jeo-code 0.12.15 → 0.12.17

package/CHANGELOG.md

@@ -9,6 +9,29 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.17] - 2026-11-04
+
+### Fixed
+- **Windows sandbox unmapped host paths** — a host path that matches no approved mount (`C:\…`, drive-relative `C:name`, UNC `\\server\share`, or a leading `\`) was forwarded to the Linux guest unchanged, where it is a *relative* name; a write to it succeeded and created an oddly named file inside the read-write workspace mount instead of being denied. It stayed inside the mount (no host path was written), but it violated the "unmounted paths are denied" contract. The supervisor now rejects such paths (tool arguments, `cwd`, and `exec` cwd) with `SANDBOX_POLICY: host path is outside approved mounts` before anything reaches the guest. POSIX hosts and mounted paths are unchanged. Found by `verify:sandbox` (`unmounted-sentinel`) on a native Windows host.
+- **Windows shell resolution** — the `bash` tool, background jobs/monitors, and post-turn hooks spawned a bare `bash`, which on Windows resolves to WSL's `System32\bash.exe` (no `bun`, Windows paths absent). They now use the existing Git for Windows resolver, so verification commands no longer fail with exit 127 and hooks no longer time out.
+- **Mid-turn premature stop** — plain-text progress narration after tools have run, or while mutations/hooks are pending, now bounces for a JSON tool call instead of ending the turn; a post-verification completion grace step and verification-cycle step-budget extensions keep iterative edit-test-fix loops from being cut off.
+- **Live input** — mouse reports and terminal capability replies are stripped before they can reach the live draft; mid-turn file paths (`/tmp/a.ts`) and dollar amounts (`$100`) are steered to the model rather than treated as commands that abort the turn.
+- **Subagents** — executors, read-only roles, and critics get bounded step-budget extensions, and a subagent whose `done` lacks the required role-contract sections is bounced once to complete them.
+
+### Known issues
+- **Windows `verify:discord`** — 27 of 101 focused Discord tests fail on a native Windows host, both with and without the changes in this release (measured on the pre-change commit; not measured on other platforms), so its authoritative report is `failed` there. At least the attachment-staging check rejects a private directory because Windows reports mode `0o666`; the remainder are not yet triaged.
+
+## [0.12.16] - 2026-11-04
+
+### Upgrade
+- **Discord messenger:** Existing configurations whose `cwd` overlaps the messenger profile directory now fail closed. Set `cwd` to a directory disjoint from the profile before restarting; re-running setup preserves an explicitly configured `cwd` and does not relocate files. Changing `cwd` starts new sessions for existing threads.
+
+### Fixed
+- **Discord concurrency** — independent threads can progress concurrently, and same-thread follow-ups wait without occupying a worker slot; rejected full-queue requests receive a failure status without creating a thread.
+- **Discord sandbox setup** — create fresh workspaces outside private configuration paths, validate workspace admission before replacing settings, include `sandbox_request` in the default tool list, and keep messenger profile files outside workspace and permission grants.
+- **Antigravity model responses** — retry malformed function-call responses within the existing retry limit without executing incomplete tool calls or replaying already-streamed output.
+- **Windows sandbox** — preserve owner-only ACL protection and serialize authority directory lifecycle.
+
 ## [0.12.15] - 2026-11-03
 
 The GitHub-only 0.12.14 release was not published to npm; its changes (listed under [0.12.14]) are included in this release.
@@ -2671,7 +2694,9 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.6...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.17...HEAD
+[0.12.17]: https://github.com/akillness/jeo-code/releases/tag/v0.12.17
+[0.12.16]: https://github.com/akillness/jeo-code/releases/tag/v0.12.16
 [0.12.6]: https://github.com/akillness/jeo-code/releases/tag/v0.12.6
 [0.11.4]: https://github.com/akillness/jeo-code/releases/tag/v0.11.4
 [0.11.3]: https://github.com/akillness/jeo-code/releases/tag/v0.11.3

package/README.ja.md

@@ -447,10 +447,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -502,10 +502,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -37,6 +37,15 @@
   <a href="README.zh.md">中文</a>
 </p>
 
+## Install
+
+Requires Bun `1.3.14+`.
+
+```bash
+bun install -g jeo-code
+jeo --version
+```
+
 Run `jeo` inside a repository and it reads files, edits them, runs commands, and drives the task to completion — streaming every step live in an inline, scrollback-friendly TUI.
 
 ## Documentation
@@ -105,15 +114,6 @@ jeo-code is a **local-first AI coding agent CLI** designed to safely drive entir
 - **macOS low file-descriptor-limit warning** — a low `ulimit -n` (BSD's 256/1024 default) risks opaque `EMFILE` failures from file watching, the browser tool, or a broad repo scan; jeo now warns once at launch (stderr only, never piped `-p` output) with concrete `ulimit`/`launchctl` guidance. Opt out with `JEO_SKIP_NOFILE_CHECK=1`.
 
 
-## Install
-
-Requires Bun `1.3.14+`.
-
-```bash
-bun install -g jeo-code
-jeo --version
-```
-
 
 ## Quick start
 
@@ -491,10 +491,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -445,10 +445,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
+- **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
-- **[0.12.12]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.15",
+  "version": "0.12.17",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
 

package/src/agent/engine.ts

@@ -35,6 +35,13 @@ import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, verificationProducedEvidence, repeatHint, classifyDoneGate } from "./loop-guards";
 import { stripLeakedReasoningTags } from "../ai/think-tags";
 
+const MID_TASK_PROSE_RE =
+  /\b(?:i\s+will\s+now|i'll\s+now|let\s+me\s+(?:now\s+)?(?:read|check|inspect|search|find|edit|write|run|verify|update|fix|implement|create|test)|next,?\s+i\s+(?:will|need\s+to)|now\s+i\s+(?:will|need\s+to))\b|(?:이제|다음으로|먼저|이어서)\s+[^\n]{0,80}(?:수정|작성|실행|확인|구현|검증|진행|추가|변경|점검)(?:하겠|할게|해\s*보겠)/i;
+
+export function looksLikeMidTaskProse(text: string): boolean {
+  return MID_TASK_PROSE_RE.test(text.trim());
+}
+
 
 async function invokeCallLlm(history: Message[], options: {
   jsonMode: boolean;
@@ -653,6 +660,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   let mutVerSeq = 0;
   let lastMutationSeq = 0;
   let lastVerificationSeq = 0;
+  let verificationCycles = 0;
+  let completionGraceUsed = false;
   let doneCorrections = 0;
   // F1 (round 4): the run-command of the most recent post-turn hook FAILURE whose
   // diagnostics the model saw but has not yet resolved (a later clean hook run
@@ -715,12 +724,17 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     if (step > budget.limit()) {
       const decision = budget.tryExtend();
       if (!decision.extend) {
-        budgetStopReason = decision.reason;
-        break;
+        if (!completionGraceUsed && sawMutation && sawVerification && lastMutationSeq < lastVerificationSeq && !pendingHookFailure) {
+          completionGraceUsed = true;
+        } else {
+          budgetStopReason = decision.reason;
+          break;
+        }
+      } else {
+        // One surface per sink: budget-aware consumers get onBudget; others the notice.
+        if (ev.onBudget) ev.onBudget(decision.limit, decision.reason);
+        else ev.onNotice?.(decision.reason);
       }
-      // One surface per sink: budget-aware consumers get onBudget; others the notice.
-      if (ev.onBudget) ev.onBudget(decision.limit, decision.reason);
-      else ev.onNotice?.(decision.reason);
     }
     if (opts.signal?.aborted) {
       return finish({ done: false, steps: step - 1, doneReason: "Cancelled." });
@@ -1043,11 +1057,45 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     } catch (err) {
       // Preserve chat-style final answers, but subject them to the same completion
       // gates as explicit done calls rather than treating prose as proof of success.
+      // Mid-turn prose (after tools have already run, while mutations/hooks are
+      // pending, or when the text narrates an upcoming action) must bounce for a
+      // JSON tool call first instead of prematurely terminating the turn on step 1.
       const trimmed = responseText.trim();
       parseFailures++;
-      if (trimmed && (!trimmed.includes("{") || parseFailures > MAX_PARSE_BOUNCES)) {
+      const hasTools = Object.keys(tools).length > 0;
+      const midTurnInProgress =
+        (step > 1 && hasTools) ||
+        sawMutation ||
+        pendingHookFailure !== null ||
+        (hasTools && looksLikeMidTaskProse(trimmed));
+      if (trimmed && (parseFailures > MAX_PARSE_BOUNCES || (!trimmed.includes("{") && !midTurnInProgress))) {
+        const candidateReason = stripLeakedReasoningTags(trimmed) || trimmed;
+        if (parseFailures <= MAX_PARSE_BOUNCES && ev.onBeforeDone) {
+          const preCheck = await ev.onBeforeDone(candidateReason, {
+            sawMutation,
+            sawVerification,
+            verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
+          });
+          if (preCheck) {
+            if (doneCorrections >= GUARD_LIMITS.MAX_DONE_CORRECTIONS) {
+              return finish({ done: false, steps: step, doneReason: `Stopped: completion rejected after ${doneCorrections} corrections. ${preCheck}` });
+            }
+            doneCorrections++;
+            ev.onNotice?.(`done deferred — completion correction ${doneCorrections}/${GUARD_LIMITS.MAX_DONE_CORRECTIONS}`);
+            ev.onAssistant?.(responseText, null);
+            pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
+            history.push({
+              role: "user",
+              content:
+                `Your last reply was plain text instead of a JSON tool call, and completion cannot finish yet (${preCheck}). ` +
+                `Do NOT apologize. Reply with ONLY the next JSON tool call: {"tool":"<name>","arguments":{...}}.`,
+            });
+            step++;
+            continue;
+          }
+        }
         salvagedAnswer = true;
-        invocation = { tool: "done", arguments: { reason: stripLeakedReasoningTags(trimmed) || trimmed } };
+        invocation = { tool: "done", arguments: { reason: candidateReason } };
       } else {
         ev.onAssistant?.(responseText, null);
         pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
@@ -1187,8 +1235,10 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // coarse target" and let `budget.record` fall back to the exact-args signature
     // instead (unchanged legacy novelty for tools this helper doesn't specifically know).
     const callTargets = toolCalls.map(c => {
+      if ((c.tool || "").toLowerCase() === "task") return undefined;
       const t = toolTarget(c.tool, c.arguments);
-      return t.toLowerCase() === (c.tool || "").toLowerCase() ? undefined : t;
+      if (t.toLowerCase() === (c.tool || "").toLowerCase()) return undefined;
+      return verificationCycles > 0 ? `${t}@v${verificationCycles}` : t;
     });
 
 
@@ -1484,9 +1534,11 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       const command = String(toolCalls[i].arguments?.command ?? toolCalls[i].arguments?.cmd ?? "");
       const verificationCall = t === "bash" && isVerificationSignal(command);
       if (verificationCall) {
+        if (sawMutation && verificationCycles < 4) verificationCycles++;
         if (results[i].success && verificationProducedEvidence(command, String(results[i].output ?? ""))) {
           sawVerification = true;
           lastVerificationSeq = ++mutVerSeq;
+          if (!pendingHookFailure) doneCorrections = 0;
         } else {
           sawVerification = false;
           if (results[i].mutationMayHaveOccurred === true) {
@@ -1496,6 +1548,9 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
         }
         continue;
       }
+      if (t === "todo" && results[i].success && doneCorrections > 0 && (!sawMutation || (sawVerification && lastMutationSeq < lastVerificationSeq)) && !pendingHookFailure) {
+        doneCorrections = 0;
+      }
 
       const output = String(results[i].output ?? "").trim();
       const noOpMutation = results[i].success && (

package/src/agent/hooks.ts

@@ -21,6 +21,7 @@ export function withSandboxExecution<T>(scope: SandboxExecutionScope, run: () =>
 
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { resolvePosixTool } from "../util/posix-tools";
 import { readGlobalConfig } from "./state";
 import type { HookConfig } from "./state";
 
@@ -134,7 +135,7 @@ async function runHookCommand(
     };
   }
 
-  const proc = Bun.spawn(["bash", "-c", runCmd], {
+  const proc = Bun.spawn([resolvePosixTool("bash"), "-c", runCmd], {
     cwd,
     stdin: "pipe",
     stdout: "pipe",

package/src/agent/loop-guards.ts

@@ -72,20 +72,31 @@ export const GUARD_LIMITS = Object.freeze({
  * Recognized standalone verification commands. Matching the full command prevents
  * filenames, prose, and shell output from impersonating verification evidence.
  */
-export const VERIFY_SIGNAL_RE = /^(?:(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?(?:test|tests|typecheck|lint|build|check|spec|tsc|eslint|vitest|jest)(?::[\w-]+)?|(?:npx|bunx)\s+(?:tsc|eslint|vitest|jest|pytest)|(?:tsc|eslint|vitest|jest|pytest)|(?:python(?:3(?:\.\d+)?)?|uv)\s+(?:-m\s+)?pytest|cargo\s+(?:test|check|build|clippy)|go\s+(?:test|vet|build)|(?:make|just)\s+(?:test|check|lint|build|typecheck))(?:\s+[A-Za-z0-9_./:@+*?,=-]+)*$/i;
+export const VERIFY_SIGNAL_RE = /^(?:(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?(?:test|tests|typecheck|lint|build|check|spec|tsc|eslint|vitest|jest)(?::[\w-]+)?|(?:npx|bunx)\s+(?:tsc|eslint|vitest|jest|pytest)|(?:tsc|eslint|vitest|jest|pytest)|(?:python(?:3(?:\.\d+)?)?|uv)\s+(?:(?:-m\s+)?pytest|-m\s+(?:unittest|py_compile|mypy|flake8|ruff\s+check))|node\s+(?:--test|--check|-c)|deno\s+(?:test|check|lint)|cargo\s+(?:test|check|build|clippy)|go\s+(?:test|vet|build)|(?:make|just)\s+(?:test|check|lint|build|typecheck))(?:\s+[A-Za-z0-9_./:@+*?,=-]+)*$/i;
 const NONEXECUTING_VERIFY_FLAG_RE = /(?:^|\s)(?:--help|-h|--version|-version|--list(?:-tests|Tests)?|-list|--collect-only|--co|--show-?config|--init|--dry-run|--no-run|--passWithNoTests|--if-present)(?=$|\s|=)/i;
 const MUTATING_VERIFY_FLAG_RE = /(?:^|\s)(?:--fix|--write|--update|-u|--update[-_]snapshots?|--updateSnapshots?|--snapshot[-_]updates?)(?=$|\s|=)/i;
 const MUTATING_VERIFY_SCRIPT_RE = /^(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?[\w-]+:[^\s]*(?:fix|update|write|deploy|publish)[^\s]*/i;
 
+function isSingleVerificationSegment(segment: string): boolean {
+  const command = segment.trim();
+  if (!command) return false;
+  const shortNoOp = /^(?:(?:npx|bunx|bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?)?tsc\b.*(?:^|\s)-[vV](?=\s|$)/.test(command)
+    || /^(?:make|just|go)\s+.*(?:^|\s)-n(?=\s|$)/.test(command);
+  return !shortNoOp && !/[;&|<>`$(){}\n\r]/.test(command) && VERIFY_SIGNAL_RE.test(command) && !NONEXECUTING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_SCRIPT_RE.test(command);
+}
+
 /**
- * True only when the command itself is a recognized verifier invocation. Output
+ * True only when the command itself is a recognized verifier invocation (or a
+ * pure `&&` chain where every segment is a recognized verifier invocation). Output
  * is never evidence: arbitrary commands can print words such as "tests passed".
  */
 export function isVerificationSignal(cmd: string): boolean {
   const command = cmd.trim();
-  const shortNoOp = /^(?:(?:npx|bunx|bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?)?tsc\b.*(?:^|\s)-[vV](?=\s|$)/.test(command)
-    || /^(?:make|just|go)\s+.*(?:^|\s)-n(?=\s|$)/.test(command);
-  return !shortNoOp && !/[;&|<>`$(){}\n\r]/.test(command) && VERIFY_SIGNAL_RE.test(command) && !NONEXECUTING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_SCRIPT_RE.test(command);
+  if (!command) return false;
+  const withoutAndChain = command.replace(/&&/g, " ");
+  if (/[;&|<>`$(){}\n\r]/.test(withoutAndChain)) return false;
+  const segments = command.split("&&").map(s => s.trim());
+  return segments.length > 0 && segments.every(isSingleVerificationSegment);
 }
 
 /** Require test-run evidence for Go and Cargo's recognized text output. */
@@ -181,7 +192,7 @@ export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
       block: true,
       message:
         "You verified earlier, but then modified files again — your last passing test/build no longer reflects the current tree. " +
-        "Re-run the narrowest verification command against the latest changes, then call done.",
+        "Re-run the narrowest verification command against the latest changes (e.g. a standalone bash call such as 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done.",
     };
   }
   return {
@@ -189,6 +200,6 @@ export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
     block: true,
     message:
       "You modified files this turn but have no passing verification (no test/build/typecheck command succeeded, or the latest recognized verification failed). " +
-      "Run the narrowest command that proves your change works, then call done.",
+      "Run the narrowest command that proves your change works (e.g. a standalone bash call such as 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done.",
   };
 }

package/src/agent/sandbox/authority.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { canonicalSandboxPath, createSandboxPolicy, sandboxPathContains } from "./policy";
+import { canonicalSandboxPath, createSandboxPolicy, sandboxPathContains, windowsSystemRoot } from "./policy";
 import type { SandboxConfig, SandboxMount, SandboxSupervisor, SandboxTermination } from "./types";
 
 /** Constructed by trusted parent entry points, never from model/tool arguments. */
@@ -50,61 +50,124 @@ export interface GrantAuthorityOptions {
 
 type DecisionWaiter = { resolve(value: GrantRequest): void; reject(reason: Error): void };
 
+const pendingPrivateDirectories = new Map<string, Promise<string>>();
+
 /** Create app-private state, or verify existing state without widening its ACL. */
 export async function ensurePrivateSandboxDirectory(directory: string): Promise<string> {
   const canonical = await canonicalSandboxPath(directory, false);
-  if (process.platform === "win32") {
-    const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
-    if (!systemRoot || !path.isAbsolute(systemRoot)) throw new Error("SANDBOX_STATE: Windows system directory is unavailable");
-    await fs.mkdir(path.dirname(canonical), { recursive: true });
-    // Fixed parent-owned program; paths are data, never interpolated into code.
-    // Windows PowerShell 5.1 provides .NET Framework's atomic ACL creation API.
-    const script = `
+  const key = process.platform === "win32" ? canonical.toLowerCase() : canonical;
+  const active = pendingPrivateDirectories.get(key);
+  if (active) return active;
+  const operation = (async (): Promise<string> => {
+    if (process.platform === "win32") {
+      const systemRoot = windowsSystemRoot();
+      await fs.mkdir(path.dirname(canonical), { recursive: true });
+      // Fixed parent-owned program; paths are data, never interpolated into code.
+      // Windows PowerShell 5.1 provides .NET Framework's ACL creation and SetAccessControl APIs.
+      // Note: Win32 CreateDirectoryW applies explicit ACEs from SECURITY_ATTRIBUTES but strips
+      // SE_DACL_PROTECTED unless SetAccessControl (SetNamedSecurityInfoW) is called afterwards.
+      const script = `
 $ErrorActionPreference = 'Stop'
+$mutex = New-Object System.Threading.Mutex($false, 'Local\\jeo-sandbox-private-directory')
+$locked = $false
 try {
+  try { $locked = $mutex.WaitOne(30000) } catch [System.Threading.AbandonedMutexException] { $locked = $true }
+  if (-not $locked) { throw 'mutex timeout' }
   $directory = $env:JEO_SANDBOX_PRIVATE_DIRECTORY
-  $sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+  $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+  $sid = $identity.User
+  $tokenOwner = $identity.Owner
   $inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+  $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', $inherit, 'None', 'Allow')
+  $daclSecurity = New-Object System.Security.AccessControl.DirectorySecurity
+  $daclSecurity.SetAccessRuleProtection($true, $false)
+  $daclSecurity.AddAccessRule($accessRule)
+  $created = $false
   if (-not [System.IO.Directory]::Exists($directory)) {
-    $security = New-Object System.Security.AccessControl.DirectorySecurity
-    $security.SetAccessRuleProtection($true, $false)
-    $security.SetOwner($sid)
-    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', $inherit, 'None', 'Allow')
-    $security.AddAccessRule($rule)
-    [void][System.IO.Directory]::CreateDirectory($directory, $security)
+    $createSecurity = New-Object System.Security.AccessControl.DirectorySecurity
+    $createSecurity.SetAccessRuleProtection($true, $false)
+    $createSecurity.SetOwner($sid)
+    $createSecurity.AddAccessRule($accessRule)
+    [void][System.IO.Directory]::CreateDirectory($directory, $createSecurity)
+    $created = $true
+  }
+  try {
+    if (([System.IO.File]::GetAttributes($directory) -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse point' }
+    if ($created) {
+      [System.IO.Directory]::SetAccessControl($directory, $daclSecurity)
+      $currentOwner = [System.IO.Directory]::GetAccessControl($directory).GetOwner([System.Security.Principal.SecurityIdentifier])
+      if ($currentOwner.Value -ne $sid.Value) {
+        $ownerSecurity = [System.IO.Directory]::GetAccessControl($directory)
+        $ownerSecurity.SetAccessRuleProtection($true, $false)
+        $ownerSecurity.SetOwner($sid)
+        [System.IO.Directory]::SetAccessControl($directory, $ownerSecurity)
+      }
+    } else {
+      $existing = [System.IO.Directory]::GetAccessControl($directory)
+      $existingOwner = $existing.GetOwner([System.Security.Principal.SecurityIdentifier])
+      $existingRules = $existing.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
+      if ($existingRules.Count -eq 1) {
+        $existingRule = $existingRules[0]
+        $ownerMatchesToken = ($existingOwner.Value -eq $sid.Value) -or ($null -ne $tokenOwner -and $existingOwner.Value -eq $tokenOwner.Value)
+        if ($ownerMatchesToken -and $existingRule.IdentityReference.Value -eq $sid.Value -and -not $existingRule.IsInherited -and $existingRule.AccessControlType -eq 'Allow' -and $existingRule.FileSystemRights -eq 'FullControl' -and $existingRule.InheritanceFlags -eq $inherit -and $existingRule.PropagationFlags -eq 'None') {
+          if (-not $existing.AreAccessRulesProtected) {
+            [System.IO.Directory]::SetAccessControl($directory, $daclSecurity)
+          }
+          if ($existingOwner.Value -ne $sid.Value) {
+            $ownerSecurity = [System.IO.Directory]::GetAccessControl($directory)
+            $ownerSecurity.SetAccessRuleProtection($true, $false)
+            $ownerSecurity.SetOwner($sid)
+            [System.IO.Directory]::SetAccessControl($directory, $ownerSecurity)
+          }
+        }
+      }
+    }
+    $actual = [System.IO.Directory]::GetAccessControl($directory)
+    if (-not $actual.AreAccessRulesProtected -or $actual.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner or inheritance' }
+    $rules = $actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
+    if ($rules.Count -ne 1) { throw 'unexpected access rules' }
+    $rule = $rules[0]
+    if ($rule.IdentityReference.Value -ne $sid.Value -or $rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $rule.FileSystemRights -ne 'FullControl' -or $rule.InheritanceFlags -ne $inherit -or $rule.PropagationFlags -ne 'None') { throw 'non-private rule' }
+  } catch {
+    if ($created) { try { [System.IO.Directory]::Delete($directory, $false) } catch {} }
+    throw
   }
-  if (([System.IO.File]::GetAttributes($directory) -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'reparse point' }
-  $actual = [System.IO.Directory]::GetAccessControl($directory)
-  if (-not $actual.AreAccessRulesProtected -or $actual.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'owner or inheritance' }
-  $rules = $actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])
-  if ($rules.Count -ne 1) { throw 'unexpected access rules' }
-  $rule = $rules[0]
-  if ($rule.IdentityReference.Value -ne $sid.Value -or $rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $rule.FileSystemRights -ne 'FullControl' -or $rule.InheritanceFlags -ne $inherit -or $rule.PropagationFlags -ne 'None') { throw 'non-private rule' }
   [Console]::Out.Write('JEO_PRIVATE_DIRECTORY_VERIFIED')
   exit 0
 } catch { exit 1 }
+finally {
+  if ($locked) { try { $mutex.ReleaseMutex() } catch {} }
+  $mutex.Dispose()
+}
 `;
-    const executable = path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-    const child = Bun.spawn([executable, "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
-      env: { SystemRoot: systemRoot, JEO_SANDBOX_PRIVATE_DIRECTORY: canonical },
-      stdin: "ignore", stdout: "pipe", stderr: "ignore",
-    });
-    const timer = setTimeout(() => child.kill(), 30_000);
-    try {
-      const [exitCode, output] = await Promise.all([child.exited, new Response(child.stdout).text()]);
-      if (exitCode !== 0 || output !== "JEO_PRIVATE_DIRECTORY_VERIFIED") {
-        throw new Error("SANDBOX_STATE: private Windows owner-only ACL could not be verified");
-      }
-    } finally { clearTimeout(timer); }
-  } else {
-    await fs.mkdir(canonical, { recursive: true, mode: 0o700 });
-  }
-  const stat = await fs.lstat(canonical);
-  if (!stat.isDirectory() || stat.isSymbolicLink() ||
-      (process.platform !== "win32" && ((stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.()))) {
-    throw new Error("SANDBOX_STATE: authority state must be a private owner-only directory");
+      const executable = path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+      const child = Bun.spawn([executable, "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+        env: { SystemRoot: systemRoot, JEO_SANDBOX_PRIVATE_DIRECTORY: canonical },
+        stdin: "ignore", stdout: "pipe", stderr: "ignore",
+      });
+      const timer = setTimeout(() => child.kill(), 30_000);
+      try {
+        const [exitCode, output] = await Promise.all([child.exited, new Response(child.stdout).text()]);
+        if (exitCode !== 0 || output !== "JEO_PRIVATE_DIRECTORY_VERIFIED") {
+          throw new Error("SANDBOX_STATE: private Windows owner-only ACL could not be verified");
+        }
+      } finally { clearTimeout(timer); }
+    } else {
+      await fs.mkdir(canonical, { recursive: true, mode: 0o700 });
+    }
+    const stat = await fs.lstat(canonical);
+    if (!stat.isDirectory() || stat.isSymbolicLink() ||
+        (process.platform !== "win32" && ((stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.()))) {
+      throw new Error("SANDBOX_STATE: authority state must be a private owner-only directory");
+    }
+    return canonical;
+  })();
+  pendingPrivateDirectories.set(key, operation);
+  try {
+    return await operation;
+  } finally {
+    if (pendingPrivateDirectories.get(key) === operation) pendingPrivateDirectories.delete(key);
   }
-  return canonical;
 }
 
 /** All mutable authority remains in this parent closure, outside worker mounts. */

package/src/agent/sandbox/bundle.ts

@@ -19,8 +19,11 @@ export async function prepareHandsBundle(): Promise<string> {
     const temporary = path.join(staging, "hands.js");
     try {
       const output = await fs.open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-      try { await output.writeFile(source); await output.sync(); await output.chmod(0o400); }
-      finally { await output.close(); }
+      try {
+        await output.writeFile(source);
+        await output.sync();
+        if (process.platform !== "win32") await output.chmod(0o400);
+      } finally { await output.close(); }
       try { await fs.link(temporary, file); }
       catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
     } finally { await fs.rm(staging, { recursive: true, force: true }); }

package/src/agent/sandbox/docker.ts

@@ -76,6 +76,14 @@ export function createDockerBackend(options: DockerBackendOptions = {}): Sandbox
     Bun.spawn([...argv], { env: environment, stdin: "pipe", stdout: "pipe", stderr: "pipe" }) as unknown as DockerChild);
   const command = (args: readonly string[]) => run([executable, ...args]);
 
+  function normalizeMountSource(value: string): string {
+    if (platform !== "win32") return value;
+    const match = /^\/(?:run\/desktop\/mnt\/host|host_mnt)\/([a-zA-Z])(?:\/(.*))?$/.exec(value.replace(/\\/g, "/"));
+    if (!match) return value;
+    const drive = `${match[1]!.toUpperCase()}:\\`;
+    return match[2] ? path.win32.join(drive, ...match[2].split("/").filter(Boolean)) : drive;
+  }
+
   async function checked(args: readonly string[], context: string): Promise<string> {
     let result: DockerCommandResult;
     try { result = await command(args); }
@@ -158,8 +166,9 @@ export function createDockerBackend(options: DockerBackendOptions = {}): Sandbox
       if (!labels?.[OWNER] || !labels[SESSION] || !/^\d+$/.test(labels[REVISION] ?? "") || !Array.isArray(record.Mounts)) throw new Error("SANDBOX_UNAVAILABLE: unknown managed ownership or mounts");
       for (const mount of record.Mounts) {
         if (mount.Type === "tmpfs" && mount.Destination === "/tmp") continue;
-        if (mount.Type !== "bind" || typeof mount.Source !== "string" || !path.isAbsolute(mount.Source)) throw new Error("SANDBOX_UNAVAILABLE: unknown managed mount metadata");
-        const source = await canonicalSandboxPath(mount.Source);
+        const normalizedSource = typeof mount.Source === "string" ? normalizeMountSource(mount.Source) : "";
+        if (mount.Type !== "bind" || !normalizedSource || !path.isAbsolute(normalizedSource)) throw new Error("SANDBOX_UNAVAILABLE: unknown managed mount metadata");
+        const source = await canonicalSandboxPath(normalizedSource);
         if (sources.some(candidate => candidate !== source && (sandboxPathContains(candidate, source) || sandboxPathContains(source, candidate)))) {
           throw new Error("SANDBOX_MOUNT_OVERLAP: managed mount roots must be identical or disjoint");
         }
@@ -262,7 +271,8 @@ export function createDockerBackend(options: DockerBackendOptions = {}): Sandbox
         if (actual.length !== expected.length) throw new Error("SANDBOX_UNAVAILABLE: unexpected container bind mounts");
         for (const mount of expected) {
           const observed = actual.find(candidate => candidate.Destination === mount.guest);
-          if (!observed?.Source || await canonicalSandboxPath(observed.Source) !== mount.source || observed.RW !== mount.writable) throw new Error("SANDBOX_UNAVAILABLE: actual container bind configuration changed");
+          const normalizedObserved = observed?.Source ? normalizeMountSource(observed.Source) : "";
+          if (!normalizedObserved || await canonicalSandboxPath(normalizedObserved) !== mount.source || observed?.RW !== mount.writable) throw new Error("SANDBOX_UNAVAILABLE: actual container bind configuration changed");
         }
         if (record.State?.Running === true) break;
         if (Date.now() >= deadline) throw new Error("SANDBOX_UNAVAILABLE: container did not start");