jeo-code 0.12.10 → 0.12.11

package/README.zh.md

@@ -1,12 +1,12 @@
 <p align="center">
-  <img src="assets/hero.png" alt="jeo-code 自主编码代理主视觉插图" width="100%" />
+  <img src="assets/hero.png" alt="发光的奇幻风景中，jeo-code 红色小龙虾魔法师与毛绒伙伴" width="100%" />
 </p>
 
 <h1 align="center">jeo-code (jeo)</h1>
 
 <p align="center">
   <strong>Encode intention. Decode software.</strong><br />
-  基于 Bun 的 AI 编码代理 CLI — 需求访谈、经评审的计划、带门禁的执行、诚实的验证。
+  基于 Bun 的 AI 编码代理 CLI — 需求访谈、经评审的计划、带门禁的执行、基于证据的检查。
 </p>
 
 <p align="center">
@@ -32,6 +32,8 @@
 
 - [双向消息网关（Discord、Telegram、Slack）](docs/integrations/messenger.md)
 
+**消息网关** — `jeo messenger` 独立于通知守护进程，支持白名单内的 Discord、Telegram 和 Slack 会话。本地工具默认关闭；明确启用 `computer` 可访问共享主机桌面，启用 `bash` 可访问 shell，两者均非沙箱。详见[消息网关指南](docs/integrations/messenger.md)。
+
 📖 **[使用指南](docs/usage-guide.md)** — 安装、TUI 操作（↑ 历史、Ctrl+O、`!` shell）、斜杠命令、`/resume`、规格优先工作流，附演示视频。
 
 <video src="https://raw.githubusercontent.com/akillness/jeo-code/main/docs/jeo-code-promo.mp4" controls muted playsinline width="100%"></video>
@@ -43,7 +45,7 @@
 - **多提供商、单一循环** — Anthropic / OpenAI(+Codex) / Gemini / Antigravity / Ollama / LM Studio，以及 20+ 个 OpenAI、Anthropic 兼容云服务(Groq、DeepSeek、Mistral、OpenRouter、xAI、Kimi、z.ai 等)，统一在一个 JSON 工具循环中 — **还包括你自己注册的端点**: `jeo provider add --id my-proxy --base-url https://…`(或 `--preset litellm|vllm|sglang|azure-openai|…`)让 LiteLLM 代理、自托管 vLLM、企业内部 Anthropic 网关拥有各自的路由前缀、模型列表和凭据，而不是劫持内置的 `openai` 提供商。输入框内直接 OAuth 登录(`/provider login`)，每次模型选择都会持久化为新的默认值，而 prompt routing 只会自动选择真实可用的凭据路径: Gemini OAuth 会走 provider-qualified 的 `antigravity/*` 代理模型集，**以账号当前实际提供的为准**(实时发现 — 例如 Gemini 3.6 Flash 各档、Gemini 3.1 Pro、Claude Sonnet/Opus 4.6；非对话模型与已弃用的 id 会被过滤掉，列表为空时也不会用静态目录顶替)，绝不选择需要 `GEMINI_API_KEY` 的 public `google/gemini-*` 行；如果已配置的路由指向尚未就绪的提供商，jeo 会先切换到同层级的等价凭据模型，再退回默认模型。
 - **编辑完整性** — read 输出携带内容锚点(`42ab|`)；带锚点的编辑会与当前文件校验、行移动时自动重映射、不匹配时连同最新内容一起拒绝 — 绝不污染文件。
 - **自我修正的验证循环** — 配置 post-edit 钩子(tsc / eslint / 测试)，代理会*亲自读取*诊断并在循环内修复；钩子未通过时 `done` 会被阻断。
-- **没有表演的真实门禁** — `ralplan` 共识由真正读取仓库的 critic 子代理执行，`[OKAY]` 裁决被持久化且 `jeo approve` *强制要求*它；`ultragoal` 诚实报告(套件运行只是全局信号，绝不伪造逐条通过)。
+- **真实门禁，不做表演** — `ralplan` 共识由真正读取仓库的 critic 子代理执行，`[OKAY]` 裁决被持久化且 `jeo approve` *强制要求*它；`ultragoal` 将套件运行作为全局信号，不伪造逐条通过。这不能证明测试运行器真实可信或工作区正确。
 - **崩溃耐久、本地优先** — 全部状态位于 `.jeo/`，原子写入、跨进程运行锁、失败任务标记 + 恢复时的部分编辑警告。
 - **动态步数预算** — 只要近期工具调用展现新的进展就持续延长，停滞时优雅收敛为总结；子代理保持精确的步数契约。
 - **内联 TUI** — 已完成的工作流入真实滚动缓冲区(回合中也可用 tmux 滚轮)，代理运行时普通查询输入框仍保持可见并可编辑。Ctrl+O 详细信息切换、主题、剪贴板图片粘贴(Ctrl+V)、CJK/表情安全的宽度计算。
@@ -52,9 +54,9 @@
 - **低价位评分模型路由** — `/goal` 验证器、`critic` 子代理角色,以及未锁定的 `task` 扇出批次,现在默认使用低价位、已配置凭证的模型,而不是悄悄搭乘与它们所评分/执行的工作相同的全价模型(`resolveVerifierModel`,针对浏览器 `verify` 动作按视觉能力过滤,确保纯文本的低价模型不会悄悄丢弃附带的截图)。
 - **`jeo routine init`** — 生成一个 GitHub Actions 工作流,在 schedule/issue/PR 触发器上以无头模式运行 jeo(`jeo "<prompt>" -p`),运行在 GitHub 自己的 runner 上 — 不需要笔记本电脑,并且不会给 jeo 自身增加任何新的攻击面(没有进程内调度器或 webhook 监听器)。`--dry-run` 可预览,`--no-pr` 则改为直接提交而非默认的每次运行一个 PR。
 - **远程监控与控制(Telegram、Discord、Slack)** — 配对一次机器人(`jeo notify setup --provider telegram|discord|slack`)后，一个共享的 `jeo daemon start` 会在所有活跃会话中、子代理每次状态变化(启动 → 完成/失败/取消)时推送消息，并接受来自人类 allowlist 的 `/subagents`、`/steer`、`/cancel`(Discord/Slack 上还有 `/sessions` 和 `/send`)回传。Telegram 额外提供论坛主题、内联键盘和图片附件；Discord 使用 REST + Gateway WebSocket；Slack 使用 Web API + Socket Mode。附带各平台详细配置指南及可安装的 Agent Skill(`channel-notify`)。
-- **无法绕过的门禁** — `approve` 会重新校验它正在批准的那份计划的精确摘要，`team` 会拒绝已审阅摘要发生变化的计划；`done` 调用会对照最新的验证证据重新检查(后来的失败检查会使先前的通过失效，三次纠正往返后硬性拒绝)；`autopilot` ratchet 会把失败的回滚记录为 `rollback_failed` 并以非零状态停止，而不是声称该步骤已回退。
+- **有边界的工作流门禁，不是证明** — `approve` 会重新校验其批准的确切计划摘要，`team` 会拒绝审核后摘要已变化的计划。调用 `done` 时，当前回合的变更与验证信号可以阻止或降级完成；`/goal` 另加一次基于对话/工具历史的 LLM 判断和确定性证据门禁。两者都不会独立重新读取工作区；工具/测试输出是证据，并不能证明运行器或结果可信。这些检查也不保证回合结束后后台任务不会修改文件。`autopilot` ratchet 会将回滚失败记为 `rollback_failed` 并以非零状态停止。
 - **不阻塞回合的会话级异步执行** — 通过 `task` 工具真实的 `tasks` 数组扇出独立工作，不阻塞父回合。detached 子代理、后台 job 和逐行 monitor 可在后续回合中继续使用 `subagent`/`job`/`monitor` 的 `list`、`inspect`、`await`、`cancel`、`tail` 控制。内联 TUI 为每个 worker 保留独立的实时 activity 槽位，并在会话退出或 Ctrl-C 时清理全部 registry。
-- **独立验证器，真正强制执行** — 计划再也无法跳过 architect/critic 步骤: `PlanSchema` 会拒绝任何以未验证变更结尾的计划(把验证器放在它该检查的变更之前也不算数)，在 `ralplan` 起草阶段和 `team`/`approve` 执行阶段都强制生效。每一次 architect/critic 裁决也都必须展示真实证据 — 观测到的 `read`/`search`/`find`/`ast_grep`/`lsp` 调用为零，无论文本怎么声称，裁决都会被拦下。
+- **计划 critic 门禁** — 计划不能跳过 architect/critic 步骤：`PlanSchema` 会拒绝以未验证变更结束的计划(变更之前的 verifier 不算)，并在 `ralplan` 起草阶段以及 `team`/`approve` 执行阶段生效。critic 裁决需要观察到仓库读取/搜索证据；这提高可审查性，但不等于独立验证工作区。
 - **安全边界自动模型回退** — 未分类的安全拒绝(可能是分类器误报，而非真实的内容策略命中)现在会切换到真正不同提供商的模型，而不是在同一个模型上无限退让 — 与现有的 rate-limit 快速回退是同一套模式。`Refusal (<category>)` 这种形态的确定性拒绝不受影响，仍然零回退硬失败。
 - **内存: 应得的信任** — 概念的验证日期现在只在蒸馏阶段被明确标记为已验证时才会写入，而不是每次写入都记录；`isConceptStale` 把未验证(或超过 30 天过期)的概念视为需要重新验证，而不是信任一个被动的时间戳。
 - **动态工作流(`eval` 工具)** — 围绕子代理派遣编写真正的 JS 控制流: `task(role, taskText, context?)`、`parallel(thunks)`、`pipeline(items, ...stages)`、`log(message)`，组合出 `task` 单阶段 `tasks[]` 批次无法表达的顺序/分支编排。运行在隔离的 Worker 线程中，具备真正的抢占式超时(`worker.terminate()`，而非同进程内的竞争) — 与 `bash` 同等的全进程信任级别，不假装沙箱，受同一个 interview 变更锁门控。
@@ -70,7 +72,6 @@ bun install -g jeo-code
 jeo --version
 ```
 
-> 从重命名前的版本升级？旧 CLI 名称 `joc` 的二进制文件现在会被 `scripts/install.sh` / `scripts/uninstall.sh` 自动移除；手动移除: `rm -f ~/.local/bin/joc ~/.bun/bin/joc`。
 
 ## 快速开始
 
@@ -155,7 +156,7 @@ jeo launch --model agy/gemini-4-argon-low --plan --no-tui --no-session --no-skil
 
 ## Spec-first 工作流
 
-需求 → 计划 → 批准 → 执行 → 验证，经由 `.jeo/state/` 串联，每次交接都有**可阻断的真实门禁**:
+需求 → 计划 → 批准 → 执行 → 验证由 `.jeo/state/` 管理。各阶段门禁可以阻止相应流程，但不保证每次交接或最终完成结果都正确。
 
 ```bash
 jeo deep-interview "描述你想构建的东西"
@@ -164,6 +165,8 @@ jeo approve <计划路径>
 jeo team
 jeo ultragoal
 ```
+![Interview → reviewed plan → approval → execution → verification](assets/workflow.svg)
+
 ```
   ┌──────────────────────┐
   │   deep-interview     │  Socratic ambiguity gate · seed frozen when concrete
@@ -186,15 +189,17 @@ jeo ultragoal
              │ all tasks done
              ▼
   ┌──────────────────────┐
-  │      ultragoal       │  Honest verification — suite once, no fabrication
+  │      ultragoal       │  基于证据的报告 — 套件运行一次，不伪造逐项通过
   └──────────────────────┘
 ```
 
 - **deep-interview** — 基于歧义度评分的苏格拉底循环；只有标准足够具体才冻结种子(纯含糊标准会被拒绝)，且种子必须通过自身解析器的往返校验。新想法绝不会静默复用已完成的访谈。
 - **ralplan** — 起草阶段 + **真正读取仓库的 critic 子代理门禁**: 强制并持久化 `[OKAY]`/`[ITERATE]`/`[REJECT]` 裁决。无效计划(schema、未知角色)不会被标记为 complete。
 - **approve** — 校验 `team` 执行的确切契约(schema+角色)，并要求持久化的 `[OKAY]` 共识裁决。
-- **team** — 串行计划执行器: 跨进程运行锁、过期计划重置、按任务的子代理契约、父侧变更审计(零写入的"完成"会被标记)、失败标记 + 恢复时的部分编辑警告。
-- **ultragoal** — 诚实验证: 套件作为全局信号只运行一次，标准只被记录，绝不伪造为逐条通过。
+- **team** — 在跨进程运行锁下执行已审阅的步骤。具有相同 `parallel_group` 的连续步骤在独立 Git worktree 中并行执行并按顺序合并；任务契约、变更审计和失败标记会暴露未完成的工作。
+- **ultragoal** — 基于证据的报告：套件运行一次作为全局信号，不伪造逐项通过。这不能证明测试运行器真实可信或工作区满足目标。
+
+`/goal` 会通过单独的 LLM 调用判断对话和已记录的工具历史，并对当前回合的修改与新验证信号应用确定性门禁。它不会重新读取工作区，也不会验证测试输出是否真实；launch 完成门禁也不检查仍在运行的后台任务。
 
 ## 验证钩子(自我修正)
 
@@ -416,10 +421,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[0.12.10]** (2026-11-02)
+- **[0.12.11]** (2026-11-02)
 - **[0.12.9]** (2026-11-02)
 - **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
 - **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
-- **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "jeo-code",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
+
   "main": "src/cli.ts",
   "bin": {
     "jeo": "src/cli.ts"

package/src/agent/ast-edit-tool.ts

@@ -71,6 +71,7 @@ export function createAstEditTool(): ToolHandler {
 
     const perFile: { file: string; replaced: number }[] = [];
     let totalReplaced = 0;
+    let mutationMayHaveOccurred = false;
 
     for (const abs of files) {
       let original: string;
@@ -107,8 +108,9 @@ export function createAstEditTool(): ToolHandler {
 
       const rel = path.relative(cwd, abs) || abs;
       const res = await writeTool(rel, newText, cwd);
+      if (res.success) mutationMayHaveOccurred = true;
       if (!res.success) {
-        return { success: false, output: "", error: `${rel}: ${res.error ?? "write failed"}` };
+        return { success: false, output: "", error: `${rel}: ${res.error ?? "write failed"}`, mutationMayHaveOccurred: res.mutationMayHaveOccurred === true || mutationMayHaveOccurred };
       }
       perFile.push({ file: rel, replaced: selected.length });
       totalReplaced += selected.length;

package/src/agent/engine.ts

@@ -121,6 +121,40 @@ const READONLY_TOOL_NAMES: Record<string, true> = {
   web_search: true,
   calc: true,
 };
+/** Invoked tools that can change the workspace and therefore invalidate old verification. */
+const MUTATING_TOOL_NAMES: Record<string, true> = {
+  write: true,
+  edit: true,
+  mkdir: true,
+  delete: true,
+  ast_edit: true,
+  lsp_rename: true,
+  eval: true,
+};
+/** Debug actions that execute or alter the target process rather than inspect it. */
+const MUTATING_DEBUG_ACTIONS: Record<string, true> = {
+  launch: true,
+  continue: true,
+  step_over: true,
+  step_in: true,
+  step_out: true,
+  pause: true,
+  evaluate: true,
+  terminate: true,
+  write_memory: true,
+  custom_request: true,
+};
+/** Computer actions affect external UI state; only observation and waiting are read-only. */
+function computerActionMayAffectState(action: unknown): boolean {
+  if (!action || typeof action !== "object") return true;
+  const value = action as { action?: unknown; actions?: unknown };
+  if (value.action === "screenshot" || value.action === "wait") return false;
+  if (value.action === "batch") {
+    return !Array.isArray(value.actions) || value.actions.some(computerActionMayAffectState);
+  }
+  return true;
+}
+
 /** Tool-protocol description injected into the system prompt. */
 export const TOOL_PROTOCOL = [
   "You have these tools (call exactly ONE per step, or batch multiple independent calls):",
@@ -301,6 +335,8 @@ export interface AgentLoopEvents {
     reason: string,
     evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean }
   ): Promise<string | null> | string | null;
+  /** Updated after each executed tool batch so callers can persist mutation evidence across turns. */
+  onEvidence?(evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean }): Promise<void> | void;
 
   /** Fired when a mid-turn steering message (an additional user query typed while
    *  the turn is running) is injected into the live history. `text` is the raw
@@ -1216,7 +1252,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       let success: boolean;
       let output: string;
       let images: import("../ai/types").ImageAttachment[] | undefined;
-
+      let mutationMayHaveOccurred: boolean | undefined;
       if (tool === "done") {
         success = false;
         output = "Error: 'done' can only be called as the single tool invocation, not in a batch. Please send 'done' alone.";
@@ -1245,14 +1281,23 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
               success = res.success;
               images = res.images;
               output = res.success ? res.output : (res.error ? (res.output ? `${res.error}\n${res.output}` : res.error) : res.output);
-            } catch (err: any) {
+              mutationMayHaveOccurred = res.mutationMayHaveOccurred;
+            } catch (err: unknown) {
               success = false;
-              output = err?.message || String(err);
+              output = err instanceof Error ? err.message : String(err);
+              const explicitSignal = err && typeof err === "object" && "mutationMayHaveOccurred" in err && err.mutationMayHaveOccurred === true;
+              const knownMutatingCall =
+                (MUTATING_TOOL_NAMES[tool] === true && (tool !== "lsp_rename" || args?.apply !== false)) ||
+                tool === "bash" ||
+                (tool === "debug" && MUTATING_DEBUG_ACTIONS[String(args?.action ?? "")] === true) ||
+                (tool === "computer" && computerActionMayAffectState(args)) ||
+                ((tool === "monitor" || tool === "job") && String(args?.action ?? "").trim().toLowerCase() === "start");
+              if (explicitSignal || knownMutatingCall) mutationMayHaveOccurred = true;
             }
           }
         }
       }
-      return { success, output, images };
+      return { success, output, images, mutationMayHaveOccurred };
     };
 
     const WRITE_TOOLS = new Set(["write", "edit"]);
@@ -1295,7 +1340,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       }
     }
 
-    const results: { success: boolean; output: string; executed: boolean; images?: import("../ai/types").ImageAttachment[] }[] = Array.from(
+    const results: { success: boolean; output: string; executed: boolean; images?: import("../ai/types").ImageAttachment[]; mutationMayHaveOccurred?: boolean }[] = Array.from(
       { length: toolCalls.length },
       () => ({ success: false, output: "", executed: false })
     );
@@ -1398,11 +1443,11 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       if (executedIndices.length > 0) {
         await processAndPushResults(executedIndices);
       }
-      return finish({ done: false, steps: step, doneReason: "Cancelled." });
+    } else {
+      const allIndices = toolCalls.map((_, i) => i);
+      await processAndPushResults(allIndices);
     }
 
-    const allIndices = toolCalls.map((_, i) => i);
-    await processAndPushResults(allIndices);
 
     // Score the budget window per CALL, not per batch: a batch of five failing
     // edits plus one trivial successful read must not look like a progressing
@@ -1411,22 +1456,75 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       if (results[i].executed) budget.record(callSigs[i], results[i].success, callTargets[i]);
 
     }
-    // Only the latest recognized verification result is evidence; a later failure
-    // invalidates earlier success. Sequence numbers also reject tests before edits.
+    // Process calls in execution order: a successful verification supersedes
+    // mutation evidence before it, but anything after that verification remains
+    // stale. Verification commands are shell calls, so do not let a wrapper's
+    // mutationMayHaveOccurred flag turn the verifier itself into a later mutation.
     for (let i = 0; i < toolCalls.length; i++) {
       if (!results[i].executed) continue;
       const t = toolCalls[i].tool;
-      if ((t === "write" || t === "edit") && results[i].success) {
+      const verificationCall = t === "bash" && isVerificationSignal(String(toolCalls[i].arguments?.command ?? toolCalls[i].arguments?.cmd ?? ""));
+      if (verificationCall) {
+        if (results[i].success) {
+          sawVerification = true;
+          lastVerificationSeq = ++mutVerSeq;
+        } else {
+          sawVerification = false;
+          if (results[i].mutationMayHaveOccurred === true) {
+            sawMutation = true;
+            lastMutationSeq = ++mutVerSeq;
+          }
+        }
+        continue;
+      }
+
+      const output = String(results[i].output ?? "").trim();
+      const noOpMutation = results[i].success && (
+        (t === "ast_edit" && (output.startsWith("0 matches for pattern") || output.startsWith("No TypeScript/JavaScript files matched"))) ||
+        (t === "lsp_rename" && output === "No rename locations found.")
+      );
+      const structuredMutation = results[i].mutationMayHaveOccurred === true && !noOpMutation;
+      const builtInMutation = MUTATING_TOOL_NAMES[t] === true &&
+        (t !== "lsp_rename" || toolCalls[i].arguments?.apply !== false) &&
+        !noOpMutation;
+      if (structuredMutation || builtInMutation) {
+        // Structured mutation evidence from a delegated/control tool is itself
+        // sufficient to invalidate prior verification, even when the wrapper
+        // tool name is not one of the engine's built-in mutators. Successful
+        // built-in mutators remain covered by the same branch.
+        if (results[i].success || results[i].mutationMayHaveOccurred === true) {
+          sawMutation = true;
+          lastMutationSeq = ++mutVerSeq;
+        }
+      } else if (t === "debug" && MUTATING_DEBUG_ACTIONS[String(toolCalls[i].arguments?.action ?? "")] === true) {
+        sawMutation = true;
+        lastMutationSeq = ++mutVerSeq;
+      } else if (t === "computer" && computerActionMayAffectState(toolCalls[i].arguments)) {
+        // Failed UI actions may have partially changed external state.
+        sawMutation = true;
+        lastMutationSeq = ++mutVerSeq;
+      } else if (t === "monitor" && String(toolCalls[i].arguments?.action ?? "").trim().toLowerCase() === "start") {
+        // Starting a background monitor can mutate the workspace asynchronously;
+        // read-only monitor controls (list/tail/await/cancel) do not invalidate verification.
+        sawMutation = true;
+        lastMutationSeq = ++mutVerSeq;
+      } else if (t === "job" && String(toolCalls[i].arguments?.action ?? "").trim().toLowerCase() === "start") {
+        // Starting a background shell may mutate the workspace asynchronously;
+        // read-only job controls (list/tail/await/cancel) do not invalidate verification.
         sawMutation = true;
         lastMutationSeq = ++mutVerSeq;
       } else if (t === "bash") {
-        const cmd = String(toolCalls[i].arguments?.command ?? "");
-        if (isVerificationSignal(cmd, results[i].output)) {
-          sawVerification = results[i].success;
-          lastVerificationSeq = ++mutVerSeq;
-        }
+        // Non-verification shell commands may mutate files even when they exit unsuccessfully.
+        sawMutation = true;
+        lastMutationSeq = ++mutVerSeq;
       }
     }
+    await ev.onEvidence?.({
+      sawMutation,
+      sawVerification,
+      verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
+    });
+    if (aborted) return finish({ done: false, steps: step, doneReason: "Cancelled." });
     // F6 (round 4 architect, Low): judge the step by its NON-TRIVIAL calls — a
     // batch of read(ok)+edit(fail) repeated with varying targets previously
     // never tripped MAX_FAILURES because the trivial read reset the streak.

package/src/agent/goal-tool.ts

@@ -35,7 +35,13 @@ export function createGoalTool(): ToolHandler {
       if (!condition) {
         return { success: false, output: "", error: `goal {action:"set"} requires a non-empty 'condition'.` };
       }
-      await writeGoalState({ condition, setAt: Date.now(), verdicts: [] }, cwd);
+      const previous = await readGoalState(cwd);
+      await writeGoalState({
+        condition,
+        setAt: Date.now(),
+        verdicts: [],
+        ...(previous?.pendingMutationVerification ? { pendingMutationVerification: true } : {}),
+      }, cwd);
       return {
         success: true,
         output: `Goal set: "${condition}". It will be auto-verified against the conversation each time you call done.`,

package/src/agent/goal-verifier.ts

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+
 import { callLlm, type Message } from "./loop";
 
 export interface GoalVerdict {
@@ -90,26 +92,25 @@ export interface TurnEvidence {
   sawMutation: boolean;
   sawVerification: boolean;
   verificationStale: boolean;
+  /** Mutation evidence persisted from an earlier user turn. */
+  pendingMutation?: boolean;
 }
 
 /**
  * Deterministic downgrade gate: an LLM-judged MET verdict is trustworthy only when
- * the turn either made no file changes, or made changes AND a fresh (non-stale)
- * verification signal (test/build/typecheck/lint) was observed. A turn that mutated
- * files with no verification at all, or whose only verification predates the last
- * mutation, cannot self-report MET on the transcript alone — that is exactly the
- * "gate theater" failure mode (an LLM asserting success without re-checked evidence).
- * NOT_MET/IMPOSSIBLE verdicts pass through unchanged: this only ever tightens MET,
- * never loosens a verdict the LLM itself already found lacking.
+ * no workspace mutation is pending, or a fresh verification signal follows the
+ * most relevant mutation. NOT_MET/IMPOSSIBLE pass through unchanged; this only
+ * ever tightens MET, never loosens a verdict the LLM itself already found lacking.
  */
 export function applyEvidenceGate(verdict: GoalVerdict, evidence: TurnEvidence): GoalVerdict {
   if (verdict.verdict !== "MET") return verdict;
-  if (!evidence.sawMutation) return verdict; // nothing changed — the transcript judgment stands
-  if (evidence.sawVerification && !evidence.verificationStale) return verdict; // fresh verification backs the claim
+  const sawMutation = evidence.sawMutation || evidence.pendingMutation === true;
+  if (!sawMutation) return verdict;
+  if (evidence.sawVerification && !evidence.verificationStale) return verdict;
 
   const gap = !evidence.sawVerification
-    ? "the turn modified files but no test/build/typecheck/lint run was observed"
-    : "the turn's only verification run predates its last file modification (stale evidence)";
+    ? "workspace changes are pending but no test/build/typecheck/lint run was observed"
+    : "the only verification run predates the last workspace modification (stale evidence)";
   return {
     verdict: "NOT_MET",
     reason:
@@ -129,8 +130,78 @@ export interface GoalState {
     verdict: "MET" | "NOT_MET" | "IMPOSSIBLE";
     gap?: string;
   }>;
+  /** Backward-compatible persisted evidence that a mutation still needs verification. */
+  pendingMutationVerification?: boolean;
+}
+
+export class GoalStateCorruptError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "GoalStateCorruptError";
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isGoalVerdict(value: unknown): value is GoalState["verdicts"][number] {
+  return (
+    isRecord(value) &&
+    typeof value.at === "number" &&
+    Number.isFinite(value.at) &&
+    (value.verdict === "MET" || value.verdict === "NOT_MET" || value.verdict === "IMPOSSIBLE") &&
+    (value.gap === undefined || typeof value.gap === "string")
+  );
 }
 
+
+function parseGoalState(data: string, filePath: string): GoalState {
+  let value: unknown;
+  try {
+    value = JSON.parse(data);
+  } catch {
+    throw new GoalStateCorruptError(`Persisted goal state is malformed JSON: ${filePath}`);
+  }
+
+  if (
+    !isRecord(value) ||
+    typeof value.condition !== "string" ||
+    value.condition.trim().length === 0 ||
+    typeof value.setAt !== "number" ||
+    !Number.isFinite(value.setAt) ||
+    !Array.isArray(value.verdicts) ||
+    (value.pendingMutationVerification !== undefined && typeof value.pendingMutationVerification !== "boolean")
+  ) {
+    throw new GoalStateCorruptError(`Persisted goal state has invalid required fields: ${filePath}`);
+  }
+
+  const verdicts: GoalState["verdicts"] = [];
+  for (const verdict of value.verdicts) {
+    if (!isGoalVerdict(verdict)) {
+      throw new GoalStateCorruptError(`Persisted goal state has an invalid verdict entry: ${filePath}`);
+    }
+    verdicts.push(verdict);
+  }
+
+  return {
+    condition: value.condition,
+    setAt: value.setAt,
+    verdicts,
+    ...(value.pendingMutationVerification === undefined
+      ? {}
+      : { pendingMutationVerification: value.pendingMutationVerification }),
+  };
+}
+
+/** Apply this turn's evidence to the persisted pending-mutation flag. */
+export function applyPendingEvidence(state: GoalState, evidence: TurnEvidence): GoalState {
+  const pendingMutationVerification = evidence.sawVerification && !evidence.verificationStale
+    ? false
+    : state.pendingMutationVerification === true || evidence.sawMutation;
+  return { ...state, pendingMutationVerification };
+}
+
+
 import * as path from "node:path";
 import * as fs from "node:fs/promises";
 import { getLocalJeoDir } from "./state";
@@ -141,18 +212,26 @@ export function getGoalPath(cwd: string = process.cwd()): string {
 
 export async function readGoalState(cwd: string = process.cwd()): Promise<GoalState | null> {
   const p = getGoalPath(cwd);
+  let data: string;
   try {
-    const data = await fs.readFile(p, "utf-8");
-    return JSON.parse(data) as GoalState;
-  } catch {
-    return null;
+    data = await fs.readFile(p, "utf-8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
   }
+  return parseGoalState(data, p);
 }
 
 export async function writeGoalState(state: GoalState, cwd: string = process.cwd()): Promise<void> {
   const p = getGoalPath(cwd);
   await fs.mkdir(path.dirname(p), { recursive: true });
-  await fs.writeFile(p, JSON.stringify(state, null, 2), "utf-8");
+  const tempPath = `${p}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(tempPath, JSON.stringify(state, null, 2), { encoding: "utf-8", flag: "wx" });
+    await fs.rename(tempPath, p);
+  } finally {
+    await fs.unlink(tempPath).catch(() => {});
+  }
 }
 
 export async function clearGoalState(cwd: string = process.cwd()): Promise<void> {

package/src/agent/loop-guards.ts

@@ -69,19 +69,20 @@ export const GUARD_LIMITS = Object.freeze({
 });
 
 /**
- * Commands (or their output) that count as a verification signal: a test, build,
- * typecheck, or lint invocation. The done-verification guard treats a turn that mutated
- * files without any such signal as "unverified".
+ * Recognized standalone verification commands. Matching the full command prevents
+ * filenames, prose, and shell output from impersonating verification evidence.
  */
-export const VERIFY_SIGNAL_RE = /\b(test|tests|tsc|typecheck|lint|build|check|spec|pytest|vitest|jest)\b/i;
+export const VERIFY_SIGNAL_RE = /^(?:(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?(?:test|tests|typecheck|lint|build|check|spec|tsc|eslint|vitest|jest)(?::[\w-]+)?|(?:npx|bunx)\s+(?:tsc|eslint|vitest|jest|pytest)|(?:tsc|eslint|vitest|jest|pytest)|(?:python(?:3(?:\.\d+)?)?|uv)\s+(?:-m\s+)?pytest|cargo\s+(?:test|check|build|clippy)|go\s+(?:test|vet|build)|(?:make|just)\s+(?:test|check|lint|build|typecheck))(?:\s+[A-Za-z0-9_./:@+*?,=-]+)*$/i;
+const NONEXECUTING_VERIFY_FLAG_RE = /(?:^|\s)(?:--help|-h|--version|-version|--list(?:-tests|Tests)?|-list|--collect-only|--show-?config|--init|--dry-run|--no-run|--passWithNoTests)(?=$|\s|=)/i;
+const MUTATING_VERIFY_FLAG_RE = /(?:^|\s)(?:--fix|--write|--update|-u|--update[-_]snapshots?|--updateSnapshots?|--snapshot[-_]updates?)(?=$|\s|=)/i;
 
 /**
- * True when a bash command (or the head of its output) proves the work was verified.
- * Output is examined only up to the first 2000 chars — enough to catch a tool runner's
- * banner without rescanning a megabyte of logs.
+ * True only when the command itself is a recognized verifier invocation. Output
+ * is never evidence: arbitrary commands can print words such as "tests passed".
  */
-export function isVerificationSignal(cmd: string, output = ""): boolean {
-  return VERIFY_SIGNAL_RE.test(cmd) || VERIFY_SIGNAL_RE.test(output.slice(0, 2000));
+export function isVerificationSignal(cmd: string): boolean {
+  const command = cmd.trim();
+  return !/[;&|<>`$(){}\n\r]/.test(command) && VERIFY_SIGNAL_RE.test(command) && !NONEXECUTING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_FLAG_RE.test(command);
 }
 
 /**

package/src/agent/lsp-rename-tool.ts

@@ -75,6 +75,7 @@ export function createLspRenameTool(): ToolHandler {
 
     const preview: string[] = [];
     let totalEdits = 0;
+    let mutationMayHaveOccurred = false;
     for (const [fName, spans] of byFile) {
       const rel = path.relative(cwd, fName) || fName;
       let content: string;
@@ -96,7 +97,8 @@ export function createLspRenameTool(): ToolHandler {
           newText = newText.slice(0, span.start) + newName + newText.slice(span.start + span.length);
         }
         const res = await writeTool(rel, newText, cwd);
-        if (!res.success) return err(`${rel}: ${res.error ?? "write failed"}`);
+        if (!res.success) return { ...err(`${rel}: ${res.error ?? "write failed"}`), mutationMayHaveOccurred: res.mutationMayHaveOccurred === true || mutationMayHaveOccurred };
+        mutationMayHaveOccurred = true;
       }
     }
 

package/src/agent/notify/discord-daemon.ts

@@ -598,6 +598,7 @@ export class DiscordDaemon {
       if (!session) { await emit("Session not found or prefix ambiguous. Use /sessions and a unique ID."); return false; }
       const body = command[3]!.trim();
       if (command[1] === "send") return sendPrompt(session, body);
+
       const args = command[1] === "steer" ? /^(\S+)\s+([\s\S]+)$/.exec(body) : /^(\S+)$/.exec(body);
       if (!args) { await emit(HELP); return false; }
       if (!session.controlEnabled) { await emit("Discord remote control is disabled in this session.", session.sessionId); return false; }
@@ -606,7 +607,8 @@ export class DiscordDaemon {
       const delivered = await emit(ok ? "Session acknowledged command." : "Command not acknowledged (unavailable, rejected or timed out).", session.sessionId);
       return ok && delivered;
     }
-    if (text.startsWith("/")) { await emit(HELP); return false; }
+    if (text.startsWith("/") || text.startsWith("!")) { await emit(HELP); return false; }
+
     const reference = object(message.message_reference) ? message.message_reference : undefined;
     const reply = reference && typeof reference.message_id === "string" && (reference.channel_id === undefined || reference.channel_id === message.channel_id)
       ? this.replies.get(reference.message_id) : undefined;

package/src/agent/notify/paths.ts

@@ -7,6 +7,7 @@
 import * as path from "node:path";
 import * as os from "node:os";
 import { jeoEnv } from "../../util/env";
+import { createHash } from "node:crypto";
 
 /** Root directory for all local jeo state, resolved at call time (not import
  *  time) so a `JEO_CONFIG_DIR` override or runtime `HOME` change is honored. */
@@ -46,3 +47,10 @@ export function notifyDaemonLockPath(): string {
 export function notifyDaemonLogPath(): string {
   return path.join(notifyDir(), "daemon.log");
 }
+
+/** Per-bot/per-chat Telegram update cursor. Hashing the tuple keeps chat IDs
+ *  (including negative group IDs) out of path syntax and prevents collisions. */
+export function notifyTelegramUpdateOffsetPath(botId: string, chatId: string): string {
+  const key = createHash("sha256").update(JSON.stringify([botId, chatId])).digest("hex");
+  return path.join(notifyDir(), `telegram-offset-${key}.json`);
+}