jeo-code 0.12.15 → 0.12.16

package/CHANGELOG.md

@@ -9,6 +9,17 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.16] - 2026-11-04
+
+### Upgrade
+- **Discord messenger:** Existing configurations whose `cwd` overlaps the messenger profile directory now fail closed. Set `cwd` to a directory disjoint from the profile before restarting; re-running setup preserves an explicitly configured `cwd` and does not relocate files. Changing `cwd` starts new sessions for existing threads.
+
+### Fixed
+- **Discord concurrency** — independent threads can progress concurrently, and same-thread follow-ups wait without occupying a worker slot; rejected full-queue requests receive a failure status without creating a thread.
+- **Discord sandbox setup** — create fresh workspaces outside private configuration paths, validate workspace admission before replacing settings, include `sandbox_request` in the default tool list, and keep messenger profile files outside workspace and permission grants.
+- **Antigravity model responses** — retry malformed function-call responses within the existing retry limit without executing incomplete tool calls or replaying already-streamed output.
+- **Windows sandbox** — preserve owner-only ACL protection and serialize authority directory lifecycle.
+
 ## [0.12.15] - 2026-11-03
 
 The GitHub-only 0.12.14 release was not published to npm; its changes (listed under [0.12.14]) are included in this release.
@@ -2671,7 +2682,8 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.6...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.16...HEAD
+[0.12.16]: https://github.com/akillness/jeo-code/releases/tag/v0.12.16
 [0.12.6]: https://github.com/akillness/jeo-code/releases/tag/v0.12.6
 [0.11.4]: https://github.com/akillness/jeo-code/releases/tag/v0.11.4
 [0.11.3]: https://github.com/akillness/jeo-code/releases/tag/v0.11.3

package/README.ja.md

@@ -447,10 +447,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
 - **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -502,10 +502,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
 - **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -491,10 +491,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
 - **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -445,10 +445,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
 - **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.15",
+  "version": "0.12.16",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
 

package/src/agent/sandbox/authority.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { canonicalSandboxPath, createSandboxPolicy, sandboxPathContains } from "./policy";
+import { canonicalSandboxPath, createSandboxPolicy, sandboxPathContains, windowsSystemRoot } from "./policy";
 import type { SandboxConfig, SandboxMount, SandboxSupervisor, SandboxTermination } from "./types";
 
 /** Constructed by trusted parent entry points, never from model/tool arguments. */
@@ -50,61 +50,124 @@ export interface GrantAuthorityOptions {
 
 type DecisionWaiter = { resolve(value: GrantRequest): void; reject(reason: Error): void };
 
+const pendingPrivateDirectories = new Map<string, Promise<string>>();
+
 /** Create app-private state, or verify existing state without widening its ACL. */
 export async function ensurePrivateSandboxDirectory(directory: string): Promise<string> {
   const canonical = await canonicalSandboxPath(directory, false);
-  if (process.platform === "win32") {
-    const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
-    if (!systemRoot || !path.isAbsolute(systemRoot)) throw new Error("SANDBOX_STATE: Windows system directory is unavailable");
-    await fs.mkdir(path.dirname(canonical), { recursive: true });
-    // Fixed parent-owned program; paths are data, never interpolated into code.
-    // Windows PowerShell 5.1 provides .NET Framework's atomic ACL creation API.
-    const script = `
+  const key = process.platform === "win32" ? canonical.toLowerCase() : canonical;
+  const active = pendingPrivateDirectories.get(key);
+  if (active) return active;
+  const operation = (async (): Promise<string> => {
+    if (process.platform === "win32") {
+      const systemRoot = windowsSystemRoot();
+      await fs.mkdir(path.dirname(canonical), { recursive: true });
+      // Fixed parent-owned program; paths are data, never interpolated into code.
+      // Windows PowerShell 5.1 provides .NET Framework's ACL creation and SetAccessControl APIs.
+      // Note: Win32 CreateDirectoryW applies explicit ACEs from SECURITY_ATTRIBUTES but strips
+      // SE_DACL_PROTECTED unless SetAccessControl (SetNamedSecurityInfoW) is called afterwards.
+      const script = `
 $ErrorActionPreference = 'Stop'
+$mutex = New-Object System.Threading.Mutex($false, 'Local\\jeo-sandbox-private-directory')
+$locked = $false
 try {
+  try { $locked = $mutex.WaitOne(30000) } catch [System.Threading.AbandonedMutexException] { $locked = $true }
+  if (-not $locked) { throw 'mutex timeout' }
   $directory = $env:JEO_SANDBOX_PRIVATE_DIRECTORY
-  $sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+  $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+  $sid = $identity.User
+  $tokenOwner = $identity.Owner
   $inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+  $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', $inherit, 'None', 'Allow')
+  $daclSecurity = New-Object System.Security.AccessControl.DirectorySecurity
+  $daclSecurity.SetAccessRuleProtection($true, $false)
+  $daclSecurity.AddAccessRule($accessRule)
+  $created = $false
   if (-not [System.IO.Directory]::Exists($directory)) {
-    $security = New-Object System.Security.AccessControl.DirectorySecurity
-    $security.SetAccessRuleProtection($true, $false)
-    $security.SetOwner($sid)
-    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', $inherit, 'None', 'Allow')
-    $security.AddAccessRule($rule)
-    [void][System.IO.Directory]::CreateDirectory($directory, $security)
+    $createSecurity = New-Object System.Security.AccessControl.DirectorySecurity
+    $createSecurity.SetAccessRuleProtection($true, $false)
+    $createSecurity.SetOwner($sid)
+    $createSecurity.AddAccessRule($accessRule)
+    [void][System.IO.Directory]::CreateDirectory($directory, $createSecurity)
+    $created = $true
+  }
+  try {
+    if (([System.IO.File]::GetAttributes($directory) -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse point' }
+    if ($created) {
+      [System.IO.Directory]::SetAccessControl($directory, $daclSecurity)
+      $currentOwner = [System.IO.Directory]::GetAccessControl($directory).GetOwner([System.Security.Principal.SecurityIdentifier])
+      if ($currentOwner.Value -ne $sid.Value) {
+        $ownerSecurity = [System.IO.Directory]::GetAccessControl($directory)
+        $ownerSecurity.SetAccessRuleProtection($true, $false)
+        $ownerSecurity.SetOwner($sid)
+        [System.IO.Directory]::SetAccessControl($directory, $ownerSecurity)
+      }
+    } else {
+      $existing = [System.IO.Directory]::GetAccessControl($directory)
+      $existingOwner = $existing.GetOwner([System.Security.Principal.SecurityIdentifier])
+      $existingRules = $existing.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
+      if ($existingRules.Count -eq 1) {
+        $existingRule = $existingRules[0]
+        $ownerMatchesToken = ($existingOwner.Value -eq $sid.Value) -or ($null -ne $tokenOwner -and $existingOwner.Value -eq $tokenOwner.Value)
+        if ($ownerMatchesToken -and $existingRule.IdentityReference.Value -eq $sid.Value -and -not $existingRule.IsInherited -and $existingRule.AccessControlType -eq 'Allow' -and $existingRule.FileSystemRights -eq 'FullControl' -and $existingRule.InheritanceFlags -eq $inherit -and $existingRule.PropagationFlags -eq 'None') {
+          if (-not $existing.AreAccessRulesProtected) {
+            [System.IO.Directory]::SetAccessControl($directory, $daclSecurity)
+          }
+          if ($existingOwner.Value -ne $sid.Value) {
+            $ownerSecurity = [System.IO.Directory]::GetAccessControl($directory)
+            $ownerSecurity.SetAccessRuleProtection($true, $false)
+            $ownerSecurity.SetOwner($sid)
+            [System.IO.Directory]::SetAccessControl($directory, $ownerSecurity)
+          }
+        }
+      }
+    }
+    $actual = [System.IO.Directory]::GetAccessControl($directory)
+    if (-not $actual.AreAccessRulesProtected -or $actual.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner or inheritance' }
+    $rules = $actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
+    if ($rules.Count -ne 1) { throw 'unexpected access rules' }
+    $rule = $rules[0]
+    if ($rule.IdentityReference.Value -ne $sid.Value -or $rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $rule.FileSystemRights -ne 'FullControl' -or $rule.InheritanceFlags -ne $inherit -or $rule.PropagationFlags -ne 'None') { throw 'non-private rule' }
+  } catch {
+    if ($created) { try { [System.IO.Directory]::Delete($directory, $false) } catch {} }
+    throw
   }
-  if (([System.IO.File]::GetAttributes($directory) -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse point' }
-  $actual = [System.IO.Directory]::GetAccessControl($directory)
-  if (-not $actual.AreAccessRulesProtected -or $actual.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner or inheritance' }
-  $rules = $actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
-  if ($rules.Count -ne 1) { throw 'unexpected access rules' }
-  $rule = $rules[0]
-  if ($rule.IdentityReference.Value -ne $sid.Value -or $rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $rule.FileSystemRights -ne 'FullControl' -or $rule.InheritanceFlags -ne $inherit -or $rule.PropagationFlags -ne 'None') { throw 'non-private rule' }
   [Console]::Out.Write('JEO_PRIVATE_DIRECTORY_VERIFIED')
   exit 0
 } catch { exit 1 }
+finally {
+  if ($locked) { try { $mutex.ReleaseMutex() } catch {} }
+  $mutex.Dispose()
+}
 `;
-    const executable = path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-    const child = Bun.spawn([executable, "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
-      env: { SystemRoot: systemRoot, JEO_SANDBOX_PRIVATE_DIRECTORY: canonical },
-      stdin: "ignore", stdout: "pipe", stderr: "ignore",
-    });
-    const timer = setTimeout(() => child.kill(), 30_000);
-    try {
-      const [exitCode, output] = await Promise.all([child.exited, new Response(child.stdout).text()]);
-      if (exitCode !== 0 || output !== "JEO_PRIVATE_DIRECTORY_VERIFIED") {
-        throw new Error("SANDBOX_STATE: private Windows owner-only ACL could not be verified");
-      }
-    } finally { clearTimeout(timer); }
-  } else {
-    await fs.mkdir(canonical, { recursive: true, mode: 0o700 });
-  }
-  const stat = await fs.lstat(canonical);
-  if (!stat.isDirectory() || stat.isSymbolicLink() ||
-      (process.platform !== "win32" && ((stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.()))) {
-    throw new Error("SANDBOX_STATE: authority state must be a private owner-only directory");
+      const executable = path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+      const child = Bun.spawn([executable, "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+        env: { SystemRoot: systemRoot, JEO_SANDBOX_PRIVATE_DIRECTORY: canonical },
+        stdin: "ignore", stdout: "pipe", stderr: "ignore",
+      });
+      const timer = setTimeout(() => child.kill(), 30_000);
+      try {
+        const [exitCode, output] = await Promise.all([child.exited, new Response(child.stdout).text()]);
+        if (exitCode !== 0 || output !== "JEO_PRIVATE_DIRECTORY_VERIFIED") {
+          throw new Error("SANDBOX_STATE: private Windows owner-only ACL could not be verified");
+        }
+      } finally { clearTimeout(timer); }
+    } else {
+      await fs.mkdir(canonical, { recursive: true, mode: 0o700 });
+    }
+    const stat = await fs.lstat(canonical);
+    if (!stat.isDirectory() || stat.isSymbolicLink() ||
+        (process.platform !== "win32" && ((stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.()))) {
+      throw new Error("SANDBOX_STATE: authority state must be a private owner-only directory");
+    }
+    return canonical;
+  })();
+  pendingPrivateDirectories.set(key, operation);
+  try {
+    return await operation;
+  } finally {
+    if (pendingPrivateDirectories.get(key) === operation) pendingPrivateDirectories.delete(key);
   }
-  return canonical;
 }
 
 /** All mutable authority remains in this parent closure, outside worker mounts. */

package/src/agent/sandbox/bundle.ts

@@ -19,8 +19,11 @@ export async function prepareHandsBundle(): Promise<string> {
     const temporary = path.join(staging, "hands.js");
     try {
       const output = await fs.open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-      try { await output.writeFile(source); await output.sync(); await output.chmod(0o400); }
-      finally { await output.close(); }
+      try {
+        await output.writeFile(source);
+        await output.sync();
+        if (process.platform !== "win32") await output.chmod(0o400);
+      } finally { await output.close(); }
       try { await fs.link(temporary, file); }
       catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
     } finally { await fs.rm(staging, { recursive: true, force: true }); }

package/src/agent/sandbox/docker.ts

@@ -76,6 +76,14 @@ export function createDockerBackend(options: DockerBackendOptions = {}): Sandbox
     Bun.spawn([...argv], { env: environment, stdin: "pipe", stdout: "pipe", stderr: "pipe" }) as unknown as DockerChild);
   const command = (args: readonly string[]) => run([executable, ...args]);
 
+  function normalizeMountSource(value: string): string {
+    if (platform !== "win32") return value;
+    const match = /^\/(?:run\/desktop\/mnt\/host|host_mnt)\/([a-zA-Z])(?:\/(.*))?$/.exec(value.replace(/\\/g, "/"));
+    if (!match) return value;
+    const drive = `${match[1]!.toUpperCase()}:\\`;
+    return match[2] ? path.win32.join(drive, ...match[2].split("/").filter(Boolean)) : drive;
+  }
+
   async function checked(args: readonly string[], context: string): Promise<string> {
     let result: DockerCommandResult;
     try { result = await command(args); }
@@ -158,8 +166,9 @@ export function createDockerBackend(options: DockerBackendOptions = {}): Sandbox
       if (!labels?.[OWNER] || !labels[SESSION] || !/^\d+$/.test(labels[REVISION] ?? "") || !Array.isArray(record.Mounts)) throw new Error("SANDBOX_UNAVAILABLE: unknown managed ownership or mounts");
       for (const mount of record.Mounts) {
         if (mount.Type === "tmpfs" && mount.Destination === "/tmp") continue;
-        if (mount.Type !== "bind" || typeof mount.Source !== "string" || !path.isAbsolute(mount.Source)) throw new Error("SANDBOX_UNAVAILABLE: unknown managed mount metadata");
-        const source = await canonicalSandboxPath(mount.Source);
+        const normalizedSource = typeof mount.Source === "string" ? normalizeMountSource(mount.Source) : "";
+        if (mount.Type !== "bind" || !normalizedSource || !path.isAbsolute(normalizedSource)) throw new Error("SANDBOX_UNAVAILABLE: unknown managed mount metadata");
+        const source = await canonicalSandboxPath(normalizedSource);
         if (sources.some(candidate => candidate !== source && (sandboxPathContains(candidate, source) || sandboxPathContains(source, candidate)))) {
           throw new Error("SANDBOX_MOUNT_OVERLAP: managed mount roots must be identical or disjoint");
         }
@@ -262,7 +271,8 @@ export function createDockerBackend(options: DockerBackendOptions = {}): Sandbox
         if (actual.length !== expected.length) throw new Error("SANDBOX_UNAVAILABLE: unexpected container bind mounts");
         for (const mount of expected) {
           const observed = actual.find(candidate => candidate.Destination === mount.guest);
-          if (!observed?.Source || await canonicalSandboxPath(observed.Source) !== mount.source || observed.RW !== mount.writable) throw new Error("SANDBOX_UNAVAILABLE: actual container bind configuration changed");
+          const normalizedObserved = observed?.Source ? normalizeMountSource(observed.Source) : "";
+          if (!normalizedObserved || await canonicalSandboxPath(normalizedObserved) !== mount.source || observed?.RW !== mount.writable) throw new Error("SANDBOX_UNAVAILABLE: actual container bind configuration changed");
         }
         if (record.State?.Running === true) break;
         if (Date.now() >= deadline) throw new Error("SANDBOX_UNAVAILABLE: container did not start");