jeo-code 0.11.2 → 0.11.3

package/src/autopilot.ts

@@ -180,6 +180,7 @@ export function foldBest(goal: Goal, best: number | undefined, score: number): n
 /**
  * Single source of truth for the ratchet keep/revert decision. Shared by step,
  * loop, and status so they can never diverge.
+ *  - every goal: a failed eval always reverts, regardless of its printed score.
  *  - gate goal: keep iff the eval passed (score is irrelevant).
  *  - min/max goal: a non-measurable (NaN) score can never prove improvement, so
  *    it is always reverted; otherwise keep iff it improves on the best so far.
@@ -190,7 +191,8 @@ export function decideStep(
   passed: boolean,
   best: number | undefined,
 ): "keep" | "revert" {
-  if (goal === "gate") return passed ? "keep" : "revert";
+  if (!passed) return "revert";
+  if (goal === "gate") return "keep";
   if (Number.isNaN(score)) return "revert";
   return isImprovement(goal, score, best) ? "keep" : "revert";
 }
@@ -255,8 +257,11 @@ function cmdStep(flags: Record<string, string>): void {
   if (decision === "revert" && flags["on-revert"]) {
     try {
       execSync(flags["on-revert"], { stdio: "inherit", shell: getShell() });
-    } catch {
-      console.error("jeo autopilot: --on-revert hook failed (decision still logged)");
+    } catch (error) {
+      appendLog({ type: "stop", reason: "rollback_failed", change, score, passed, prevBest: best ?? null, output, error: String(error) });
+      console.error(`jeo autopilot: stop — --on-revert hook failed: ${String(error)}`);
+      process.exitCode = 1;
+      return;
     }
   }
 
@@ -295,6 +300,7 @@ function cmdLoop(flags: Record<string, string>): void {
     if (!runnerOk) {
       appendLog({ type: "stop", reason: "runner_failed", iteration: i });
       console.log(`jeo autopilot: stop — runner failed at iteration ${i}`);
+      process.exitCode = 1;
       return;
     }
 
@@ -304,8 +310,11 @@ function cmdLoop(flags: Record<string, string>): void {
     if (decision === "revert" && flags["on-revert"]) {
       try {
         execSync(flags["on-revert"], { stdio: "inherit", shell: getShell() });
-      } catch {
-        /* logged below regardless */
+      } catch (error) {
+        appendLog({ type: "stop", reason: "rollback_failed", iteration: i, change: `loop#${i}`, score, passed, prevBest: best ?? null, output, error: String(error) });
+        console.error(`jeo autopilot: stop — --on-revert hook failed at iteration ${i}: ${String(error)}`);
+        process.exitCode = 1;
+        return;
       }
     }
     appendLog({ type: "step", iteration: i, change: `loop#${i}`, score, passed, decision, prevBest: best ?? null, output });

package/src/cli/runner.ts

@@ -112,8 +112,8 @@ export const COMMANDS: readonly CommandSpec[] = [
   },
   {
     name: "notify",
-    summary: "Configure/inspect remote subagent notifications over Telegram (gjc notify parity).",
-    usage: "notify [setup [--token <t> --chat-id <id>]|status]",
+    summary: "Configure/inspect Telegram, Discord, and Slack notification channels.",
+    usage: "notify [setup|status|health|test] [--provider telegram|discord|slack] [--token-env NAME] [--app-token-env NAME] [--chat-id ID|--channel-id ID] [--allowed-user-ids IDS]",
     loader: async () => {
       const m = await import("../commands/notify");
       return args => m.runNotifyCommand(args);
@@ -121,7 +121,7 @@ export const COMMANDS: readonly CommandSpec[] = [
   },
   {
     name: "daemon",
-    summary: "Manage the background Telegram notification/subagent-control daemon.",
+    summary: "Manage the shared Telegram/Discord/Slack notification daemon.",
     usage: "daemon [status|start|stop|reload]",
     loader: async () => {
       const m = await import("../commands/daemon");
@@ -197,7 +197,7 @@ export const COMMANDS: readonly CommandSpec[] = [
   },
   {
     name: "notify-daemon-run",
-    summary: "(internal) Foreground worker for the Telegram notification daemon, spawned by 'jeo daemon start'.",
+    summary: "(internal) Foreground notification worker, spawned by 'jeo daemon start'.",
     usage: "notify-daemon-run",
     loader: async () => {
       const m = await import("../agent/notify/telegram-daemon");

package/src/commands/approve.ts

@@ -67,11 +67,6 @@ export async function approvePlan(planPathInput: string, cwd: string): Promise<A
     };
   }
 
-  // Idempotency: check if already approved
-  if (ralplanState.approved) {
-    return { ok: true, message: `[SUCCESS] Plan is already approved.` };
-  }
-
   // Round-10 #4 (architect ref 8-Round10Planning): approval is a GATE, not a
   // rubber stamp — validate the plan against the exact contract `jeo team`
   // enforces, so a schema-invalid/unknown-role plan is refused HERE instead of
@@ -118,17 +113,27 @@ export async function approvePlan(planPathInput: string, cwd: string): Promise<A
     };
   }
 
-  // Round-13: verify the plan's hash matches the consensus hash to prevent silent edits
-  if (ralplanState.consensus_hash) {
-    const currentHash = createHash("sha256").update(planContent).digest("hex");
-    if (currentHash !== ralplanState.consensus_hash) {
-      return {
-        ok: false,
-        message:
-          `[ERROR] Refusing to approve: the plan file has been modified since the consensus critic reviewed it.\n` +
-          `  Re-run 'jeo ralplan' to let the critic review the updated plan, then approve again.`,
-      };
-    }
+  // Approval and idempotent re-approval both require the exact reviewed bytes.
+  if (!ralplanState.consensus_hash) {
+    return {
+      ok: false,
+      message:
+        `[ERROR] Refusing to approve: the plan lacks a consensus review hash.\n` +
+        `  Re-run 'jeo ralplan' so the consensus critic can review the plan, then approve again.`,
+    };
+  }
+  const currentHash = createHash("sha256").update(planContent).digest("hex");
+  if (currentHash !== ralplanState.consensus_hash) {
+    return {
+      ok: false,
+      message:
+        `[ERROR] Refusing to approve: the plan file has been modified since the consensus critic reviewed it.\n` +
+        `  Re-run 'jeo ralplan' to let the critic review the updated plan, then approve again.`,
+    };
+  }
+
+  if (ralplanState.approved) {
+    return { ok: true, message: `[SUCCESS] Plan is already approved.` };
   }
 
   // Update ralplan-state.json to approved: true

package/src/commands/daemon.ts

@@ -1,5 +1,5 @@
 /**
- * `jeo daemon status|start|stop|reload` — manage the background Telegram
+ * `jeo daemon status|start|stop|reload` — manage the shared Telegram/Discord/Slack
  * notification/subagent-control daemon (gjc `gjc daemon` parity, scoped to
  * jeo's one daemon kind). See `src/agent/notify/daemon-control.ts`.
  */
@@ -10,8 +10,10 @@ async function printStatus(): Promise<void> {
   if (!status.configured) {
     console.log("notifications not configured — run 'jeo notify setup' first.");
   }
-  if (status.running) {
-    console.log(`running (pid ${status.pid}, started ${new Date(status.startedAt!).toISOString()})`);
+  if (status.pairing) {
+    console.log(`pairing owns polling (pid ${status.pid}); daemon not running`);
+  } else if (status.running) {
+    console.log(`process ${status.ready ? "initialized" : "initializing"} (pid ${status.pid}, started ${new Date(status.startedAt!).toISOString()}); platform connectivity not checked`);
     // Say so when the PID-reuse guard could not actually run. On a host with no `/proc`
     // and no usable `ps` (distroless images, seccomp-hardened sandboxes) "running" is an
     // existence-only guess: the pid is alive, but it may belong to an unrelated process

package/src/commands/launch/agents-slash.ts

@@ -54,12 +54,12 @@ function providerDefaultModel(p: ProviderName): string {
   return openaiCompatDef(p)?.defaultModel ?? STATIC_PROVIDER_DEFAULT[p] ?? "";
 }
 
-// Pick-list entries for ONE provider, with static fallbacks so the list is
-// never empty. Pure function — mirrors launch.ts's exported `providerPickEntries`
+// Pick-list entries for ONE provider. Antigravity requires live availability;
+// other providers retain static fallbacks. Mirrors launch.ts's `providerPickEntries`
 // (duplicated here rather than imported to avoid a launch.ts <-> launch/*.ts cycle).
 function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
-  if (fromLive.length) return fromLive;
+  if (fromLive.length || want === "antigravity") return fromLive;
   const catalog = catalogByProvider(want);
   if (catalog.length) {
     return catalog.map((m, i) => ({ index: i + 1, provider: want, model: qualifyModelId(m.providerModel, want) }));
@@ -253,6 +253,11 @@ export async function runAgentsSlash(input: string, ctx: AgentsSlashCtx): Promis
     const forProvider = providerPickEntries(live, want);
     const liveForProvider = live.some(r => r.ok && r.provider === want && r.models.length > 0);
     const explicit = tokens[3];
+    if (want === "antigravity" && !forProvider.length && (!explicit || explicit.startsWith("#"))) {
+      const reason = live.find(r => r.provider === want)?.error ?? "no account-available models returned";
+      console.log(`Cannot list ${want} models: ${reason}. Retry discovery or specify an explicit model id.`);
+      return result();
+    }
     let chosenModel: string;
     if (explicit && forProvider.length) {
       const sel = resolveSelection(forProvider, explicit);

package/src/commands/launch.ts

@@ -335,22 +335,22 @@ function providerDefaultModel(p: ProviderName): string {
 }
 
 /**
- * Pick-list entries for ONE provider. OpenAI availability comes only from live
- * results; other providers retain their offline catalog fallbacks.
+ * Pick-list entries for ONE provider. OpenAI and Antigravity availability comes
+ * only from live results; other providers retain their offline catalog fallbacks.
  *
  * Live discovery yields ids only for a logged-in, reachable provider, and
  * `catalogOr` backfills the static catalog for OAuth sources and for API-key
  * providers whose models-list endpoint is absent (HTTP 404, e.g. Tencent MaaS).
  * A not-yet-configured provider still has an empty live list, so prefer live ids;
  * else the provider's capability catalog; else its single known default model (all
- * 24 OpenAI-compat providers carry one) so the user always sees at least one id.
+ * 24 OpenAI-compat providers carry one). Antigravity never uses these fallbacks.
  */
 export function providerPickEntries(live: ProviderModelsResult[], want: ProviderName): PickEntry[] {
   const fromLive = flattenModels(live.filter(r => r.provider === want));
   if (fromLive.length) return fromLive;
-  // An OpenAI empty/error response is authoritative for this picker. Offering
-  // the static capability catalog here would fabricate account availability.
-  if (want === "openai") return [];
+  // An OpenAI or Antigravity empty/error response is authoritative for this picker.
+  // Offering the static capability catalog here would fabricate account availability.
+  if (want === "openai" || want === "antigravity") return [];
   const catalog = catalogByProvider(want);
   if (catalog.length) {
     return catalog.map((m, i) => ({ index: i + 1, provider: want, model: qualifyModelId(m.providerModel, want) }));
@@ -1519,15 +1519,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
           const goalState = await readGoalState(cwd);
           if (goalState && goalState.condition) {
-            const reBlockCount = goalState.verdicts.filter(v => v.verdict === "NOT_MET" || v.verdict === "IMPOSSIBLE").length;
-            const MAX_RE_BLOCKS = 2;
-
-            if (reBlockCount >= MAX_RE_BLOCKS) {
-              if (tui) tui.events().onNotice?.(`[Goal Verifier] Re-block cap of ${MAX_RE_BLOCKS} reached. Auto-allowing done.`);
-              else console.log(`[Goal Verifier] Re-block cap of ${MAX_RE_BLOCKS} reached. Auto-allowing done.`);
-              return null;
-            }
-
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
             const llmVerdict = await verifyGoal(goalState.condition, history, resolveVerifierModel(turnConfig));
             // Deterministic downgrade: a fresh MET from the transcript-only LLM
@@ -4197,35 +4188,36 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // `rl`/`promptInput`'s `pendingRemoteInject`, and `pendingStdinLines`, all
   // established by now. See the Tier 2 contract's "Session-side routing".
   if (sessionNotifyEndpoint) {
-    sessionNotifyEndpoint.onUserMessage = (msg): void => {
-      void (async () => {
-        // Resolve any attached photo/document paths (already downloaded to
-        // local temp files by the daemon) into real ImageAttachments via the
-        // SAME path `attachImagePaths` uses for local drag-drop — one image
-        // ingestion mechanism, not a parallel one. Bare paths never contain
-        // whitespace here (daemon-generated temp names), so simple whitespace
-        // joining is a safe token boundary for the path-token scanner.
-        const withPaths = msg.imagePaths?.length ? `${msg.text} ${msg.imagePaths.join(" ")}`.trim() : msg.text;
-        const attached = await attachImagePaths(withPaths, pendingImages.length + 1);
-        const cleanedText = attached.images.length ? attached.text : msg.text;
-        if (attached.images.length) pendingImages.push(...attached.images);
-
-        if (interactiveTurnActive && currentTurnSteer) {
-          // Busy: steer the running turn exactly like a local mid-turn Enter.
-          currentTurnSteer.push(cleanedText);
-          currentTurnSteer.flushCard(cleanedText);
-          return;
-        }
-        // Idle: never hijack text the user is actively typing locally — only
-        // abort+inject when the readline buffer is confirmed empty (verified
-        // empirically: aborting mid-partial-type corrupts the buffer).
-        const rli = rl as unknown as { line?: string };
-        if (rli.line === "" && pendingRemoteInject?.(cleanedText)) return;
-        // No question pending, or the user is mid-type: queue for the NEXT
-        // prompt cycle instead (same queue `pendingMidTurnCommands`/paste-merge
-        // already feed — consumed at the top of the next `promptInput` call).
-        pendingStdinLines.push(cleanedText);
-      })();
+    sessionNotifyEndpoint.onUserMessage = async (msg): Promise<void | boolean> => {
+      // Resolve any attached photo/document paths (already downloaded to
+      // local temp files by the daemon) into real ImageAttachments via the
+      // SAME path `attachImagePaths` uses for local drag-drop — one image
+      // ingestion mechanism, not a parallel one. Bare paths never contain
+      // whitespace here (daemon-generated temp names), so simple whitespace
+      // joining is a safe token boundary for the path-token scanner.
+      const withPaths = msg.imagePaths?.length ? `${msg.text} ${msg.imagePaths.join(" ")}`.trim() : msg.text;
+      const attached = await attachImagePaths(withPaths, pendingImages.length + 1);
+      const cleanedText = attached.images.length ? attached.text : msg.text;
+      // Attachment normalization must not expose a remote slash command that
+      // bypasses the local approval prompt or changes local execution policy.
+      if (cleanedText.trimStart().startsWith("/")) return false;
+      if (attached.images.length) pendingImages.push(...attached.images);
+
+      if (interactiveTurnActive && currentTurnSteer) {
+        // Busy: steer the running turn exactly like a local mid-turn Enter.
+        currentTurnSteer.push(cleanedText);
+        currentTurnSteer.flushCard(cleanedText);
+        return;
+      }
+      // Idle: never hijack text the user is actively typing locally — only
+      // abort+inject when the readline buffer is confirmed empty (verified
+      // empirically: aborting mid-partial-type corrupts the buffer).
+      const rli = rl as unknown as { line?: string };
+      if (rli.line === "" && pendingRemoteInject?.(cleanedText)) return;
+      // No question pending, or the user is mid-type: queue for the NEXT
+      // prompt cycle instead (same queue `pendingMidTurnCommands`/paste-merge
+      // already feed — consumed at the top of the next `promptInput` call).
+      pendingStdinLines.push(cleanedText);
     };
     sessionNotifyEndpoint.onConfigCommand = (cmd): void => {
       if (cmd.verbosity !== undefined) notifyVerbosity = cmd.verbosity;