-          step++;
-          continue;
-        }
-        // donePushbackUsed && sawActionSincePushback: the model made at least one
-        // real attempt since the pushback — honor the escape hatch.
-      }
-      // Caller-owned done gate (e.g. stale-todo reconciliation): ONE bounded
-      // bounce, then any later done passes — field case: a 28-step turn ended
-      // [DONE] with the Todos checklist still showing 1 in-progress + 4 pending
-      // because nothing ever forced a status update.
-      if (!beforeDoneNudgeUsed && ev.onBeforeDone) {
-        const nudge = await ev.onBeforeDone((toolCalls[0].arguments?.reason as string) ?? "", {
-          sawMutation,
-          sawVerification,
-          verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
-        });
-
-        if (nudge) {
-          beforeDoneNudgeUsed = true;
-          pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-          history.push({ role: "user", content: nudge });
-          ev.onNotice?.("done deferred once — final plan reconciliation requested");
-          step++;
-          continue;
+      };
+      const doneGate = classifyDoneGate({ ...evidence, pendingHookFailure });
+      const nudge = await ev.onBeforeDone?.((toolCalls[0].arguments?.reason as string) ?? "", evidence);
+      const rejection = [doneGate.block ? doneGate.message : "", nudge].filter(Boolean).join("\n\n");
+      if (rejection) {
+        if (doneCorrections >= GUARD_LIMITS.MAX_DONE_CORRECTIONS) {
+          return finish({ done: false, steps: step, doneReason: `Stopped: completion rejected after ${doneCorrections} corrections. ${rejection}` });
         }
+        doneCorrections++;
+        pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
+        history.push({ role: "user", content: rejection });
+        ev.onNotice?.(`done deferred — completion correction ${doneCorrections}/${GUARD_LIMITS.MAX_DONE_CORRECTIONS}`);
+        step++;
+        continue;
       }
       // Steering that arrived DURING this final step (after the top-of-loop drain,
       // while the model was generating its `done`): reopen the turn and handle it now
@@ -1148,6 +1094,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           continue;
         }
       }
+      if (salvagedAnswer) pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
       return finish({ done: true, steps: step, doneReason: stripLeakedReasoningTags((toolCalls[0].arguments?.reason as string) ?? "") });
     }
 
@@ -1445,20 +1392,18 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       if (results[i].executed) budget.record(callSigs[i], results[i].success, callTargets[i]);
 
     }
-    // done-verification guard bookkeeping: write/edit successes mark the turn as
-    // mutating; a successful bash whose command/output looks like a test/build run
-    // counts as verification. A monotonic seq records ORDER so the done gate can
-    // reject a verification that predates the last mutation (stale evidence).
+    // Only the latest recognized verification result is evidence; a later failure
+    // invalidates earlier success. Sequence numbers also reject tests before edits.
     for (let i = 0; i < toolCalls.length; i++) {
-      if (!results[i].executed || !results[i].success) continue;
+      if (!results[i].executed) continue;
       const t = toolCalls[i].tool;
-      if (t === "write" || t === "edit") {
+      if ((t === "write" || t === "edit") && results[i].success) {
         sawMutation = true;
         lastMutationSeq = ++mutVerSeq;
       } else if (t === "bash") {
         const cmd = String(toolCalls[i].arguments?.command ?? "");
         if (isVerificationSignal(cmd, results[i].output)) {
-          sawVerification = true;
+          sawVerification = results[i].success;
           lastVerificationSeq = ++mutVerSeq;
         }
       }
@@ -1494,7 +1439,6 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // Executed tool step = progress: the stall budget clocks time WITHOUT this.
     if (results.some(r => r.executed)) {
       lastProgressAt = Date.now();
-      sawActionSincePushback = true; // any real step after a pushback re-enables the done escape hatch
     }
     step++;
   }

package/src/agent/loop-guards.ts

@@ -41,6 +41,8 @@ export const GUARD_LIMITS = Object.freeze({
   MAX_REPEAT: 4,
   /** Consecutive different-but-failing steps before the turn stops. */
   MAX_FAILURES: 5,
+  /** Rejected completion attempts that may request a correction before stopping incomplete. */
+  MAX_DONE_CORRECTIONS: 3,
   /** Context-mutating refusal-ladder rungs (resend → reset → guidance strip) before
    *  recovery switches to unbounded backoff resends (gjc parity: never terminal). */
   MAX_REFUSAL_RETRIES: 3,
@@ -114,7 +116,7 @@ export function repeatHint(tool: string, prev?: { success: boolean; output: stri
 export interface DoneGateInput {
   /** A write/edit succeeded this turn. */
   sawMutation: boolean;
-  /** A test/build/typecheck/lint command succeeded this turn. */
+  /** The most recent recognized test/build/typecheck/lint command succeeded. */
   sawVerification: boolean;
   /**
    * A mutation landed AFTER the most recent successful verification — so the
@@ -129,7 +131,7 @@ export interface DoneGateInput {
 /** Verdict from {@link classifyDoneGate}: whether to bounce `done`, and the message. */
 export interface DoneGateVerdict {
   state: Extract<GuardState, "done_ok" | "done_unverified" | "done_stale_verification" | "done_hook_failing">;
-  /** When true, `done` should be bounced ONCE with `message` (the caller owns the once-gate). */
+  /** When true, completion must remain blocked until the condition is resolved. */
   block: boolean;
   /** Corrective message to push back on `done`; empty when `state === "done_ok"`. */
   message: string;
@@ -139,10 +141,9 @@ export interface DoneGateVerdict {
  * Classify whether a `done` should be accepted or bounced — the direct descendant of
  * gjc's `ultragoal-guard` completion gate (plan/gjc-inheritance.md B4).
  *
- * A turn that MUTATED files is blocked ONCE when its verification is missing
- * (no test/build signal), STALE (a passing run that predates the last edit), or
- * a post-turn hook is still failing. The caller owns the single-pushback latch; a
- * second `done` always passes (the escape hatch for unverifiable docs/config changes).
+ * A turn that MUTATED files remains blocked while verification is missing/failed,
+ * STALE (a passing run predates the last edit), or a post-turn hook is still failing.
+ * The caller bounds corrective retries without converting rejection into success.
  */
 export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
   const hookFailing = input.pendingHookFailure !== null;
@@ -155,8 +156,7 @@ export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
       block: true,
       message:
         `Your latest mutation left the post-turn hook "${input.pendingHookFailure}" FAILING (non-zero exit) — its diagnostics were shown in the tool result above. ` +
-        "Fix the reported problems (the hook re-runs on your next mutation), then call done. " +
-        "If the hook failure is a false positive, call done again and say why in the reason.",
+        "Fix the reported problems (the hook re-runs on your next mutation), then call done.",
     };
   }
   if (stale) {
@@ -165,16 +165,14 @@ export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
       block: true,
       message:
         "You verified earlier, but then modified files again — your last passing test/build no longer reflects the current tree. " +
-        "Re-run the narrowest verification command against the latest changes, then call done. " +
-        "If the later edits are verification-irrelevant (docs/config-only), call done again and say why in the reason.",
+        "Re-run the narrowest verification command against the latest changes, then call done.",
     };
   }
   return {
     state: "done_unverified",
     block: true,
     message:
-      "You modified files this turn but ran NO verification (no test/build/typecheck command succeeded). " +
-      "Run the narrowest command that proves your change works, then call done. " +
-      "If verification is genuinely not applicable (docs/config-only change), call done again and say why in the reason.",
+      "You modified files this turn but have no passing verification (no test/build/typecheck command succeeded, or the latest recognized verification failed). " +
+      "Run the narrowest command that proves your change works, then call done.",
   };
 }