jeo-code 0.12.15 → 0.12.16

package/src/agent/sandbox/policy.ts

@@ -29,6 +29,17 @@ export function sandboxPathContains(parent: string, child: string): boolean {
   return relative === "" || (!path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`));
 }
 
+export function windowsSystemRoot(): string {
+  const configured = process.env.SystemRoot ?? process.env.SYSTEMROOT ?? process.env.windir;
+  if (configured && path.isAbsolute(configured)) return configured;
+  for (const candidate of ["powershell.exe", "cmd.exe"]) {
+    const resolved = Bun.which(candidate);
+    const match = resolved ? /^(.*)[\\/]System32(?:[\\/]|$)/i.exec(resolved) : null;
+    if (match?.[1] && path.isAbsolute(match[1])) return match[1];
+  }
+  throw new Error("SANDBOX_STATE: Windows system directory is unavailable");
+}
+
 let nativeHome: Promise<string> | undefined;
 
 /** Bun userInfo() can inherit startup HOME; query the native account database instead. */
@@ -36,9 +47,9 @@ export function nativeSandboxHome(): Promise<string> {
   nativeHome ??= (async () => {
     let home: string | undefined;
     let argv: string[] | undefined;
+    let systemRoot = "";
     if (process.platform === "win32") {
-      const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
-      if (!systemRoot || !path.isAbsolute(systemRoot)) throw new Error("SANDBOX_STATE: native Windows system directory unavailable");
+      systemRoot = windowsSystemRoot();
       const script = "$ErrorActionPreference='Stop';[Console]::Out.Write([Environment]::GetFolderPath([Environment+SpecialFolder]::UserProfile))";
       argv = [path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")];
     } else {
@@ -52,7 +63,7 @@ export function nativeSandboxHome(): Promise<string> {
       }
     }
     if (argv) {
-      const child = Bun.spawn(argv, { env: { SystemRoot: process.env.SystemRoot ?? process.env.SYSTEMROOT ?? "" }, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+      const child = Bun.spawn(argv, { env: { SystemRoot: systemRoot }, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
       const timer = setTimeout(() => child.kill(), 30_000);
       try {
         const [code, output] = await Promise.all([child.exited, new Response(child.stdout).text()]);
@@ -73,7 +84,10 @@ export async function canonicalSandboxPath(value: string, mustExist = true, cwd?
   if (process.platform === "win32" && /^(?:[\\/]{2}|[\\/]\?\?[\\/])/.test(value)) throw new Error("SANDBOX_PATH: Windows network and device paths are forbidden");
   const absolute = cwd === undefined ? path.resolve(value) : path.resolve(cwd, value);
   if (process.platform === "win32" && /^[\\/]{2}/.test(absolute)) throw new Error("SANDBOX_PATH: Windows network and device paths are forbidden");
-  try { return await fs.realpath(absolute); }
+  try {
+    const resolved = await fs.realpath(absolute);
+    return process.platform === "win32" && /^[A-Za-z]:$/.test(resolved) ? `${resolved}\\` : resolved;
+  }
   catch (error) {
     const code = (error as NodeJS.ErrnoException).code;
     // macOS realpath can reject launchd sockets even though their parent is resolvable.
@@ -81,14 +95,17 @@ export async function canonicalSandboxPath(value: string, mustExist = true, cwd?
     if (!socket && (mustExist || code !== "ENOENT")) throw error;
     const parent = path.dirname(absolute);
     if (parent === absolute) throw error;
-    return path.join(await canonicalSandboxPath(parent, false), path.basename(absolute));
+    const resolvedParent = await canonicalSandboxPath(parent, false);
+    const result = path.join(resolvedParent, path.basename(absolute));
+    return process.platform === "win32" && /^[A-Za-z]:$/.test(result) ? `${result}\\` : result;
   }
 }
 
 /** Deny endpoint ancestors even when their socket has not been created yet. */
 export async function validateSandboxMountSource(host: string, privatePaths: readonly string[], controlPaths: readonly string[] = []): Promise<void> {
   const home = await canonicalSandboxPath(os.homedir());
-  if (host === path.parse(host).root || host === home) throw new Error("SANDBOX_POLICY: host root and whole-home mounts are forbidden");
+  const isRoot = host === path.parse(host).root || (process.platform === "win32" && /^[A-Za-z]:[\\/]?$/.test(host));
+  if (isRoot || host === home) throw new Error("SANDBOX_POLICY: host root and whole-home mounts are forbidden");
   if (privatePaths.some(privatePath => sandboxPathContains(host, privatePath) || sandboxPathContains(privatePath, host))) {
     throw new Error("SANDBOX_POLICY: mount overlaps private control state");
   }

package/src/commands/launch.ts

@@ -60,7 +60,7 @@ import { AgyCliError, type AgyTurnResult } from "../agent/antigravity-cli";
 import { currentSandboxExecution, withSandboxExecution, runPreToolHooks, runPostTurnHooks } from "../agent/hooks";
 import { createSandboxSupervisor } from "../agent/sandbox/supervisor";
 import { createSandboxPolicy } from "../agent/sandbox/policy";
-import { createGrantAuthority } from "../agent/sandbox/authority";
+import { createGrantAuthority, ensurePrivateSandboxDirectory } from "../agent/sandbox/authority";
 import { handleSandboxControl } from "../agent/sandbox/control";
 import type { SandboxConfig, SandboxSupervisor } from "../agent/sandbox/types";
 import { runAgySessionTurn } from "./launch/agy-turn";
@@ -75,6 +75,7 @@ import { RouteHistory } from "../agent/route-history";
 
 import { isRateLimitError, isUsageLimitError, isConnectionError } from "../util/retry";
 import { messengerUsageFallback } from "../messenger/model-policy";
+import { messengerProfilePrivatePaths } from "../messenger/config";
 
 
 import { listAliases } from "../ai/model-registry";
@@ -400,6 +401,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let supervisor: SandboxSupervisor | undefined;
   let stateDirectory: string | undefined;
   let stopEndpoint: (() => Promise<void>) | undefined;
+  const setup = Promise.withResolvers<void>();
   let endpointStartup: Promise<void> | undefined;
   let closing: Promise<void> | undefined;
   const acknowledge = async (gone: boolean): Promise<void> => {
@@ -411,6 +413,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const close = (): Promise<void> => closing ??= (async () => {
     for (;;) {
       try {
+        await setup.promise;
         await endpointStartup;
         await stopEndpoint?.();
         // No supervisor means startup never had authority to create an environment.
@@ -445,6 +448,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const runSession = (): Promise<void> => {
     const ready = Promise.withResolvers<void>();
     endpointStartup = ready.promise;
+    setup.resolve();
     return runLaunchSession(args, cleanup => { stopEndpoint = cleanup; ready.resolve(); }).finally(ready.resolve);
   };
   try {
@@ -460,9 +464,18 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     for (const legacy of [path.join(cwd, ".jeo", "sessions"), path.join(cwd, ".jeo", "messenger-sessions"), path.join(cwd, ".jeo", "memory", "raw")]) {
       if (fs.existsSync(legacy)) throw new Error("SANDBOX_PRIVATE_STATE: legacy transcripts are inside the workspace; relocate them before granting workspace access");
     }
-    stateDirectory = fs.mkdtempSync(path.join(tmpdir(), "jeo-sandbox-authority-"));
+    // The messenger profile (config, token file, run script) is private control state wherever it lives, not only under ~/.jeo.
+    const profileDirectory = process.env.JEO_MESSENGER_PROFILE_DIR;
+    if (profileDirectory !== undefined && !path.isAbsolute(profileDirectory)) throw new Error("SANDBOX_PRIVATE_STATE: invalid messenger profile directory");
+    const profilePaths = profileDirectory === undefined ? [] : await messengerProfilePrivatePaths(profileDirectory, cwd);
+    if (closing) throw new Error("Messenger worker stopping");
+    // Publish the candidate before creating it so close() removes it even if owner-only creation or ACL verification fails midway.
+    const candidateStateDirectory = path.join(tmpdir(), `jeo-sandbox-authority-${crypto.randomUUID()}`);
+    stateDirectory = candidateStateDirectory;
+    stateDirectory = await ensurePrivateSandboxDirectory(candidateStateDirectory);
+    if (closing) throw new Error("Messenger worker stopping");
     const sessionDirectory = previousSessionDirectory || path.join(jeoHomeDir(), "sandbox-sessions", createHash("sha256").update(path.resolve(cwd)).digest("hex"));
-    const privateRoots = [stateDirectory, sessionDirectory, jeoHomeDir(), notifySessionsDir()];
+    const privateRoots = [stateDirectory, sessionDirectory, jeoHomeDir(), notifySessionsDir(), ...profilePaths];
     const policy = await createSandboxPolicy({ sessionKey, revision: 0, cwd, config: sandboxConfig, privatePaths: privateRoots });
     if (closing) throw new Error("Messenger worker stopping");
     const sessionSupervisor = createSandboxSupervisor({ policy });
@@ -481,6 +494,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     if (closing) throw new Error("Messenger worker stopping");
     await withSandboxExecution({ supervisor: sessionSupervisor, authority, requestAccess: (host, mode) => authority.requestAccess(host, mode) }, runSession);
   } finally {
+    setup.resolve();
     await close();
     process.removeListener("SIGTERM", handleTermination);
     process.removeListener("message", handleControlMessage);

package/src/commands/messenger.ts

@@ -159,6 +159,8 @@ export function createMessengerCliReply(config: MessengerConfig, spawn: typeof B
 		delete env.JEO_MESSENGER_SANDBOX;
 		delete env.JEO_MESSENGER_ALLOWED_USER_IDS;
 		delete env.JEO_MESSENGER_SESSION_KEY;
+		delete env.JEO_MESSENGER_PROFILE_DIR;
+		if (config.profileDir !== undefined) env.JEO_MESSENGER_PROFILE_DIR = config.profileDir;
 		if (sandbox) {
 			env.JEO_MESSENGER_SANDBOX = JSON.stringify(sandbox);
 			env.JEO_MESSENGER_ALLOWED_USER_IDS = JSON.stringify(platformConfig?.allowedUserIds ?? []);

package/src/messenger/config.ts

@@ -147,6 +147,12 @@ export async function validateMessengerStorage(config: MessengerConfig): Promise
 	if (sandboxPathContains(cwd, sessionDir) || sandboxPathContains(sessionDir, cwd)) {
 		throw new Error("sessionDir must be outside and disjoint from the sandbox workspace");
 	}
+	if (config.profileDir !== undefined) {
+		const profile = await canonicalSandboxPath(config.profileDir);
+		if (sandboxPathContains(cwd, profile) || sandboxPathContains(profile, cwd)) {
+			throw new Error("The sandbox workspace must be disjoint from the messenger profile directory (configuration and credentials); set cwd to a directory outside it");
+		}
+	}
 	const pending = [path.join(cwd, ".jeo", "sessions"), path.join(cwd, ".jeo", "messenger-sessions"), path.join(cwd, ".jeo", "memory", "raw")];
 	while (pending.length) {
 		const directory = pending.pop()!;
@@ -162,6 +168,25 @@ export async function validateMessengerStorage(config: MessengerConfig): Promise
 	}
 }
 
+/**
+ * Host paths a sandbox mount or grant must never touch: the whole profile directory (messenger.json, token file,
+ * run script, anything created later) and every direct entry that is a symlink leaving it. Entries are canonicalized,
+ * so a symlink cannot move a secret outside the list. The workspace must be disjoint from the profile in both
+ * directions; any failure to inspect the profile throws instead of returning a shorter list.
+ */
+export async function messengerProfilePrivatePaths(profileDir: string, cwd: string): Promise<string[]> {
+	const [profile, workspace] = await Promise.all([canonicalSandboxPath(profileDir), canonicalSandboxPath(cwd)]);
+	if (sandboxPathContains(workspace, profile) || sandboxPathContains(profile, workspace)) {
+		throw new Error("SANDBOX_PRIVATE_STATE: the sandbox workspace must be disjoint from the messenger profile directory (configuration and credentials)");
+	}
+	const privatePaths = [profile];
+	for (const name of await fs.readdir(profile)) {
+		const entry = await canonicalSandboxPath(path.join(profile, name), false);
+		if (!sandboxPathContains(profile, entry)) privatePaths.push(entry);
+	}
+	return privatePaths;
+}
+
 export async function loadMessengerConfig(file: string): Promise<MessengerConfig> {
 	let value: unknown;
 	try {
@@ -169,7 +194,8 @@ export async function loadMessengerConfig(file: string): Promise<MessengerConfig
 	} catch {
 		throw new Error("Cannot read messenger configuration as JSON");
 	}
-	const config = parseMessengerConfig(value, path.dirname(path.resolve(file)));
+	const profileDir = path.dirname(path.resolve(file));
+	const config: MessengerConfig = { ...parseMessengerConfig(value, profileDir), profileDir };
 	await validateMessengerStorage(config);
 	const artifactDir = config.platforms.discord?.artifactDir;
 	if (artifactDir) {

package/src/messenger/discord-setup.ts

@@ -1,14 +1,20 @@
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
-import { loadMessengerConfig, parseMessengerSandbox, resolveMessengerToken, validateMessengerEnvironment } from "./config";
+import { DEFAULT_MESSENGER_TOOLS, loadMessengerConfig, messengerProfilePrivatePaths, parseMessengerSandbox, resolveMessengerToken, validateMessengerEnvironment } from "./config";
 import { DISCORD_API, DISCORD_GATEWAY_INTENTS, discordGatewayUrl } from "./discord";
 import { MessengerHttpError, messengerFetchJson } from "./http";
 import { installMessengerService, messengerServicePlan } from "./service";
 import { isEnoent, isRecord } from "./types";
-import { notifyDir } from "../agent/notify/paths";
+import { jeoHomeDir, notifyDir, notifySessionsDir } from "../agent/notify/paths";
+import { createSandboxPolicy } from "../agent/sandbox/policy";
+import type { SandboxConfig } from "../agent/sandbox/types";
 
 export const DISCORD_TOKEN_ENV = "JEO_DISCORD_BOT_TOKEN";
 const TOKEN_FILE = "discord-token";
+/** Fresh-setup workspace: a jeo-owned directory in the user's home, outside every sandbox-private root. */
+const WORKSPACE_DIR = "jeo-discord-workspace";
+const WORKSPACE_MARKER = ".jeo-workspace";
 const RUN_SCRIPT_POSIX = "run-discord.sh";
 const RUN_SCRIPT_WINDOWS = "run-discord.cmd";
 const MESSAGE_CONTENT = 1 << 18;
@@ -495,11 +501,18 @@ export function discordRunCommand(command: string[], configName: string, tokenEn
 	return `@echo off\r\nsetlocal DisableDelayedExpansion\r\nset /p "${tokenEnv}="<"%~dp0${TOKEN_FILE}"\r\n${command.map(quote).join(" ")} messenger run --config "%~dp0${literal(configName, "config name")}"\r\n`;
 }
 
-async function writePrivate(file: string, content: string, mode: number): Promise<void> {
+/** Stage `content` beside `file`, run `validate` on the staged copy, and only then replace `file`; failure leaves `file` untouched. */
+async function writePrivate(file: string, content: string, mode: number, validate?: (staged: string) => Promise<void>): Promise<void> {
 	const temporary = `${file}.${process.pid}.tmp`;
-	await Bun.write(temporary, content);
-	await fs.chmod(temporary, mode);
-	await fs.rename(temporary, file);
+	try {
+		await Bun.write(temporary, content);
+		await fs.chmod(temporary, mode);
+		await validate?.(temporary);
+		await fs.rename(temporary, file);
+	} catch (error) {
+		await fs.unlink(temporary).catch(() => undefined);
+		throw error;
+	}
 }
 
 async function readExistingConfig(configPath: string): Promise<Record<string, unknown> | undefined> {
@@ -519,6 +532,61 @@ async function readExistingConfig(configPath: string): Promise<Record<string, un
 	throw new Error(`${configPath} exists but is not a JSON object; fix or move it before setup`);
 }
 
+/**
+ * The policy admission `messenger run` performs before starting the sandbox worker (commands/launch.ts), with the same
+ * private roots: the authority state directory, the session directory, the jeo home, the notify sessions directory and
+ * the profile paths from messengerProfilePrivatePaths, which also refuses a workspace that overlaps the profile. The authority state
+ * directory is a fresh random temp directory at launch, so a representative path under os.tmpdir() stands in for it.
+ * Throws on any refusal, so setup cannot succeed for a workspace that launch would reject.
+ */
+async function admitSandboxWorkspace(sandbox: SandboxConfig, profileDir: string, sessionDir: string, cwd: string): Promise<void> {
+	const profilePaths = await messengerProfilePrivatePaths(profileDir, cwd);
+	await createSandboxPolicy({
+		sessionKey: "setup",
+		revision: 0,
+		cwd,
+		config: sandbox,
+		privatePaths: [path.join(os.tmpdir(), "jeo-sandbox-authority-setup"), sessionDir, jeoHomeDir(), notifySessionsDir(), ...profilePaths],
+	});
+}
+
+/**
+ * Create the default workspace (or reuse one that carries the marker an earlier setup run left), then prove `admit`
+ * accepts it. The marker is a re-run convention, not proof of ownership; reuse is still gated by `admit`, and an
+ * unmarked existing directory is never adopted. Failure cleanup is non-recursive and best-effort: it can only remove
+ * the marker this call wrote and the then-empty directory, so concurrently added data survives.
+ */
+async function createDefaultWorkspace(admit: (workspace: string) => Promise<void>): Promise<string> {
+	const workspace = path.join(os.homedir(), WORKSPACE_DIR);
+	const marker = path.join(workspace, WORKSPACE_MARKER);
+	let created = false;
+	let wroteMarker = false;
+	try {
+		await fs.mkdir(workspace, { mode: 0o700 });
+		created = true;
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+	}
+	try {
+		if (created) {
+			await fs.writeFile(marker, "", { flag: "wx", mode: 0o600 });
+			wroteMarker = true;
+		} else {
+			const [stat, tag] = await Promise.all([fs.lstat(workspace), fs.lstat(marker).catch(() => undefined)]);
+			if (!stat.isDirectory() || !tag?.isFile()) {
+				throw new Error(`${workspace} already exists without the jeo setup marker`);
+			}
+		}
+		await admit(workspace);
+	} catch (error) {
+		if (wroteMarker) await fs.unlink(marker).catch(() => undefined);
+		// rmdir refuses a non-empty directory, so anything added meanwhile is preserved.
+		if (created) await fs.rmdir(workspace).catch(() => undefined);
+		throw new Error(`Default workspace ${workspace} is unusable (${error instanceof Error ? error.message : String(error)}); set "cwd" in the config to a directory outside private jeo and config roots`, { cause: error });
+	}
+	return workspace;
+}
+
 export function currentJeoCommand(entry = Bun.main, execPath = process.execPath): string[] {
 	return entry === execPath || entry.startsWith("/$bunfs/") || entry.replaceAll("\\", "/").startsWith("B:/~BUN/") ? [execPath] : [execPath, entry];
 }
@@ -606,13 +674,22 @@ export async function setupDiscordMessenger(
 
 	const discord: Record<string, unknown> = { ...previous, tokenEnv, allowedUserIds: userIds, allowedChannelIds };
 	if (options.artifacts) discord.artifactDir = "./artifacts";
-	const defaultTools = ["read", "find", "search", "write", "edit", "bash", "computer"];
+	const sessionDir = str(existing?.sessionDir) ?? path.join(notifyDir(), "messenger-sessions");
+	let cwd: unknown;
+	if (existing && Object.hasOwn(existing, "cwd")) {
+		// An explicit value is never replaced; an unusable one fails the loader below before the config is touched.
+		cwd = existing.cwd;
+	} else {
+		cwd = await createDefaultWorkspace(workspace => admitSandboxWorkspace(sandbox, directory, path.resolve(directory, sessionDir), workspace));
+		if (existing) io.say(`The existing config had no "cwd"; its sandbox workspace is now ${cwd}. No existing files were moved or deleted.`);
+	}
+	throwIfAborted(deps.signal);
 	const config = {
 		...existing,
-		cwd: str(existing?.cwd) ?? "./workspace",
-		sessionDir: str(existing?.sessionDir) ?? path.join(notifyDir(), "messenger-sessions"),
+		cwd,
+		sessionDir,
 		sandbox,
-		toolNames: options.toolNames ?? (Array.isArray(existing?.toolNames) ? existing.toolNames : defaultTools),
+		toolNames: options.toolNames ?? (Array.isArray(existing?.toolNames) ? existing.toolNames : [...DEFAULT_MESSENGER_TOOLS]),
 		platforms: { ...platforms, discord },
 	};
 	for (const relative of [config.cwd, config.sessionDir, discord.artifactDir]) {
@@ -620,7 +697,16 @@ export async function setupDiscordMessenger(
 			await fs.mkdir(path.resolve(directory, relative), { recursive: true, mode: 0o700 });
 		throwIfAborted(deps.signal);
 	}
-	await writePrivate(configPath, `${JSON.stringify(config, null, 2)}\n`, 0o600);
+	// The loader `messenger run` uses, then the policy admission it performs, must accept the staged file before it replaces a working config.
+	await writePrivate(configPath, `${JSON.stringify(config, null, 2)}\n`, 0o600, async staged => {
+		const loaded = await loadMessengerConfig(staged);
+		validateMessengerEnvironment({ ...loaded, platforms: { discord: loaded.platforms.discord } }, { [tokenEnv]: token });
+		try {
+			await admitSandboxWorkspace(sandbox, loaded.profileDir ?? directory, loaded.sessionDir, loaded.cwd);
+		} catch (error) {
+			throw new Error(`Sandbox workspace ${loaded.cwd} would be refused at launch (${error instanceof Error ? error.message : String(error)}); set "cwd" in the config to a directory outside private jeo and config roots`, { cause: error });
+		}
+	});
 	throwIfAborted(deps.signal);
 	await writePrivate(
 		runScript,
@@ -630,12 +716,6 @@ export async function setupDiscordMessenger(
 		0o700,
 	);
 	throwIfAborted(deps.signal);
-	// The same loader `messenger run` uses must accept what was written.
-	const written = await loadMessengerConfig(configPath);
-	validateMessengerEnvironment(
-		{ ...written, platforms: { discord: written.platforms.discord } },
-		{ [tokenEnv]: token },
-	);
 
 	await probeDiscordGateway(api, token, deps.WebSocket ?? WebSocket, deps.signal);
 	throwIfAborted(deps.signal);

package/src/messenger/gateway.ts

@@ -216,7 +216,12 @@ export function messengerSessionRoute(cwd: string, message: MessengerMessage): s
 	return new Bun.CryptoHasher("sha256").update(JSON.stringify([cwd, messengerConversationKey(message)])).digest("hex");
 }
 
-function schedulingKey(message: MessengerMessage, adapter: MessengerAdapter): string {
+/**
+ * Admission lane. A top-level message has no thread yet, so only its raw channel can order it against its
+ * neighbours; anything already resolved is ordered by its own conversation. A lane is held only until the request
+ * is queued, never while it runs, so it cannot serialize requests that end up in different threads.
+ */
+function admissionKey(message: MessengerMessage, adapter: MessengerAdapter): string {
 	if (adapter.prepare && !message.direct && !message.threadId && !message.parentChannelId) {
 		return JSON.stringify([message.platform, message.accountId, message.guildId, message.channelId, message.platform === "discord" ? null : message.senderId]);
 	}
@@ -243,12 +248,15 @@ export function isMessengerMessageAllowed(message: MessengerMessage, config: Mes
 }
 
 interface PendingMessage {
+	/** Prepared destination: replies, deliveries and activity target it. */
 	message: MessengerMessage;
 	adapter: MessengerAdapter;
 	signal: AbortSignal;
 	resolve: () => void;
-	/** Requests sharing a key never run at the same time. */
+	/** Destination conversation key; requests sharing it never run at the same time. */
 	key: string;
+	/** Status reactions on the user's original message. */
+	status: (state: "processing" | "success" | "failure") => void;
 }
 
 export interface MessengerGateway {
@@ -260,8 +268,9 @@ export interface MessengerGatewayOptions {
 	/** Minimum spacing between in-place activity edits for one request. */
 	activityIntervalMs?: number;
 	/**
-	 * Requests processed at once (default 1). Requests of one prepared conversation still answer and deliver in
-	 * order; above 1 the reply implementation must accept concurrent turns for different conversations.
+	 * Requests processed at once (default 1). Requests of one conversation answer and deliver in arrival order and
+	 * wait in the queue, not in a slot, behind their predecessor; above 1 the reply implementation must accept
+	 * concurrent turns for different conversations.
 	 */
 	concurrency?: number;
 	/** Authenticated human controls bypass model queues, including busy sessions. */
@@ -286,23 +295,22 @@ export function createMessengerGateway(
 	const queue: PendingMessage[] = [];
 	const activeKeys = new Set<string>();
 	const turns = new Set<Promise<void>>();
-	/** Settles when the latest request of a prepared conversation has delivered its reply. */
-	const conversationTails = new Map<string, Promise<void>>();
+	/** Orders admission (sandbox control, capacity check, destination preparation) per raw lane. */
 	const admissionTails = new Map<string, Promise<void>>();
+	/** Requests holding a queue slot while the adapter prepares their destination; counted against the queue cap. */
+	let preparing = 0;
 	const lifetime = new AbortController();
 	let running = false;
 	let fatalError: MessengerFatalError | undefined;
 	let statusInFlight = 0;
 
-	async function processRequest(pending: PendingMessage): Promise<void> {
-		const { message, adapter, signal, resolve } = pending;
-		let failed = false;
-		let activity = NO_ACTIVITY;
-		let release = (): void => {};
-		let tail: Promise<void> | undefined;
-		let conversation = "";
+	function createStatusReporter(
+		adapter: MessengerAdapter,
+		message: MessengerMessage,
+		signal: AbortSignal,
+	): (state: "processing" | "success" | "failure") => void {
 		let statusChain = Promise.resolve();
-		const status = (state: "processing" | "success" | "failure"): void => {
+		return state => {
 			if (!adapter.status) return;
 			statusChain = statusChain.then(async () => {
 				if (signal.aborted || statusInFlight >= MAX_STATUS_IN_FLIGHT) return;
@@ -332,22 +340,20 @@ export function createMessengerGateway(
 				}
 			});
 		};
+	}
+
+	async function processRequest(pending: PendingMessage): Promise<void> {
+		const { message, adapter, signal, resolve, status } = pending;
+		let failed = false;
+		let activity = NO_ACTIVITY;
 		try {
 			if (signal.aborted) return;
 			status("processing");
-			const destination = (await adapter.prepare?.(message, signal)) ?? message;
-			conversation = messengerConversationKey(destination);
-			const previous = conversationTails.get(conversation);
-			const done = Promise.withResolvers<void>();
-			release = done.resolve;
-			tail = done.promise;
-			conversationTails.set(conversation, tail);
-			await previous;
-			activity = createActivityReporter(adapter, destination, signal, activityIntervalMs);
+			activity = createActivityReporter(adapter, message, signal, activityIntervalMs);
 			activity.report("Starting request");
 			let text: string;
 			try {
-				text = await reply(destination, signal, activity.report);
+				text = await reply(message, signal, activity.report);
 			} catch (error) {
 				failed = true;
 				if (error instanceof MessengerFatalError) {
@@ -363,7 +369,7 @@ export function createMessengerGateway(
 			}
 			if (!signal.aborted && text.trim()) {
 				// A failed send may already have delivered a chunk: never retry the entire reply.
-				await adapter.send(destination, text, signal);
+				await adapter.send(message, text, signal);
 			}
 			if (!signal.aborted) status(failed ? "failure" : "success");
 		} catch {
@@ -371,8 +377,6 @@ export function createMessengerGateway(
 			if (!signal.aborted) status("failure");
 		} finally {
 			await activity.close(failed ? "failure" : signal.aborted ? "cancelled" : "success");
-			release();
-			if (tail && conversationTails.get(conversation) === tail) conversationTails.delete(conversation);
 			resolve();
 		}
 	}
@@ -407,12 +411,12 @@ export function createMessengerGateway(
 			const oldest = seen.values().next().value;
 			if (oldest !== undefined) seen.delete(oldest);
 		}
-		const key = schedulingKey(message, adapter);
-		const previous = admissionTails.get(key) ?? Promise.resolve();
+		const lane = admissionKey(message, adapter);
+		const previous = admissionTails.get(lane) ?? Promise.resolve();
 		const ready = Promise.withResolvers<void>();
 		const tail = previous.then(() => ready.promise);
-		admissionTails.set(key, tail);
-		void tail.then(() => { if (admissionTails.get(key) === tail) admissionTails.delete(key); });
+		admissionTails.set(lane, tail);
+		void tail.then(() => { if (admissionTails.get(lane) === tail) admissionTails.delete(lane); });
 		try {
 			if (options.sandboxControl) {
 				const control = await options.sandboxControl(message, effectiveSignal);
@@ -422,9 +426,30 @@ export function createMessengerGateway(
 				}
 			}
 			await previous;
-			if (effectiveSignal.aborted || queue.length >= MAX_QUEUED_MESSAGES) return;
+			if (effectiveSignal.aborted) return;
+			const status = createStatusReporter(adapter, message, effectiveSignal);
+			// Capacity is claimed before preparing: a request that cannot be queued must never create a thread.
+			if (queue.length + preparing >= MAX_QUEUED_MESSAGES) {
+				// Never executed, so forget the id: a redelivery is accepted once capacity returns, replaying nothing.
+				seen.delete(id);
+				status("failure");
+				return;
+			}
+			let destination: MessengerMessage;
+			let key: string;
+			preparing++;
+			try {
+				destination = (await adapter.prepare?.(message, effectiveSignal)) ?? message;
+				key = messengerConversationKey(destination);
+			} catch {
+				if (!effectiveSignal.aborted) status("failure");
+				return;
+			} finally {
+				preparing--;
+			}
+			if (effectiveSignal.aborted) return;
 			const { promise, resolve } = Promise.withResolvers<void>();
-			queue.push({ message, adapter, signal: effectiveSignal, resolve, key });
+			queue.push({ message: destination, adapter, signal: effectiveSignal, resolve, key, status });
 			schedule();
 			return promise;
 		} finally { ready.resolve(); }

package/src/messenger/types.ts

@@ -50,6 +50,8 @@ export interface MessengerPlatformConfig {
 }
 
 export interface MessengerConfig {
+	/** Directory holding the loaded messenger.json, token file and run script; set by `loadMessengerConfig`. */
+	profileDir?: string;
 	cwd: string;
 	sessionDir: string;
 	toolNames: string[];

package/src/util/retry.ts

@@ -64,6 +64,18 @@ export function defaultRetryable(err: unknown): boolean {
   if (isRefusalError(err)) {
     return false;
   }
+  // An Antigravity/Gemini 3.x `finishReason=MALFORMED_FUNCTION_CALL` on an otherwise-200
+  // response that already carried partial text/functionCall parts is rejected by
+  // antigravity.ts as "…response incomplete (finishReason=MALFORMED_FUNCTION_CALL)."
+  // (call AND stream). It is an intermittent model fault, not a deterministic classifier
+  // verdict: the adapter throws BEFORE serializing the buffered functionCalls, so a resend
+  // executes no unvalidated call. Retry it within the normal attempt budget. Scoped to this
+  // exact shape — other `response incomplete (…)` reasons (MAX_TOKENS, missing finishReason)
+  // stay non-retryable; the empty-candidate variant ("returned no content (…)") is already
+  // retried below. A stream that has yielded a chunk is never re-run by retryableStream.
+  if (/Antigravity Cloud Code Assist response incomplete \(finishReason=MALFORMED_FUNCTION_CALL\)/i.test(errorMessageOf(err))) {
+    return true;
+  }
   // A pre-response connection failure (refused / unresolved host) — retryable: a
   // local provider that is mid-restart, or a transient DNS blip, can clear within
   // the backoff budget. A provider that is simply never running exhausts the