jeo-code 0.12.10 → 0.12.12

package/src/agent/subagents.ts

@@ -258,14 +258,16 @@ export function subagentSystemPrompt(role: SubagentRole): string {
 
 /**
  * True when EVERY shell segment of `command` starts with one of `prefixes`
- * (after stripping leading env-assignments and a leading `sudo`). Splitting on
- * `; && || |` means a chained `… && rm -rf` cannot smuggle an un-vetted command
- * past a single allowed head. Command substitution (`$(…)`, backticks) can't be
- * statically vetted, so it is rejected outright. Empty allowlist = unconstrained.
+ * (after stripping leading env-assignments and a leading `sudo`). Only `&&`,
+ * `||`, `;`, and `|` chaining is understood; other shell operators, newlines,
+ * and substitutions are rejected rather than approximated. Empty allowlist =
+ * unconstrained.
  */
 export function bashCommandAllowed(command: string, prefixes: string[]): boolean {
   if (prefixes.length === 0) return true;
-  if (/[`]|\$\(/.test(command)) return false; // un-vettable command substitution
+  if (/[$`]/.test(command)) return false; // un-vettable expansion/substitution
+  const unsupportedSyntax = command.replace(/&&|\|\||[;|]/g, "");
+  if (/[&<>(){}\\\r\n]/.test(unsupportedSyntax)) return false;
   const matches = (seg: string, p: string) =>
     seg === p || seg.startsWith(p + " ") || seg.startsWith(p + "\t");
   for (const raw of command.split(/(?:&&|\|\||[;|])/)) {

package/src/agent/task-tool.ts

@@ -9,7 +9,7 @@
  * repo). Subagents are spawned with `subagentToolset(role)`, which never includes
  * `task` itself, so delegation cannot recurse infinitely.
  */
-import { runAgentLoop, isSafetyFallbackBail, stripSafetyFallbackTag, type ToolHandler } from "./engine";
+import { runAgentLoop, isSafetyFallbackBail, stripSafetyFallbackTag, type AgentLoopResult, type ToolHandler } from "./engine";
 import { toolTarget } from "./step-budget";
 
 import type { ToolResult } from "./tools";
@@ -279,8 +279,11 @@ export interface RunSubagentOptions {
   modelOverride?: string;
   /** Stable detached id (from SubagentRegistry), attached to all emitted TaskSubEvents. */
   detachedId?: string;
+  /** SubagentRegistry to report live activity into (e.g. current tool or step). */
+  registry?: SubagentRegistry;
 }
 
+
 /** `runSubagentOnce`'s result — a superset of `ToolResult` exposing the raw
  *  (unwrapped, unfenced) done reason and mutation-audit counters so a caller with
  *  its OWN pass/fail policy on top (e.g. `jeo team`'s role-gate-verdict parsing and
@@ -288,6 +291,8 @@ export interface RunSubagentOptions {
  *  report text. `task`/`subagent` tool callers only ever need `success`/`output`/
  *  `error`, which stay structurally identical to plain `ToolResult`. */
 export interface SubagentRunResult extends ToolResult {
+  /** True when delegated execution observed a successful or potentially partial mutation. */
+  mutationMayHaveOccurred?: boolean;
   /** Raw subagent done reason, before contract validation or fencing. */
   doneReason: string;
   /** True when the subagent actually called `done` (vs. exhausting its step
@@ -297,7 +302,8 @@ export interface SubagentRunResult extends ToolResult {
   contractOk: boolean;
   /** Required markers missing from the done reason, when `contractOk` is false. */
   missingMarkers?: string[];
-  /** Successful write/edit/mkdir/delete calls observed (mutation audit evidence). */
+  /** Successful workspace mutation calls observed (write/edit/mkdir/delete,
+   *  ast_edit, or lsp_rename). */
   fileMutations: number;
   /** Successful bash calls observed (tracked apart — bash CAN mutate but isn't proof). */
   bashRuns: number;
@@ -329,7 +335,18 @@ export async function runSubagentOnce(
   const { steer, slot, detachedId, projectContext: preloadedContext, signal } = opts;
   // Tag every live event with its fan-out slot or detached ID so a parent monitor can tell
   // task 1 from task 3 or detached tasks apart when several subagents stream concurrently.
-  const emit = (ev: TaskSubEvent) =>
+  const emit = (ev: TaskSubEvent) => {
+    if (detachedId && opts.registry) {
+      if (ev.kind === "tool") {
+        opts.registry.setActivity(detachedId, ev.detail ? `tool: ${ev.detail}` : "running tool");
+      } else if (ev.kind === "thinking") {
+        opts.registry.setActivity(detachedId, "thinking");
+      } else if (ev.kind === "step") {
+        opts.registry.setActivity(detachedId, ev.detail ? `step: ${ev.detail}` : "next step");
+      } else if (ev.kind === "done") {
+        opts.registry.setActivity(detachedId, undefined);
+      }
+    }
     opts.onEvent?.(
       detachedId
         ? { ...ev, detachedId }
@@ -337,6 +354,8 @@ export async function runSubagentOnce(
         ? { ...ev, index: slot.index, total: slot.total }
         : ev
     );
+  };
+
   const initialModel = opts.modelOverride || resolveSubagentModel(role.id, opts.config);
   const maxSteps = resolveSubagentMaxSteps(role.id, opts.config);
   // gjc parity: a role may pin its own reasoning budget; absent = inherit the
@@ -365,6 +384,9 @@ export async function runSubagentOnce(
   let fileMutations = 0;
   let bashRuns = 0;
   let readOnlyEvidenceCalls = 0;
+  // The engine's evidence signal is cumulative across tool batches and includes
+  // failed mutators whose handlers report that state may have changed.
+  let mutationMayHaveOccurred = false;
   // Per-run prompt-cache key: the subagent replays its own growing history each
   // step, so a stable key (even across a model switch below — a stale cache key
   // on a NEW provider is simply unused, never wrong) gets provider cache hits
@@ -454,6 +476,9 @@ export async function runSubagentOnce(
       tools: subagentToolset(role),
       ...(failoverEnabled ? { rateLimitFallbackAvailable, safetyFallbackAvailable } : {}),
       events: {
+        onEvidence: evidence => {
+          if (evidence.sawMutation) mutationMayHaveOccurred = true;
+        },
         onStep: n => { currentStep = n; },
         // Live reasoning preview (native extended-thinking models only — the JSON-protocol
         // "reasoning" field the main turn also extracts from onModelStream is intentionally
@@ -475,7 +500,7 @@ export async function runSubagentOnce(
         },
         onToolResult: (tool, success, output) => {
           if (success) {
-            if (tool === "write" || tool === "edit" || tool === "mkdir" || tool === "delete") fileMutations++;
+            if (tool === "write" || tool === "edit" || tool === "mkdir" || tool === "delete" || tool === "ast_edit" || tool === "lsp_rename") fileMutations++;
             else if (tool === "bash") bashRuns++;
             else if (tool === "read" || tool === "search" || tool === "find" || tool === "ast_grep" || tool === "lsp") readOnlyEvidenceCalls++;
           }
@@ -496,12 +521,36 @@ export async function runSubagentOnce(
     });
   };
 
-  let result = await runOnce();
+  const failureResult = (error: unknown): SubagentRunResult => {
+    const explicitSignal = typeof error === "object" && error !== null && "mutationMayHaveOccurred" in error && error.mutationMayHaveOccurred === true;
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      success: false,
+      output: "",
+      error: message,
+      doneReason: message,
+      done: false,
+      contractOk: false,
+      fileMutations,
+      bashRuns,
+      readOnlyEvidenceCalls,
+      mutationMayHaveOccurred: mutationMayHaveOccurred || explicitSignal || (!role.readOnly ? true : undefined),
+    };
+  };
+  const runSafely = async (): Promise<{ ok: true; result: AgentLoopResult } | { ok: false; error: unknown }> => {
+    try {
+      return { ok: true, result: await runOnce() };
+    } catch (error: unknown) {
+      return { ok: false, error };
+    }
+  };
+  let outcome = await runSafely();
+  if (!outcome.ok) return failureResult(outcome.error);
+  let result = outcome.result;
   // `routing.enabled` off = the model is FIXED: no failover reroute at all (the
   // engine bail predicates above are withheld too, so a 429 rides its normal
   // backoff ladder instead of bailing early with nowhere to go).
-  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {
-    const rateLimited = !result.done && isRateLimitError(new Error(result.doneReason ?? ""));
+  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {    const rateLimited = !result.done && isRateLimitError(new Error(result.doneReason ?? ""));
     const safetyBail = !result.done && !rateLimited && isSafetyFallbackBail(result.doneReason);
     if (!rateLimited && !safetyBail) break;
     const previousModel = activeModel;
@@ -526,7 +575,9 @@ export async function runSubagentOnce(
       emit({ role: role.id, kind: "step", detail: `↳ refused on '${previousModel}' — switching to '${activeModel}' in case of a classifier false positive`, step: currentStep, maxSteps, model: activeModel });
     }
     attemptedModels.add(activeModel);
-    result = await runOnce();
+    outcome = await runSafely();
+    if (!outcome.ok) return failureResult(outcome.error);
+    result = outcome.result;
   }
 
   const reason = stripSafetyFallbackTag(result.doneReason?.trim() || "") || `(subagent reached the ${result.steps}-step limit without signaling done)`;
@@ -543,8 +594,8 @@ export async function runSubagentOnce(
   // "verify independently" instead of the stronger UNVERIFIED.
   const audit = complete && !role.readOnly && fileMutations === 0
     ? bashRuns === 0
-      ? `\n[parent audit] No successful write/edit/bash was observed in this run — treat any "Changed Files:" claims above as UNVERIFIED.`
-      : `\n[parent audit] No successful write/edit was observed (only bash ran); bash may or may not have mutated files — verify any "Changed Files:" claims above independently.`
+      ? `\n[parent audit] No successful workspace mutation or bash call was observed in this run — treat any "Changed Files:" claims above as UNVERIFIED.`
+      : `\n[parent audit] No successful workspace mutation was observed (only bash ran); bash may or may not have mutated files — verify any "Changed Files:" claims above independently.`
     : "";
   return {
     success: complete,
@@ -556,6 +607,7 @@ export async function runSubagentOnce(
     fileMutations,
     bashRuns,
     readOnlyEvidenceCalls,
+    mutationMayHaveOccurred,
   };
 }
 
@@ -585,8 +637,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       modelOverride?: string;
       /** Stable detached id from SubagentRegistry. */
       detachedId?: string;
+      /** SubagentRegistry to report live activity into. */
+      registry?: SubagentRegistry;
     } = {},
-  ): Promise<ToolResult> =>
+  ): Promise<SubagentRunResult> =>
     runSubagentOnce(role, taskText, context, cwd, {
       config: opts.config,
       signal: extra.signal ?? opts.signal,
@@ -597,8 +651,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       excludedCredentialScopes: extra.excludedCredentialScopes,
       modelOverride: extra.modelOverride,
       detachedId: extra.detachedId,
+      registry: extra.registry,
     });
 
+
   return async (args: Record<string, any>, cwd: string): Promise<ToolResult> => {
     const roleArg = typeof args.role === "string" ? args.role.trim() : "";
     const role = roleArg ? getSubagentRole(roleArg, opts.config) : defaultSubagentRole();
@@ -689,7 +745,7 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       // `executor`'s single resolved model), so the first worker to exclude a
       // scope saves every sibling worker the same wasted round.
       const batchExcludedScopes = new Set<string>();
-      const results: ToolResult[] = new Array(items.length);
+      const results: SubagentRunResult[] = new Array(items.length);
       let next = 0;
       // #7: broadcast steering hub — each concurrent worker sees every parent
       // steer message exactly once (safe even for parallel read-only fan-out).
@@ -714,7 +770,11 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       const ok = results.filter(r => r.success).length;
       const head = `[${role.title} fan-out] ${ok}/${items.length} completed (concurrency ${limit}).`;
       const combined = results.map((r, i) => `### Task ${i + 1}/${items.length}\n${r.output}`).join("\n\n");
-      return { success: ok === items.length, output: `${head}\n\n${combined}` };
+      return {
+        success: ok === items.length,
+        output: `${head}\n\n${combined}`,
+        mutationMayHaveOccurred: results.some(r => r.mutationMayHaveOccurred === true),
+      };
     }
 
     // Single-task form.
@@ -728,8 +788,15 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
     // its own registry inbox (registry.steerDrainFor(id)) between its own steps.
     if (args.detached === true && opts.registry) {
       const rec = opts.registry.launch(role.id, taskText, (signal, id) =>
-        runOne(role, taskText, ctx(args.context), cwd, { signal, steer: opts.registry!.steerDrainFor(id), detachedId: id }),
+        runOne(role, taskText, ctx(args.context), cwd, {
+          signal,
+          steer: opts.registry!.steerDrainFor(id),
+          detachedId: id,
+          registry: opts.registry,
+        }),
+        { readOnly: role.readOnly },
       );
+
       // Remote subagent visibility/control over Telegram (gjc daemon parity, see
       // `src/agent/notify/`): best-effort, no-op unless `notifications.enabled`.
       ensureSessionNotifyEndpoint(opts.registry, cwd, opts.sessionEndpoint);
@@ -739,6 +806,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
         output:
           `[detached] launched ${role.title} subagent '${rec.id}'. It runs in the background — ` +
           `keep working, then use the 'subagent' tool ({action:"await"|"list"|"inspect"|"cancel", ids?}) to collect its result.`,
+        // A mutating detached run may change the workspace after this tool returns;
+        // surface that possibility immediately so the parent cannot claim a clean
+        // workspace before collecting and verifying the settled result.
+        mutationMayHaveOccurred: role.readOnly ? undefined : true,
       };
     }
     return runOne(role, taskText, ctx(args.context), cwd, { steer: opts.steer });

package/src/agent/tools.ts

@@ -26,6 +26,8 @@ export interface ToolResult {
   success: boolean;
   output: string;
   error?: string;
+  /** Failed operations set this when an attempted filesystem write may have partially changed state. */
+  mutationMayHaveOccurred?: boolean;
 }
 
 /**
@@ -315,18 +317,20 @@ export async function writeTool(
   content: string,
   cwd: string = process.cwd()
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof filePath !== "string" || filePath.trim() === "") {
       return { success: false, output: "", error: 'write requires a non-empty "filePath".' };
     }
     await assertMutationAllowed(filePath, cwd);
     const absPath = path.resolve(cwd, filePath);
+    mutationMayHaveOccurred = true;
     await fs.mkdir(path.dirname(absPath), { recursive: true });
     await fs.writeFile(absPath, content, "utf-8");
     markRead(absPath); // own change counts as having seen the file
     return { success: true, output: `Successfully wrote ${content.length} characters to ${filePath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 
@@ -363,6 +367,7 @@ export async function editTool(
   editBlock: string,
   cwd: string = process.cwd()
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof filePath !== "string" || filePath.trim() === "") {
       return { success: false, output: "", error: 'edit requires a non-empty "filePath".' };
@@ -582,11 +587,12 @@ export async function editTool(
       };
     }
 
+    mutationMayHaveOccurred = true;
     await fs.writeFile(absPath, content, "utf-8");
     markRead(absPath); // own change counts as having seen the file
     return { success: true, output: `Successfully updated ${filePath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 
@@ -1079,6 +1085,7 @@ export async function mkdirTool(
   dirPath: string,
   cwd: string = process.cwd()
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof dirPath !== "string" || dirPath.trim() === "") {
       return { success: false, output: "", error: 'mkdir requires a non-empty "dirPath".' };
@@ -1089,10 +1096,11 @@ export async function mkdirTool(
     if (existing && !existing.isDirectory()) {
       return { success: false, output: "", error: `Path exists and is not a directory: ${dirPath}` };
     }
+    mutationMayHaveOccurred = true;
     await fs.mkdir(abs, { recursive: true });
     return { success: true, output: `Directory ready: ${dirPath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 
@@ -1108,6 +1116,7 @@ export async function deleteTool(
   cwd: string = process.cwd(),
   recursive: boolean = false
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof targetPath !== "string" || targetPath.trim() === "") {
       return { success: false, output: "", error: 'delete requires a non-empty "path".' };
@@ -1124,11 +1133,12 @@ export async function deleteTool(
     if (st.isDirectory() && !recursive) {
       return { success: false, output: "", error: `${targetPath} is a directory — pass recursive:true to remove it and its contents.` };
     }
+    mutationMayHaveOccurred = true;
     await fs.rm(abs, { recursive, force: false });
     readThisSession.delete(abs); // a future edit against this path must read it again first
     return { success: true, output: `Deleted ${st.isDirectory() ? "directory" : "file"}: ${targetPath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 

package/src/cli.ts

@@ -49,6 +49,7 @@ process.on("unhandledRejection", fatal);
 process.stdout.on("error", fatal);
 process.stderr.on("error", fatal);
 
+
 try {
   const code = await dispatch(process.argv.slice(2), { appName: APP_NAME, version: VERSION });
   if (code !== 0) process.exit(code);

package/src/commands/launch.ts

@@ -62,7 +62,7 @@ import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recen
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, liveProviderCatalogModels, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import { rehydrateLiveModels, writeModelCache } from "../ai/model-cache";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
-import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
+import { GoalStateCorruptError, readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate, applyPendingEvidence, type GoalState } from "../agent/goal-verifier";
 import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, credentialScopeFor, resolveVerifierModel, type PromptTier, type RouteDecision, type RoutingConfig } from "../agent/prompt-router";
 import { RouteHistory } from "../agent/route-history";
 
@@ -114,7 +114,7 @@ import type { ImageAttachment } from "../ai/types";
 import { renderMarkdownTables } from "../tui/components/markdown-table";
  
 import { stripMarkdown } from "../tui/components/markdown-text";
-import { summarizeForgeInvocation } from "../tui/components/forge";
+import { createMessengerActivityEvents } from "../messenger/activity";
 import { formatDuration, formatUsage } from "../tui/components/duration";
 
 import { bashTool } from "../agent/tools";
@@ -122,6 +122,7 @@ import { bashTool } from "../agent/tools";
 import { loadProjectContext, withProjectContext } from "../agent/context-files";
 import { maybeCompact, historyTokens, buildHandoffDocument } from "../agent/compaction";
 import * as path from "node:path";
+import { tmpdir } from "node:os";
 import * as fs from "node:fs";
 import { listThemes, resolveTheme, themeGradient, accentPaint, accentShadowPaint } from "../tui/components/themes";
 import {
@@ -971,6 +972,15 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // Session-scoped registries for DETACHED subagents, background jobs, and monitors (gjc parity).
   // Created ONCE for the whole launch session lifetime (not per-turn) so detached
   // runs persist across turns and remain controllable/inspectable.
+  let pendingMutationVerification = false;
+  try {
+    pendingMutationVerification = (await readGoalState(cwd))?.pendingMutationVerification === true;
+  } catch (error) {
+    if (!(error instanceof GoalStateCorruptError)) throw error;
+    pendingMutationVerification = true;
+    console.error(`${error.message}. Run /goal clear to remove it; fresh verification is still required.`);
+  }
+
   const subagentRegistry = new SubagentRegistry();
   const jobRegistry = new JobRegistry();
   let activeTui: LaunchTui | null = null;
@@ -1024,9 +1034,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // `step N/M` display seed: the explicit --max-steps cap, else the dynamic budget's
   // rolling base — the engine's onBudget event keeps the denominator honest as it grows.
   const initialStepLimit = flags.maxSteps > 0 ? flags.maxSteps : initialDynamicStepLimit();
-  // Plain (non-TTY / --no-tui) progress sink — the cmd-mode equivalent of the live TUI.
-  const streamEvents = flags.literalPrompt
-    ? { onStep: () => { process.stderr.write("JEO_MESSENGER_STEP\n"); } }
+  // Literal workers send progress without exposing tool arguments or output.
+  const streamEvents = (flags.literalPrompt || flags.literalWorker)
+    ? createMessengerActivityEvents(text => process.stderr.write(`JEO_MESSENGER_ACTIVITY ${text}\n`))
     : createStreamEvents(initialStepLimit);
   let queueBusyInput: ((chunk: string) => boolean) | undefined;
   let queueBusyPasteActive: (() => boolean) | undefined;
@@ -1716,10 +1726,61 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         // Todos checklist used to end a finished turn stuck at "✓0 ◐1 ·4 / 5"
         // because nothing ever forced the model to update item statuses).
         let turnTodos: { title: string; status: string }[] = [];
+        const onEvidence = async (
+          evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean },
+        ): Promise<void> => {
+          if (evidence.sawVerification && !evidence.verificationStale) {
+            pendingMutationVerification = false;
+          } else if (evidence.sawMutation) {
+            pendingMutationVerification = true;
+          }
+
+          let goalState: GoalState | null;
+          try {
+            goalState = await readGoalState(cwd);
+          } catch (error) {
+            if (error instanceof GoalStateCorruptError) return;
+            throw error;
+          }
+          if (!goalState) return;
+          const updatedState = applyPendingEvidence(
+            { ...goalState, pendingMutationVerification },
+            evidence,
+          );
+          pendingMutationVerification = updatedState.pendingMutationVerification === true;
+          await writeGoalState(updatedState, cwd);
+        };
+
         const onBeforeDone = async (
           reason: string,
           evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean },
         ): Promise<string | null> => {
+          const runningJobs = jobRegistry.running();
+          if (runningJobs.length > 0) {
+            const jobs = runningJobs.map(record => `${record.id} (${record.command})`).join(", ");
+            return (
+              `Cannot finish while background job(s) are still running: ${jobs}. ` +
+              `Wait for them to exit or cancel them, then call done again.`
+            );
+          }
+          const runningMonitors = monitorRegistry.running();
+          if (runningMonitors.length > 0) {
+            const monitors = runningMonitors.map(record => `${record.id} (${record.command})`).join(", ");
+            return (
+              `Cannot finish while background monitor(s) are still running: ${monitors}. ` +
+              `Wait for them to exit or cancel them, then call done again.`
+            );
+          }
+
+          const inFlightMutators = subagentRegistry.inFlightMutators();
+          if (inFlightMutators.length > 0) {
+            const agents = inFlightMutators.map(record => `${record.id} (${record.role})`).join(", ");
+            return (
+              `Cannot finish while mutating subagent(s) are still in flight: ${agents}. ` +
+              `Wait for them to settle after completion or cancellation, then call done again.`
+            );
+          }
+
           const unfinished = turnTodos.filter(t => t.status !== "done");
           if (turnTodos.length > 0 && unfinished.length > 0) {
             return (
@@ -1728,8 +1789,22 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
               `(drop items that no longer apply), then call done again.`
             );
           }
+          let goalState: GoalState | null;
+          try {
+            goalState = await readGoalState(cwd);
+          } catch (error) {
+            if (error instanceof GoalStateCorruptError) {
+              return `Cannot finish: persisted goal state is corrupt. Run /goal clear, then verify any workspace mutations before calling done again.`;
+            }
+            throw error;
+          }
+          if ((pendingMutationVerification || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
+            return (
+              `Cannot finish: a workspace mutation from this session still lacks a successful, non-stale verification. ` +
+              `Run a relevant test/build/typecheck/lint after the last change, then call done again.`
+            );
+          }
 
-          const goalState = await readGoalState(cwd);
           if (goalState && goalState.condition) {
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
             const llmVerdict = await verifyGoal(goalState.condition, history, resolveVerifierModel(turnConfig));
@@ -1737,7 +1812,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             // judge still needs mutation/verification evidence to back it up —
             // see applyEvidenceGate's own docs (goal-verifier.ts). NOT_MET/
             // IMPOSSIBLE pass through unchanged; this only ever tightens MET.
-            const verdict = applyEvidenceGate(llmVerdict, evidence);
+            const effectiveEvidence = {
+              ...evidence,
+              pendingMutation: goalState.pendingMutationVerification === true,
+            };
+            const verdict = applyEvidenceGate(llmVerdict, effectiveEvidence);
 
             goalState.verdicts.push({
               at: Date.now(),
@@ -1895,7 +1974,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           // with the reroute loop below, which `routingEnabled` also gates.
           ...(routingEnabled ? { rateLimitFallbackAvailable, safetyFallbackAvailable } : {}),
 
-          events: wrapEvents(withStepPersistence({ ...withToolDetailCapture(tui ? tui.events() : streamEvents), onBeforeDone }, persistTurnTail), opik),
+          events: wrapEvents(withStepPersistence({ ...withToolDetailCapture(tui ? tui.events() : streamEvents), onBeforeDone, onEvidence }, persistTurnTail), opik),
+
         });
         const routeFailureReason = (doneReason: unknown): string | null => {
           const message = String(doneReason ?? "");
@@ -2236,6 +2316,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
               console.log("JEO_MESSENGER_ERROR");
               break;
             }
+
+
           }
         } finally { input.close(); }
         return;
@@ -3152,6 +3234,9 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let typedLine = ""; // the user-typed line (restored after readline's history nav)
   let pendingSelection: string | undefined; // command chosen via arrows, applied on Enter
   let pendingImages: ImageAttachment[] = []; // clipboard images attached to the next message (ctrl+v)
+  // Remote image paths are already ingested before prompt injection. Count the
+  // associated text so the general typed-path scanner does not read it again.
+  const remoteAttachmentTextCounts = new Map<string, number>();
   let pasteInFlight = false; // guard concurrent ctrl+v clipboard reads
   let imagePasteInFlight = false;
   let idleDirtyCount: number | undefined; // git dirty count refreshed once per prompt
@@ -4508,13 +4593,31 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       // ingestion mechanism, not a parallel one. Bare paths never contain
       // whitespace here (daemon-generated temp names), so simple whitespace
       // joining is a safe token boundary for the path-token scanner.
-      const withPaths = msg.imagePaths?.length ? `${msg.text} ${msg.imagePaths.join(" ")}`.trim() : msg.text;
-      const attached = await attachImagePaths(withPaths, pendingImages.length + 1);
-      const cleanedText = attached.images.length ? attached.text : msg.text;
+      const remoteImagePaths = msg.imagePaths ?? [];
+      // Never scan remote text for local paths: a Telegram user must not be
+      // able to make the REPL read arbitrary files by mentioning one. Only
+      // daemon-owned temp attachments are eligible for image ingestion.
+      const tempRoot = path.resolve(tmpdir());
+      const validImagePaths = remoteImagePaths.filter((filePath) => {
+        if (!path.isAbsolute(filePath)) return false;
+        const relative = path.relative(tempRoot, path.resolve(filePath));
+        const parts = relative.split(path.sep);
+        return parts.length === 2 && parts[0]!.startsWith("jeo-telegram-") && parts[1] !== "" && parts[1] !== "." && parts[1] !== "..";
+      });
+      if (validImagePaths.length !== remoteImagePaths.length) return false;
+      const attached = validImagePaths.length
+        ? await attachImagePaths(validImagePaths.join(" "), pendingImages.length + 1)
+        : { text: msg.text, images: [] };
+      // Attachment parsing receives paths only; preserve the remote message
+      // text verbatim so an image never replaces the user's prompt.
+      const cleanedText = msg.text;
       // Attachment normalization must not expose a remote slash command that
       // bypasses the local approval prompt or changes local execution policy.
-      if (cleanedText.trimStart().startsWith("/")) return false;
-      if (attached.images.length) pendingImages.push(...attached.images);
+      if (cleanedText.trimStart().startsWith("/") || cleanedText.trimStart().startsWith("!")) return false;
+      if (attached.images.length) {
+        pendingImages.push(...attached.images);
+        remoteAttachmentTextCounts.set(cleanedText, (remoteAttachmentTextCounts.get(cleanedText) ?? 0) + 1);
+      }
 
       if (interactiveTurnActive && currentTurnSteer) {
         // Busy: steer the running turn exactly like a local mid-turn Enter.
@@ -4537,7 +4640,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     };
     sessionNotifyEndpoint.onConfigCommand = (cmd): void => {
       if (cmd.verbosity !== undefined) notifyVerbosity = cmd.verbosity;
-      if (cmd.redact !== undefined) notifyRedact = cmd.redact;
+      if (cmd.redact !== undefined) {
+        notifyRedact = cmd.redact;
+        sessionNotifyEndpoint.setRedact(cmd.redact);
+      }
     };
   }
 
@@ -4660,7 +4766,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       // /login→/provider login, /settings→/config, /subagent(s)→/agents.
       input = normalizeSlashAlias(input);
       pendingSelection = undefined;
-      navMatches = [];
+navMatches = [];
       navIdx = -1;
       if (input === "/discord" || input.startsWith("/discord ")) {
         const parts = input.split(/\s+/);
@@ -4711,11 +4817,17 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         }
         continue;
       }
+
+      const remoteAttachmentCount = remoteAttachmentTextCounts.get(input) ?? 0;
+      if (remoteAttachmentCount > 0) {
+        if (remoteAttachmentCount === 1) remoteAttachmentTextCounts.delete(input);
+        else remoteAttachmentTextCounts.set(input, remoteAttachmentCount - 1);
+      }
+      if (remoteAttachmentCount === 0 && input && !input.startsWith("/") && !input.startsWith("!")) {
       // File attachment: a dragged-and-dropped image file arrives as its path in
       // the typed text. Read any image path(s), attach them, and swap the path for
       // an [image #N] tag (continuing the clipboard-image numbering) — the same
       // scheme Ctrl+V uses. Skipped for slash commands and `!` shell escapes.
-      if (input && !input.startsWith("/") && !input.startsWith("!")) {
         const dropped = await attachImagePaths(input, pendingImages.length + 1);
         if (dropped.images.length > 0) {
           pendingImages.push(...dropped.images);
@@ -4956,7 +5068,14 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       if (input === "/goal" || input.startsWith("/goal ")) {
         const arg = input.substring(5).trim();
         if (!arg) {
-          const current = await readGoalState(cwd);
+          let current: GoalState | null;
+          try {
+            current = await readGoalState(cwd);
+          } catch (error) {
+            if (!(error instanceof GoalStateCorruptError)) throw error;
+            console.error(`${error.message}. Run /goal clear to remove it.`);
+            continue;
+          }
           if (current) {
             console.log(`Current goal: "${current.condition}" (set at ${new Date(current.setAt).toLocaleTimeString()})`);
           } else {
@@ -4970,10 +5089,19 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           console.log("Goal cleared.");
           continue;
         }
+        let previous: GoalState | null;
+        try {
+          previous = await readGoalState(cwd);
+        } catch (error) {
+          if (!(error instanceof GoalStateCorruptError)) throw error;
+          console.error(`${error.message}. Run /goal clear before setting a new goal.`);
+          continue;
+        }
         const state = {
           condition: arg,
           setAt: Date.now(),
           verdicts: [],
+          ...(previous?.pendingMutationVerification ? { pendingMutationVerification: true } : {}),
         };
         await writeGoalState(state, cwd);
         console.log(`Goal set to: "${arg}"`);