jeo-code 0.12.12 → 0.12.15

package/src/commands/messenger.ts

@@ -3,16 +3,63 @@ import { constants } from "node:fs";
 import * as path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { Writable } from "node:stream";
-import { loadMessengerConfig, validateMessengerEnvironment } from "../messenger/config";
+import { loadMessengerConfig, parseMessengerSandbox, validateMessengerEnvironment, validateMessengerStorage } from "../messenger/config";
 import { createDiscordAdapter } from "../messenger/discord";
 import { setupDiscordMessenger } from "../messenger/discord-setup";
 import { messengerArtifactPrompt } from "../messenger/artifacts";
-import { createMessengerGateway, messengerSessionRoute, messengerConversationKey } from "../messenger/gateway";
+import { createMessengerGateway, messengerSessionRoute } from "../messenger/gateway";
 import { createMessengerSessionPool } from "../messenger/session-pool";
 import { createSlackAdapter } from "../messenger/slack";
 import { createTelegramAdapter } from "../messenger/telegram";
 import type { MessengerAdapter, MessengerConfig, MessengerReply } from "../messenger/types";
 import { createSession } from "../agent/session";
+import { selectDiscordModel } from "../messenger/model-selection";
+import type { MessengerGatewayOptions } from "../messenger/gateway";
+import { notifySessionEndpointPath } from "../agent/notify/paths";
+import { parseSessionEndpoint } from "../agent/notify/session-discovery";
+
+async function sendSandboxControl(config: MessengerConfig, id: string, userId: string, text: string, signal: AbortSignal): Promise<string> {
+	const file = await fs.open(notifySessionEndpointPath(id), constants.O_RDONLY | constants.O_NOFOLLOW);
+	let raw: string;
+	try {
+		const stat = await file.stat();
+		if (!stat.isFile() || (process.platform !== "win32" && (stat.mode & 0o077) !== 0)) throw new Error("Sandbox endpoint discovery is not private");
+		raw = await file.readFile("utf8");
+	} finally { await file.close(); }
+	const endpoint = parseSessionEndpoint(raw);
+	if (!endpoint || endpoint.cwd !== config.cwd) throw new Error("Sandbox endpoint session mismatch");
+	if (signal.aborted) throw new Error("Sandbox control aborted");
+	const { promise, resolve, reject } = Promise.withResolvers<string>();
+		const reqId = crypto.randomUUID();
+		const ws = new WebSocket(`${endpoint.url}/?token=${encodeURIComponent(endpoint.token)}`);
+		let sent = false;
+		let settled = false;
+		const finish = (error?: Error, output?: string) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			signal.removeEventListener("abort", abort);
+			ws.close();
+			if (error) reject(error); else resolve(output ?? "Sandbox control returned no output");
+		};
+		const abort = () => finish(new Error("Sandbox control aborted"));
+		const timer = setTimeout(() => finish(new Error("Sandbox control timed out; outcome is unconfirmed")), 30_000);
+		signal.addEventListener("abort", abort, { once: true });
+		ws.addEventListener("error", () => finish(new Error("Sandbox control endpoint unavailable")));
+		ws.addEventListener("close", () => finish(new Error("Sandbox control endpoint closed")));
+		ws.addEventListener("message", event => {
+			try {
+				const frame = JSON.parse(String(event.data));
+				if (frame.type === "discord_control" && frame.sessionId === id && !sent) {
+					if (frame.enabled !== true || !Number.isSafeInteger(frame.generation)) return finish(new Error("Discord sandbox control is disabled"));
+					sent = true;
+					ws.send(JSON.stringify({ type: "sandbox_control", sessionId: id, reqId, text, actor: { origin: "discord", sessionKey: id, userId }, controlGeneration: frame.generation }));
+				} else if (frame.type === "ack" && frame.reqId === reqId && typeof frame.output === "string") finish(undefined, frame.output);
+			} catch { finish(new Error("Invalid sandbox control response")); }
+		});
+		if (signal.aborted) abort();
+	return promise;
+}
 
 type Flags = { config?: string; channel: string[]; user: string[]; tools?: string; artifacts: boolean; service: boolean; noDm: boolean };
 
@@ -40,15 +87,20 @@ function parse(args: string[]): { action: "setup" | "check" | "run"; flags: Flag
 function terminalIO() {
 	let muted = false;
 	const output = new Writable({ write(chunk, _encoding, callback) { if (!muted) process.stdout.write(chunk); callback(); } });
-	const rl = createInterface({ input: process.stdin, output, terminal: Boolean(process.stdin.isTTY && process.stdout.isTTY) });
+	const rl = createInterface({ input: process.stdin, output, terminal: Boolean(process.stdin.isTTY && process.stdout.isTTY), historySize: 0 });
+	const controller = new AbortController();
+	const interrupted = new AbortController();
+	rl.on("SIGINT", () => { interrupted.abort(); rl.close(); });
+	rl.on("close", () => controller.abort());
 	const ask = async (question: string, secret = false) => {
 		process.stdout.write(question);
 		muted = secret;
-		try { return (await rl.question("")).trim(); }
+		try { return (await rl.question("", { signal: controller.signal })).trim(); }
 		finally { muted = false; if (secret) process.stdout.write("\n"); }
 	};
 	return {
 		interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+		signal: interrupted.signal,
 		say: (line: string) => process.stdout.write(`${line}\n`),
 		ask: (question: string) => ask(question),
 		askSecret: (question: string) => ask(question, true),
@@ -57,53 +109,39 @@ function terminalIO() {
 }
 
 function routeUuid(config: MessengerConfig, message: Parameters<MessengerReply>[0]): string {
-	if (config.independentSessions) {
-		const hex = new Bun.CryptoHasher("sha256").update(JSON.stringify([config.cwd, messengerConversationKey(message), message.messageId])).digest("hex");
-		return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
-	}
 	const hex = messengerSessionRoute(config.cwd, message);
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 
 /** Run each conversation in its own reusable agent process. */
-export function createMessengerCliReply(config: MessengerConfig, spawn: typeof Bun.spawn = Bun.spawn): MessengerReply & { close(): Promise<void> } {
-	const pool = createMessengerSessionPool(spawn);
+export function createMessengerCliReply(config: MessengerConfig, spawn: typeof Bun.spawn = Bun.spawn, selectModel: typeof selectDiscordModel = selectDiscordModel): MessengerReply & { close(): Promise<void>; sandboxControl: NonNullable<MessengerGatewayOptions["sandboxControl"]> } {
+	const sandbox = config.sandbox !== undefined || config.platforms.discord ? parseMessengerSandbox(config.sandbox) : undefined;
+	// Launch may inherit a global sandbox even when this platform has no local override.
+	const pool = createMessengerSessionPool(spawn, undefined, undefined, undefined, { requireSandboxCleanup: true });
 	const reply: MessengerReply = async (message, signal, onActivity) => {
 		if (signal.aborted) throw new Error("Messenger request aborted");
+		await validateMessengerStorage(config);
 		const id = routeUuid(config, message);
 		await fs.mkdir(config.sessionDir, { recursive: true, mode: 0o700 });
+		if (signal.aborted) throw new Error("Messenger request aborted");
 		const target = path.join(config.sessionDir, `${id}.jsonl`);
-		const legacy = path.join(config.cwd, ".jeo", "sessions", `${id}.jsonl`);
 		try {
 			await fs.access(target);
+			if (signal.aborted) throw new Error("Messenger request aborted");
 		} catch (error) {
 			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-			let old;
-			try { old = await fs.open(legacy, constants.O_RDONLY | constants.O_NOFOLLOW); }
-			catch (openError) { if ((openError as NodeJS.ErrnoException).code !== "ENOENT") throw openError; }
-			try {
-				if (old) {
-					if (!(await old.stat()).isFile()) throw new Error("Invalid legacy messenger session");
-					const contents = await old.readFile();
-					const temporary = `${target}.${crypto.randomUUID()}.tmp`;
-					try {
-						await fs.writeFile(temporary, contents, { flag: "wx", mode: 0o600 });
-						await fs.link(temporary, target);
-					} finally { await fs.unlink(temporary).catch(() => {}); }
-				} else {
-					await createSession(config.cwd, id, undefined, config.sessionDir, true);
-				}
-			} catch (createError) {
-				if ((createError as NodeJS.ErrnoException).code !== "EEXIST") throw createError;
-			} finally { await old?.close(); }
+			try { await createSession(config.cwd, id, undefined, config.sessionDir, true); }
+			catch (createError) { if ((createError as NodeJS.ErrnoException).code !== "EEXIST") throw createError; }
 		}
 		const artifactPrompt = await messengerArtifactPrompt(config.platforms[message.platform]?.artifactDir, message, signal);
+		if (signal.aborted) throw new Error("Messenger request aborted");
 		const executable = process.execPath;
 		const sourceEntry = process.argv[1]?.endsWith(".ts") ? process.argv[1] : undefined;
 		const tools = [...new Set(config.toolNames.map(name => name === "grep" ? "search" : name === "glob" ? "find" : name))];
 		const toolFlags = tools.length ? ["--tools", tools.join(",")] : ["--no-tools"];
 		const platformConfig = config.platforms[message.platform];
-		const modelFlags = platformConfig?.model ? ["--model", platformConfig.model] : [];
+		const model = message.platform === "discord" ? await selectModel(platformConfig?.model, { signal }) : platformConfig?.model;
+		const modelFlags = model ? ["--model", model] : [];
 		const command = [executable, ...(sourceEntry ? ["--no-env-file", sourceEntry] : []), "launch", "--print", "--no-tui", "--no-skills", "--literal-worker", ...toolFlags, ...modelFlags, "--resume", id, "--", "worker"];
 		const secretNames = new Set<string>();
 		for (const platform of Object.values(config.platforms)) {
@@ -118,34 +156,62 @@ export function createMessengerCliReply(config: MessengerConfig, spawn: typeof B
 		const env = Object.fromEntries(Object.entries(process.env).filter(([name, value]) => value !== undefined && !secretNames.has(name))) as Record<string, string>;
 		for (const name of secretNames) env[name] = "";
 		env.JEO_SESSION_DIR = config.sessionDir;
+		delete env.JEO_MESSENGER_SANDBOX;
+		delete env.JEO_MESSENGER_ALLOWED_USER_IDS;
+		delete env.JEO_MESSENGER_SESSION_KEY;
+		if (sandbox) {
+			env.JEO_MESSENGER_SANDBOX = JSON.stringify(sandbox);
+			env.JEO_MESSENGER_ALLOWED_USER_IDS = JSON.stringify(platformConfig?.allowedUserIds ?? []);
+			env.JEO_MESSENGER_SESSION_KEY = id;
+		}
 		// The explicit tool allowlist is the opt-in for this worker only.
 		env.JEO_MESSENGER_COMPUTER_ENABLED = tools.includes("computer") ? "1" : "0";
 		// Never inherit another platform's fallback policy from the gateway environment.
 		delete env.JEO_MESSENGER_USAGE_FALLBACK_MODEL;
-		if (platformConfig?.usageFallbackModel) env.JEO_MESSENGER_USAGE_FALLBACK_MODEL = platformConfig.usageFallbackModel;
+		if (platformConfig?.usageFallbackModel) {
+			if (message.platform !== "discord") env.JEO_MESSENGER_USAGE_FALLBACK_MODEL = platformConfig.usageFallbackModel;
+			else {
+				try { env.JEO_MESSENGER_USAGE_FALLBACK_MODEL = await selectModel(platformConfig.usageFallbackModel, { signal }); }
+				catch {
+					if (signal.aborted) throw new Error("Messenger request aborted");
+					console.warn("Discord usage fallback model could not be verified; fallback disabled for this request.");
+				}
+			}
+		}
 		delete env.JEO_MESSENGER_FIXED_MODEL;
-		if (platformConfig?.model) env.JEO_MESSENGER_FIXED_MODEL = "1";
-		return pool.turn(id, command, config.cwd, env, [message.text, artifactPrompt].filter(Boolean).join("\n\n"), signal, onActivity);
+		if (model) env.JEO_MESSENGER_FIXED_MODEL = "1";
+		const policyKey = message.platform === "discord" ? JSON.stringify([model, env.JEO_MESSENGER_USAGE_FALLBACK_MODEL]) : undefined;
+		return pool.turn(id, command, config.cwd, env, [message.text, artifactPrompt].filter(Boolean).join("\n\n"), signal, onActivity, policyKey);
+	};
+	const sandboxControl: NonNullable<MessengerGatewayOptions["sandboxControl"]> = async (message, signal) => {
+		if (!/^\/sandbox(?:\s|$)/.test(message.text)) return { handled: false, output: "" };
+		if (message.platform !== "discord" || !config.platforms.discord?.allowedUserIds.includes(message.senderId)) return { handled: true, output: "UNAUTHORIZED: Discord sandbox control required" };
+		try { return { handled: true, output: await sendSandboxControl(config, routeUuid(config, message), message.senderId, message.text, signal) }; }
+		catch (error) { return { handled: true, output: error instanceof Error ? error.message : "Sandbox control failed" }; }
 	};
-	return Object.assign(reply, { close: pool.close });
+	return Object.assign(reply, { close: pool.close, sandboxControl });
 }
 
 export async function runMessengerCommand(args: string[]): Promise<void> {
 	const { action, flags } = parse([...args]);
 	if (action === "setup") {
 		const io = terminalIO();
+		const controller = new AbortController();
+		const stop = () => { controller.abort(); io.close(); };
+		process.once("SIGINT", stop);
+		process.once("SIGTERM", stop);
 		try {
-			const result = await setupDiscordMessenger({ configPath: path.resolve(flags.config!), channelIds: flags.channel.length ? flags.channel : undefined, userIds: flags.user.length ? flags.user : undefined, toolNames: flags.tools?.split(",").filter(Boolean), artifacts: flags.artifacts, service: flags.service, dmTest: !flags.noDm }, io);
+			const result = await setupDiscordMessenger({ configPath: path.resolve(flags.config!), channelIds: flags.channel.length ? flags.channel : undefined, userIds: flags.user.length ? flags.user : undefined, toolNames: flags.tools?.split(",").filter(Boolean), artifacts: flags.artifacts, service: flags.service, dmTest: !flags.noDm }, io, { signal: AbortSignal.any([controller.signal, io.signal]) });
 			process.stdout.write(`Discord messenger ready: ${result.configPath}\nStart: ${result.runScript}\n`);
-		} finally { io.close(); }
+		} finally { process.off("SIGINT", stop); process.off("SIGTERM", stop); io.close(); }
 		return;
 	}
 	let config: MessengerConfig;
 	try { config = await loadMessengerConfig(flags.config!); validateMessengerEnvironment(config); }
-	catch { throw new Error("Messenger configuration or required environment is invalid"); }
+	catch (error) { throw new Error(error instanceof Error ? error.message : "Messenger configuration or required environment is invalid"); }
 	const platforms = Object.keys(config.platforms);
 	if (action === "check") { process.stdout.write(`Messenger configuration valid: ${platforms.join(", ")}; ${config.toolNames.length} tools enabled. No network checks performed.\n`); return; }
-	if (config.toolNames.length) process.stderr.write("Warning: messenger tools grant authorized remote users local machine authority; this is not a sandbox.\n");
+	if (config.sandbox) process.stderr.write("Messenger tools execute in session-specific containers with approved workspace mounts and no network. Sandbox failures do not fall back to host execution.\n");
 	const adapters: MessengerAdapter[] = [];
 	if (config.platforms.discord) adapters.push(createDiscordAdapter(config.platforms.discord));
 	if (config.platforms.telegram) adapters.push(createTelegramAdapter(config.platforms.telegram));
@@ -154,6 +220,6 @@ export async function runMessengerCommand(args: string[]): Promise<void> {
 	const stop = () => controller.abort();
 	process.once("SIGINT", stop); process.once("SIGTERM", stop);
 	const reply = createMessengerCliReply(config);
-	try { process.stdout.write(`Starting messenger: ${platforms.join(", ")}. Press Ctrl+C to stop.\n`); await createMessengerGateway(config, adapters, reply, { concurrency: 4 }).run(controller.signal); }
+	try { process.stdout.write(`Starting messenger: ${platforms.join(", ")}. Press Ctrl+C to stop.\n`); await createMessengerGateway(config, adapters, reply, { concurrency: 4, sandboxControl: reply.sandboxControl }).run(controller.signal); }
 	finally { controller.abort(); await reply.close(); process.off("SIGINT", stop); process.off("SIGTERM", stop); }
 }

package/src/commands/notify.ts

@@ -175,7 +175,7 @@ async function runSetup(flags: Flags, opts: NotifyOptions): Promise<void> {
     });
     console.log(`Telegram bot verified; chatId=${chatId}. Notifications enabled. Setup did not send a message.`);
   }
-  console.log("Run 'jeo daemon start' (or reload if already running) to apply. Use 'jeo notify health --provider " + flags.provider + "' for read-only API checks; 'jeo notify test --provider " + flags.provider + "' explicitly sends a test message.");
+  console.log("Setup only saves and verifies configuration; it does not start the notification daemon. Run 'jeo daemon start' (or reload if already running) to apply. Use 'jeo notify health --provider " + flags.provider + "' for read-only API checks; 'jeo notify test --provider " + flags.provider + "' explicitly sends a test message.");
 }
 
 async function runStatus(provider: Provider): Promise<void> {
@@ -188,7 +188,7 @@ async function runStatus(provider: Provider): Promise<void> {
   if (provider === "slack") console.log(`appToken=${n?.slack?.appToken ? "(set)" : "(not set)"}`);
   console.log(provider === "telegram" ? `chatId=${n?.telegram?.chatId ?? "(not set)"}` : `channelId=${n?.[provider]?.channelId ?? "(not set)"}`);
   console.log(`allowedUserIds=${channel?.allowedUserIds?.join(",") ?? (provider === "telegram" ? "private chat owner only" : "(not set; inbound disabled)")}`);
-  console.log(`daemon=${status.pairing ? "pairing owns polling (daemon not running)" : status.running ? `process ${status.ready ? "initialized" : "initializing"} (pid ${status.pid}; transport connectivity not checked)` : status.stale ? "stale" : "stopped"}`);
+  console.log(`daemon=${status.pairing ? "pairing owns polling (daemon not running)" : status.running ? `process ${status.ready ? "initialized" : "initializing"} (pid ${status.pid}; transport connectivity not checked)` : status.stale ? "stale" : status.configured ? "stopped (configuration is saved; run 'jeo daemon start')" : "stopped (not configured)"}`);
   console.log("Channel health not checked; use 'jeo notify health --provider " + provider + "'.");
 }
 

package/src/commands/team.ts

@@ -1,10 +1,10 @@
-import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { createHash } from "node:crypto";
 import chalk from "chalk";
 import { PlanSchema, normalizePlanShape, parseYaml } from "../agent/plan";
 import {
   readWorkflowState,
+  readWorkflowFile,
   readWorkflowStateStrict,
   writeWorkflowState,
   acquireWorkflowRunLock,
@@ -25,6 +25,7 @@ import {
 } from "../agent/subagents";
 import { loadProjectContext } from "../agent/context-files";
 import { categoryBadge } from "../tui/components/category-index";
+import { currentSandboxExecution } from "../agent/hooks";
 
 export type RalphStreamKind = "step" | "complete" | "error" | "warn";
 
@@ -220,7 +221,7 @@ export async function runTeamEngine(opts: TeamEngineOptions = {}): Promise<TeamE
 
   let planContent = "";
   try {
-    planContent = await fs.readFile(planPath, "utf-8");
+    planContent = await readWorkflowFile(planPath, cwd);
   } catch (err: any) {
     log(`[ERROR] Failed to read plan file: ${err.message}`);
     return { ok: false, reason: err.message };
@@ -332,7 +333,7 @@ export async function runTeamEngine(opts: TeamEngineOptions = {}): Promise<TeamE
     // with `git status --porcelain` and report the CONCRETE uncommitted count so
     // the user knows whether real partial work is present before re-running on it.
     if (teamState.current_phase === "failed" && teamState.failed_task) {
-      const dirty = gitDirtyCount(cwd);
+      const dirty = await workflowDirtyCount(cwd);
       const treeNote = dirty === undefined
         ? `The working tree could not be inspected (not a git repo or git unavailable) — review it manually before trusting this re-run.`
         : dirty > 0
@@ -597,11 +598,40 @@ interface ParallelWorktree {
   branch: string;
 }
 
-function runGitSync(cwd: string, args: string[]): { ok: boolean; stdout: string; stderr: string } {
+async function runGit(cwd: string, args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
+  const sandbox = currentSandboxExecution();
+  if (sandbox) {
+    const result = await sandbox.supervisor.exec(["git", ...args], { cwd, signal: sandbox.signal });
+    return { ok: result.success && result.exitCode === 0, stdout: result.stdout ?? result.output, stderr: result.stderr ?? result.error ?? "" };
+  }
   const res = Bun.spawnSync(["git", ...args], { cwd, stdout: "pipe", stderr: "pipe" });
   return { ok: res.exitCode === 0, stdout: res.stdout.toString(), stderr: res.stderr.toString() };
 }
 
+async function workflowDirtyCount(cwd: string): Promise<number | undefined> {
+  if (!currentSandboxExecution()) return gitDirtyCount(cwd);
+  const result = await runGit(cwd, ["status", "--porcelain"]);
+  if (!result.ok) throw new Error(result.stderr || "Sandbox git status failed");
+  return result.stdout.split("\n").filter(line => line.trim().length > 0).length;
+}
+
+async function workflowWorktree(cwd: string, worktreePath: string): Promise<string> {
+  const sandbox = currentSandboxExecution();
+  if (!sandbox) return resolveWorktree(cwd, worktreePath);
+  // Only cwd is translated by exec; keep git paths relative to that guest cwd.
+  const relativePath = path.relative(cwd, worktreePath).split(path.sep).join("/");
+  const exists = await sandbox.supervisor.exec(["test", "-d", relativePath], { cwd, signal: sandbox.signal });
+  if (exists.success && exists.exitCode === 0) return worktreePath;
+  if (exists.exitCode !== 1) throw new Error(exists.error || exists.stderr || "Sandbox worktree inspection failed");
+  const branch = path.basename(worktreePath).replace(/[^a-zA-Z0-9_-]/g, "-") || "jeo-wt";
+  const created = await runGit(cwd, ["worktree", "add", "-b", branch, "--", relativePath]);
+  if (!created.ok) {
+    const attached = await runGit(cwd, ["worktree", "add", "--", relativePath]);
+    if (!attached.ok) throw new Error(attached.stderr || created.stderr || "Sandbox worktree creation failed");
+  }
+  return worktreePath;
+}
+
 /**
  * Execute a CONTIGUOUS run of `parallel_group`-marked plan steps concurrently,
  * each in its own git worktree via `resolveWorktree` + the SAME
@@ -637,8 +667,9 @@ async function runParallelGroup(
 
   for (const step of group) {
     const worktreePath = path.join(cwd, ".jeo", "team-worktrees", `${slug}-${step.index}`);
-    const resolvedPath = resolveWorktree(cwd, worktreePath);
-    const branchRes = runGitSync(resolvedPath, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const resolvedPath = await workflowWorktree(cwd, worktreePath);
+    const branchRes = await runGit(resolvedPath, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    if (!branchRes.ok) throw new Error(branchRes.stderr || "Failed to resolve worktree branch");
     const branch = branchRes.stdout.trim();
     worktreeByIndex.set(step.index, { path: resolvedPath, branch });
 
@@ -702,13 +733,13 @@ async function runParallelGroup(
     }
     // An empty diff (read-only role, or a no-op) needs no commit — skip it for
     // the merge step below without treating it as an error.
-    if (gitDirtyCount(wt.path)) {
-      const add = runGitSync(wt.path, ["add", "-A"]);
+    if (await workflowDirtyCount(wt.path)) {
+      const add = await runGit(wt.path, ["add", "-A"]);
       if (!add.ok) {
         log(`${categoryBadge("error")} Failed to stage changes in worktree ${wt.path} for step "${step.name}": ${add.stderr.trim()}`);
         return { ok: false, failedTaskName: step.name, ...(registryMutation ? { mutationMayHaveOccurred: true } : {}) };
       }
-      const commit = runGitSync(wt.path, ["commit", "-m", step.name]);
+      const commit = await runGit(wt.path, ["commit", "-m", step.name]);
       if (!commit.ok) {
         log(`${categoryBadge("error")} Failed to commit changes in worktree ${wt.path} for step "${step.name}": ${commit.stderr.trim()}`);
         return { ok: false, failedTaskName: step.name, ...(registryMutation ? { mutationMayHaveOccurred: true } : {}) };
@@ -721,9 +752,9 @@ async function runParallelGroup(
   // rest of the group's merges.
   for (const step of group) {
     const wt = worktreeByIndex.get(step.index)!;
-    const merge = runGitSync(cwd, ["merge", "--no-ff", wt.branch, "-m", `merge: ${step.name}`]);
+    const merge = await runGit(cwd, ["merge", "--no-ff", wt.branch, "-m", `merge: ${step.name}`]);
     if (!merge.ok) {
-      runGitSync(cwd, ["merge", "--abort"]);
+      await runGit(cwd, ["merge", "--abort"]);
       log(
         `${categoryBadge("error")} Merge conflict merging step "${step.name}"'s branch "${wt.branch}" into the current branch — ` +
         `the merge was aborted automatically (no changes were auto-resolved). Resolve manually: ` +
@@ -738,7 +769,8 @@ async function runParallelGroup(
   // e.g. stray untracked files, is a warning, never a hard failure of the run).
   for (const step of group) {
     const wt = worktreeByIndex.get(step.index)!;
-    const removal = runGitSync(cwd, ["worktree", "remove", wt.path]);
+    const worktreePath = currentSandboxExecution() ? path.relative(cwd, wt.path).split(path.sep).join("/") : wt.path;
+    const removal = await runGit(cwd, ["worktree", "remove", worktreePath]);
     if (!removal.ok) {
       log(`[WARN] Could not remove worktree ${wt.path} for step "${step.name}": ${removal.stderr.trim()}`);
     }

package/src/commands/ultragoal.ts

@@ -1,7 +1,6 @@
-import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { readWorkflowState, writeWorkflowState, getLocalJeoDir, type WorkflowState } from "../agent/state";
-import { bashTool } from "../agent/tools";
+import { readWorkflowState, writeWorkflowState, readWorkflowFile, writeWorkflowFile, getLocalJeoDir, type WorkflowState } from "../agent/state";
+import { DEFAULT_TOOLS } from "../agent/engine";
 import { parseSeedAcceptanceCriteria, parseCriterion } from "../agent/seed";
 
 export interface UltragoalEngineOptions {
@@ -62,7 +61,7 @@ export async function runUltragoalEngine(opts: UltragoalEngineOptions = {}): Pro
 
   let seedContent = "";
   try {
-    seedContent = await fs.readFile(seedPath, "utf-8");
+    seedContent = await readWorkflowFile(seedPath, cwd);
   } catch (err: any) {
     log(`[ERROR] Failed to read seed file: ${err.message}`);
     return { ok: false, reason: err.message };
@@ -94,7 +93,7 @@ export async function runUltragoalEngine(opts: UltragoalEngineOptions = {}): Pro
   if (opts.onProgress) {
     opts.onProgress({ skill: "ultragoal", phase: "verifying", detail: "Running verification suite" });
   }
-  const suite = await bashTool("bun test", cwd);
+  const suite = await DEFAULT_TOOLS.bash!({ command: "bun test" }, cwd);
   log(`  └─ Suite: ${suite.success ? "GREEN" : "FAILED"}`);
 
   if (opts.signal?.aborted) {
@@ -111,7 +110,7 @@ export async function runUltragoalEngine(opts: UltragoalEngineOptions = {}): Pro
         opts.onProgress({ skill: "ultragoal", phase: "verifying", detail: `Verifying: ${c.text}` });
       }
       log(`[CHECK] ${c.text}\n  └─ $ ${c.verify}`);
-      const check = await bashTool(c.verify, cwd);
+      const check = await DEFAULT_TOOLS.bash!({ command: c.verify }, cwd);
       log(`     ${check.success ? "PASS" : "FAIL"}`);
       results.push(
         check.success
@@ -131,7 +130,6 @@ export async function runUltragoalEngine(opts: UltragoalEngineOptions = {}): Pro
 
   // Write verification report
   const reportDir = path.join(getLocalJeoDir(cwd), "state");
-  await fs.mkdir(reportDir, { recursive: true });
   const reportPath = path.join(reportDir, "ultragoal-report.md");
 
   const totalCount = results.length;
@@ -168,15 +166,7 @@ export async function runUltragoalEngine(opts: UltragoalEngineOptions = {}): Pro
     results.map(r => `| ${r.criterion} | ${r.status === "passed" ? "✅ PASSED" : r.status === "failed" ? "❌ FAILED" : "⚠️ UNVERIFIED"} | ${r.note} |`).join("\n") +
     `\n`;
 
-  // Atomic temp+rename (zeroclaw): a torn report must not disagree with the state JSON.
-  const tmpReport = `${reportPath}.${Math.random().toString(36).slice(2)}.tmp`;
-  try {
-    await fs.writeFile(tmpReport, reportContent, "utf-8");
-    await fs.rename(tmpReport, reportPath);
-  } catch (err) {
-    await fs.unlink(tmpReport).catch(() => {});
-    throw err;
-  }
+  await writeWorkflowFile(reportPath, reportContent, cwd);
 
   // Persist a machine-readable terminal phase so the chain is queryable end-to-end.
   const ultragoalState: WorkflowState = {

package/src/messenger/activity.ts

@@ -1,7 +1,8 @@
 import type { AgentLoopEvents, ToolInvocation } from "../agent/engine";
 import type { MessengerActivityReporter } from "./types";
 
-/** Derive bounded progress without exposing tool arguments, results, or provider errors. */
+
+/** Report only fixed status text and validated tool names, never model-authored content. */
 export function createMessengerActivityEvents(report: MessengerActivityReporter): AgentLoopEvents {
 	let step = 0;
 	return {

package/src/messenger/config.ts

@@ -1,6 +1,9 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { MessengerConfig, MessengerPlatform, MessengerPlatformConfig } from "./types";
+import { canonicalSandboxPath, sandboxPathContains, validateSandboxConfig } from "../agent/sandbox/policy";
+import type { SandboxConfig } from "../agent/sandbox/types";
+import { notifyDir } from "../agent/notify/paths";
 
 const PLATFORMS: MessengerPlatform[] = ["discord", "telegram", "slack"];
 const TOOLS: Record<string, true> = {
@@ -13,6 +16,7 @@ const TOOLS: Record<string, true> = {
 	edit: true,
 	write: true,
 	computer: true,
+	sandbox_request: true,
 };
 
 function object(value: unknown, label: string): Record<string, unknown> {
@@ -61,11 +65,25 @@ export function resolveMessengerToken(
 	return undefined;
 }
 
-export const DEFAULT_MESSENGER_TOOLS = ["read", "find", "search", "write", "edit", "bash", "computer"];
+export const DEFAULT_MESSENGER_TOOLS = ["read", "find", "search", "write", "edit", "bash", "computer", "sandbox_request"];
+
+export function parseMessengerSandbox(value: unknown): SandboxConfig {
+	const input = object(value, "sandbox");
+	keys(input, ["image", "limits"], "sandbox");
+	const limits = object(input.limits, "sandbox.limits");
+	keys(limits, ["memoryBytes", "pids", "cpus"], "sandbox.limits");
+	const config: SandboxConfig = {
+		image: string(input.image, "sandbox.image"),
+		limits: { memoryBytes: limits.memoryBytes as number, pids: limits.pids as number, cpus: limits.cpus as number },
+	};
+	validateSandboxConfig(config);
+	return config;
+}
 
 export function parseMessengerConfig(value: unknown, baseDir: string): MessengerConfig {
 	const input = object(value, "Messenger config");
-	keys(input, ["cwd", "sessionDir", "toolNames", "platforms", "independentSessions"], "Messenger config");
+	if (Object.hasOwn(input, "independentSessions")) throw new Error("independentSessions is obsolete; run messenger setup to migrate to persistent conversation sessions");
+	keys(input, ["cwd", "sessionDir", "sandbox", "toolNames", "platforms"], "Messenger config");
 	const platformsInput = object(input.platforms, "platforms");
 	keys(platformsInput, PLATFORMS, "platforms");
 	if (Object.keys(platformsInput).length === 0) throw new Error("At least one messenger platform is required");
@@ -108,19 +126,42 @@ export function parseMessengerConfig(value: unknown, baseDir: string): Messenger
 	) {
 		throw new Error("toolNames must be a unique list drawn from read, grep, glob, find, search, bash, edit, write, computer");
 	}
-	const independentSessions = input.independentSessions !== undefined ? Boolean(input.independentSessions) : true;
+	const sandbox = input.sandbox !== undefined || platforms.discord ? parseMessengerSandbox(input.sandbox) : undefined;
+	const cwd = path.resolve(baseDir, input.cwd === undefined ? "." : string(input.cwd, "cwd"));
+	const sessionDir = input.sessionDir === undefined ? path.join(notifyDir(), "messenger-sessions") : path.resolve(baseDir, string(input.sessionDir, "sessionDir"));
+	if (sandbox && (sandboxPathContains(cwd, sessionDir) || sandboxPathContains(sessionDir, cwd))) {
+		throw new Error("sessionDir must be outside and disjoint from the sandbox workspace");
+	}
 	return {
-		cwd: path.resolve(baseDir, input.cwd === undefined ? "." : string(input.cwd, "cwd")),
-		sessionDir: path.resolve(
-			baseDir,
-			input.sessionDir === undefined ? ".jeo/messenger-sessions" : string(input.sessionDir, "sessionDir"),
-		),
+		cwd,
+		sessionDir,
 		toolNames: [...toolNames] as string[],
+		...(sandbox ? { sandbox } : {}),
 		platforms,
-		independentSessions,
 	};
 }
 
+export async function validateMessengerStorage(config: MessengerConfig): Promise<void> {
+	if (!config.sandbox && !config.platforms.discord) return;
+	const [cwd, sessionDir] = await Promise.all([canonicalSandboxPath(config.cwd), canonicalSandboxPath(config.sessionDir, false)]);
+	if (sandboxPathContains(cwd, sessionDir) || sandboxPathContains(sessionDir, cwd)) {
+		throw new Error("sessionDir must be outside and disjoint from the sandbox workspace");
+	}
+	const pending = [path.join(cwd, ".jeo", "sessions"), path.join(cwd, ".jeo", "messenger-sessions"), path.join(cwd, ".jeo", "memory", "raw")];
+	while (pending.length) {
+		const directory = pending.pop()!;
+		let entries;
+		try { entries = await fs.readdir(directory, { withFileTypes: true }); }
+		catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") continue; throw error; }
+		for (const entry of entries) {
+			if (/\.(?:jsonl|json)$/i.test(entry.name) || entry.isSymbolicLink()) {
+				throw new Error("Legacy session transcripts or raw history may be exposed in the sandbox workspace; move existing private history outside the workspace before starting the sandbox");
+			}
+			if (entry.isDirectory()) pending.push(path.join(directory, entry.name));
+		}
+	}
+}
+
 export async function loadMessengerConfig(file: string): Promise<MessengerConfig> {
 	let value: unknown;
 	try {
@@ -129,6 +170,7 @@ export async function loadMessengerConfig(file: string): Promise<MessengerConfig
 		throw new Error("Cannot read messenger configuration as JSON");
 	}
 	const config = parseMessengerConfig(value, path.dirname(path.resolve(file)));
+	await validateMessengerStorage(config);
 	const artifactDir = config.platforms.discord?.artifactDir;
 	if (artifactDir) {
 		const stat = await fs.lstat(artifactDir).catch(() => undefined);