jeo-code 0.12.15 → 0.12.17

package/src/agent/sandbox/policy.ts

@@ -29,6 +29,17 @@ export function sandboxPathContains(parent: string, child: string): boolean {
   return relative === "" || (!path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`));
 }
 
+export function windowsSystemRoot(): string {
+  const configured = process.env.SystemRoot ?? process.env.SYSTEMROOT ?? process.env.windir;
+  if (configured && path.isAbsolute(configured)) return configured;
+  for (const candidate of ["powershell.exe", "cmd.exe"]) {
+    const resolved = Bun.which(candidate);
+    const match = resolved ? /^(.*)[\\/]System32(?:[\\/]|$)/i.exec(resolved) : null;
+    if (match?.[1] && path.isAbsolute(match[1])) return match[1];
+  }
+  throw new Error("SANDBOX_STATE: Windows system directory is unavailable");
+}
+
 let nativeHome: Promise<string> | undefined;
 
 /** Bun userInfo() can inherit startup HOME; query the native account database instead. */
@@ -36,9 +47,9 @@ export function nativeSandboxHome(): Promise<string> {
   nativeHome ??= (async () => {
     let home: string | undefined;
     let argv: string[] | undefined;
+    let systemRoot = "";
     if (process.platform === "win32") {
-      const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
-      if (!systemRoot || !path.isAbsolute(systemRoot)) throw new Error("SANDBOX_STATE: native Windows system directory unavailable");
+      systemRoot = windowsSystemRoot();
       const script = "$ErrorActionPreference='Stop';[Console]::Out.Write([Environment]::GetFolderPath([Environment+SpecialFolder]::UserProfile))";
       argv = [path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")];
     } else {
@@ -52,7 +63,7 @@ export function nativeSandboxHome(): Promise<string> {
       }
     }
     if (argv) {
-      const child = Bun.spawn(argv, { env: { SystemRoot: process.env.SystemRoot ?? process.env.SYSTEMROOT ?? "" }, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+      const child = Bun.spawn(argv, { env: { SystemRoot: systemRoot }, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
       const timer = setTimeout(() => child.kill(), 30_000);
       try {
         const [code, output] = await Promise.all([child.exited, new Response(child.stdout).text()]);
@@ -73,7 +84,10 @@ export async function canonicalSandboxPath(value: string, mustExist = true, cwd?
   if (process.platform === "win32" && /^(?:[\\/]{2}|[\\/]\?\?[\\/])/.test(value)) throw new Error("SANDBOX_PATH: Windows network and device paths are forbidden");
   const absolute = cwd === undefined ? path.resolve(value) : path.resolve(cwd, value);
   if (process.platform === "win32" && /^[\\/]{2}/.test(absolute)) throw new Error("SANDBOX_PATH: Windows network and device paths are forbidden");
-  try { return await fs.realpath(absolute); }
+  try {
+    const resolved = await fs.realpath(absolute);
+    return process.platform === "win32" && /^[A-Za-z]:$/.test(resolved) ? `${resolved}\\` : resolved;
+  }
   catch (error) {
     const code = (error as NodeJS.ErrnoException).code;
     // macOS realpath can reject launchd sockets even though their parent is resolvable.
@@ -81,14 +95,17 @@ export async function canonicalSandboxPath(value: string, mustExist = true, cwd?
     if (!socket && (mustExist || code !== "ENOENT")) throw error;
     const parent = path.dirname(absolute);
     if (parent === absolute) throw error;
-    return path.join(await canonicalSandboxPath(parent, false), path.basename(absolute));
+    const resolvedParent = await canonicalSandboxPath(parent, false);
+    const result = path.join(resolvedParent, path.basename(absolute));
+    return process.platform === "win32" && /^[A-Za-z]:$/.test(result) ? `${result}\\` : result;
   }
 }
 
 /** Deny endpoint ancestors even when their socket has not been created yet. */
 export async function validateSandboxMountSource(host: string, privatePaths: readonly string[], controlPaths: readonly string[] = []): Promise<void> {
   const home = await canonicalSandboxPath(os.homedir());
-  if (host === path.parse(host).root || host === home) throw new Error("SANDBOX_POLICY: host root and whole-home mounts are forbidden");
+  const isRoot = host === path.parse(host).root || (process.platform === "win32" && /^[A-Za-z]:[\\/]?$/.test(host));
+  if (isRoot || host === home) throw new Error("SANDBOX_POLICY: host root and whole-home mounts are forbidden");
   if (privatePaths.some(privatePath => sandboxPathContains(host, privatePath) || sandboxPathContains(privatePath, host))) {
     throw new Error("SANDBOX_POLICY: mount overlaps private control state");
   }

package/src/agent/sandbox/supervisor.ts

@@ -162,20 +162,29 @@ export function createSandboxSupervisor(options: { policy: SandboxPolicy; backen
     return effect.result.promise;
   }
 
+  /** A Windows host path that matches no mount is not "relative" to the Linux guest; it must never be forwarded. */
   function guestPath(value: string): string {
-    if (!path.isAbsolute(value)) return value;
-    const mount = [...policy.mounts].sort((a, b) => b.host.length - a.host.length).find(item => sandboxPathContains(item.host, value));
-    if (!mount) return value;
-    const relative = path.relative(mount.host, value).split(path.sep).join("/");
-    return relative ? `${mount.guest}/${relative}` : mount.guest;
+    const mount = path.isAbsolute(value) ? [...policy.mounts].sort((a, b) => b.host.length - a.host.length).find(item => sandboxPathContains(item.host, value)) : undefined;
+    if (mount) {
+      const relative = path.relative(mount.host, value).split(path.sep).join("/");
+      return relative ? `${mount.guest}/${relative}` : mount.guest;
+    }
+    if (process.platform === "win32" && /^(?:[A-Za-z]:|[\\/]{2}|\\)/.test(value)) throw new Error("SANDBOX_POLICY: host path is outside approved mounts");
+    return value;
   }
 
   function call(tool: string, args: Record<string, unknown>, callOptions?: SandboxCallOptions): Promise<ToolResult> {
     const mapped = { ...args };
-    for (const key of ["filePath", "path", "dirPath", "dir", "targetPath", "cwd", "subdir"]) {
-      if (typeof mapped[key] === "string") mapped[key] = guestPath(mapped[key]);
+    let cwd: string | undefined;
+    try {
+      for (const key of ["filePath", "path", "dirPath", "dir", "targetPath", "cwd", "subdir"]) {
+        if (typeof mapped[key] === "string") mapped[key] = guestPath(mapped[key]);
+      }
+      if (callOptions?.cwd) cwd = guestPath(callOptions.cwd);
+    } catch (error) {
+      return Promise.resolve({ success: false, output: "", error: error instanceof Error ? error.message : String(error) });
     }
-    return enqueue({ id: crypto.randomUUID(), type: "tool", tool: tool === "approve" ? "__plan_approve" : tool, args: mapped, ...(callOptions?.cwd ? { cwd: guestPath(callOptions.cwd) } : {}) }, callOptions);
+    return enqueue({ id: crypto.randomUUID(), type: "tool", tool: tool === "approve" ? "__plan_approve" : tool, args: mapped, ...(cwd ? { cwd } : {}) }, callOptions);
   }
 
   return {
@@ -184,7 +193,10 @@ export function createSandboxSupervisor(options: { policy: SandboxPolicy; backen
       return Object.fromEntries(names.map(name => [name, (args: Record<string, unknown>, cwd: string, onProgress?: (text: string) => void) => call(name, args, { cwd, onProgress })]));
     },
     exec(argv: readonly string[], execOptions: SandboxExecOptions = {}): Promise<SandboxExecResult> {
-      return enqueue({ id: crypto.randomUUID(), type: "exec", argv: [...argv], ...(execOptions.cwd ? { cwd: guestPath(execOptions.cwd) } : {}), ...(execOptions.env ? { env: execOptions.env } : {}), ...(execOptions.stdin !== undefined ? { stdin: execOptions.stdin } : {}) }, { signal: execOptions.signal });
+      let cwd: string | undefined;
+      try { if (execOptions.cwd) cwd = guestPath(execOptions.cwd); }
+      catch (error) { return Promise.resolve({ success: false, output: "", error: error instanceof Error ? error.message : String(error) }); }
+      return enqueue({ id: crypto.randomUUID(), type: "exec", argv: [...argv], ...(cwd ? { cwd } : {}), ...(execOptions.env ? { env: execOptions.env } : {}), ...(execOptions.stdin !== undefined ? { stdin: execOptions.stdin } : {}) }, { signal: execOptions.signal });
     },
     async replacePolicy(next): Promise<void> {
       if (state === "closed" || state === "changing" || next.sessionKey !== policy.sessionKey || next.revision <= policy.revision) throw new Error("SANDBOX_POLICY: closed, changing or invalid policy revision");

package/src/agent/shell-lease.ts

@@ -33,6 +33,7 @@
  */
 import * as cp from "node:child_process";
 import * as fs from "node:fs";
+import { resolvePosixTool } from "../util/posix-tools";
 import * as os from "node:os";
 import * as path from "node:path";
 import { Readable } from "node:stream";
@@ -96,7 +97,7 @@ export function spawnLeasedShell(command: string, cwd: string): LeasedShell {
 }
 
 function spawnDirect(command: string, cwd: string): LeasedShell {
-  const proc = Bun.spawn(["bash", "-c", command], { cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const proc = Bun.spawn([resolvePosixTool("bash"), "-c", command], { cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
   const stdout = proc.stdout.getReader();
   const stderr = proc.stderr.getReader();
   const reaped = proc.exited.then(() => undefined);

package/src/agent/task-tool.ts

@@ -467,6 +467,7 @@ export async function runSubagentOnce(
   const failoverEnabled = !!opts.config.routing?.enabled;
   let activeModel = initialModel;
   emit({ role: role.id, kind: "start", detail: taskText, maxSteps, model: activeModel });
+  let contractCorrections = 0;
   const runOnce = () => {
     return runAgentLoop(history, {
       cwd,
@@ -474,14 +475,27 @@ export async function runSubagentOnce(
       maxSteps,
       maxTokens: resolveMaxOutputTokens(activeModel, thinking),
       sessionKey,
-      // Bounded delegation: a subagent's step contract stays exact — the parent
-      // owns any retry/extension decision, so the gjc retry flow is disabled here.
-      budget: { maxExtensions: 0 },
+      // Allow bounded step-budget extensions when a subagent is actively making
+      // progress so multi-file edits + test verification do not get cut off mid-run.
+      budget: { maxExtensions: role.readOnly ? 1 : 2 },
       signal,
       steer,
       tools: subagentToolset(role),
       ...(failoverEnabled ? { rateLimitFallbackAvailable, safetyFallbackAvailable } : {}),
       events: {
+        onBeforeDone: reason => {
+          const hasToolActivity = fileMutations > 0 || bashRuns > 0 || readOnlyEvidenceCalls > 0;
+          if (!hasToolActivity || contractCorrections >= 1) return null;
+          const check = validateSubagentDoneReason(role, reason);
+          if (!check.ok) {
+            contractCorrections++;
+            return (
+              `Your done.reason is missing required section(s) for ${role.title}: ${check.missing?.join(", ")}. ` +
+              `Call done again with non-empty content under every required section header.`
+            );
+          }
+          return null;
+        },
         onEvidence: evidence => {
           if (evidence.sawMutation) mutationMayHaveOccurred = true;
         },

package/src/agent/tools.ts

@@ -1,4 +1,5 @@
 import { applyBashFixups } from "./bash-fixups";
+import { resolvePosixTool } from "../util/posix-tools";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { readWorkflowStateStrict, type WorkflowState } from "./state";
@@ -727,7 +728,7 @@ export async function bashTool(
     const reapBackground = isBackgroundReapEnabled();
     const grouped = reapBackground && process.platform !== "win32";
     if (grouped) ensureBackgroundSweeper();
-    const proc = Bun.spawn(["bash", "-c", command], {
+    const proc = Bun.spawn([resolvePosixTool("bash"), "-c", command], {
       cwd: runCwd,
       // Detach stdin (no inherited TTY): a command that reads stdin (`cat`, `read`,
       // a REPL, an interactive prompt) then gets immediate EOF and exits instead of

package/src/commands/launch/input.ts

@@ -439,7 +439,7 @@ export function captureLivePromptInputChunk(
       const plain = start === -1 ? rest : rest.slice(0, start);
       if (start !== -1) state.inPaste = true;
       rest = start === -1 ? "" : rest.slice(start + PASTE_START.length);
-      if (feedLivePromptSegment(state, plain)) accepted = true;
+      if (feedLivePromptSegment(state, decodeExtendedKeys(stripMouseReports(plain)))) accepted = true;
     }
   }
   return accepted;
@@ -506,10 +506,17 @@ export function createInFlightAbortHarness(opts: AbortHarnessOptions = {}): InFl
       opts.onBufferedInput?.(raw);
       return;
     }
+    // Strip mouse reports and terminal capability replies (OSC/CSI device attributes)
+    // first so terminal responses arriving mid-turn never leak into the live draft.
+    const stripped = stripMouseReports(raw);
+    if (!stripped && raw.length > 0) {
+      opts.onNoise?.();
+      return;
+    }
     // Kitty/modifyOtherKeys re-encodings → legacy bytes FIRST, so Esc (`CSI 27u`) and
     // Ctrl+C (`CSI 99;5u` / `CSI 27;5;99~`) cancel a live turn on every terminal —
     // previously they fell into the "noise" branch and did NOTHING mid-turn.
-    const text = decodeExtendedKeys(raw);
+    const text = decodeExtendedKeys(stripped);
     if (text === "\u000f") {
       opts.onDetailKey?.();
       return;
@@ -579,7 +586,22 @@ export function classifyMidTurnLine(line: string): "command" | "steer" | "empty"
   // A lone sigil ("/" or "$") has no command name — ignore it instead of aborting the
   // running turn to dispatch an empty command (a stray slash should not interrupt work).
   if (t === "/" || t === "$") return "empty";
-  return /^[/$]/.test(t) ? "command" : "steer";
+  const firstToken = t.split(/\s+/, 1)[0] ?? "";
+  if (firstToken.startsWith("/")) {
+    // A slash command is a single leading token (/model, /help, /?); a token containing
+    // additional slashes (/Users/foo/bar, /tmp/a.ts, //comment) is a path or comment,
+    // never a REPL command that should abort the running turn.
+    const name = firstToken.slice(1);
+    if (!name || name.includes("/")) return "steer";
+    return /^[a-zA-Z?][a-zA-Z0-9_-]*$/.test(name) ? "command" : "steer";
+  }
+  if (firstToken.startsWith("$")) {
+    // A skill invocation starts with a skill identifier ($team, $ralplan), not a
+    // numeric dollar amount ($100) or path ($/foo).
+    const name = firstToken.slice(1);
+    return /^[a-zA-Z][a-zA-Z0-9_:-]*$/.test(name) ? "command" : "steer";
+  }
+  return "steer";
 }
 /** Default window (ms) over which the several delivery paths of ONE physical Ctrl+C
  *  press — readline 'keypress', the rl/process 'SIGINT' event, and the raw \u0003 stdin

package/src/commands/launch.ts

@@ -60,7 +60,7 @@ import { AgyCliError, type AgyTurnResult } from "../agent/antigravity-cli";
 import { currentSandboxExecution, withSandboxExecution, runPreToolHooks, runPostTurnHooks } from "../agent/hooks";
 import { createSandboxSupervisor } from "../agent/sandbox/supervisor";
 import { createSandboxPolicy } from "../agent/sandbox/policy";
-import { createGrantAuthority } from "../agent/sandbox/authority";
+import { createGrantAuthority, ensurePrivateSandboxDirectory } from "../agent/sandbox/authority";
 import { handleSandboxControl } from "../agent/sandbox/control";
 import type { SandboxConfig, SandboxSupervisor } from "../agent/sandbox/types";
 import { runAgySessionTurn } from "./launch/agy-turn";
@@ -75,6 +75,7 @@ import { RouteHistory } from "../agent/route-history";
 
 import { isRateLimitError, isUsageLimitError, isConnectionError } from "../util/retry";
 import { messengerUsageFallback } from "../messenger/model-policy";
+import { messengerProfilePrivatePaths } from "../messenger/config";
 
 
 import { listAliases } from "../ai/model-registry";
@@ -400,6 +401,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let supervisor: SandboxSupervisor | undefined;
   let stateDirectory: string | undefined;
   let stopEndpoint: (() => Promise<void>) | undefined;
+  const setup = Promise.withResolvers<void>();
   let endpointStartup: Promise<void> | undefined;
   let closing: Promise<void> | undefined;
   const acknowledge = async (gone: boolean): Promise<void> => {
@@ -411,6 +413,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const close = (): Promise<void> => closing ??= (async () => {
     for (;;) {
       try {
+        await setup.promise;
         await endpointStartup;
         await stopEndpoint?.();
         // No supervisor means startup never had authority to create an environment.
@@ -445,6 +448,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   const runSession = (): Promise<void> => {
     const ready = Promise.withResolvers<void>();
     endpointStartup = ready.promise;
+    setup.resolve();
     return runLaunchSession(args, cleanup => { stopEndpoint = cleanup; ready.resolve(); }).finally(ready.resolve);
   };
   try {
@@ -460,9 +464,18 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     for (const legacy of [path.join(cwd, ".jeo", "sessions"), path.join(cwd, ".jeo", "messenger-sessions"), path.join(cwd, ".jeo", "memory", "raw")]) {
       if (fs.existsSync(legacy)) throw new Error("SANDBOX_PRIVATE_STATE: legacy transcripts are inside the workspace; relocate them before granting workspace access");
     }
-    stateDirectory = fs.mkdtempSync(path.join(tmpdir(), "jeo-sandbox-authority-"));
+    // The messenger profile (config, token file, run script) is private control state wherever it lives, not only under ~/.jeo.
+    const profileDirectory = process.env.JEO_MESSENGER_PROFILE_DIR;
+    if (profileDirectory !== undefined && !path.isAbsolute(profileDirectory)) throw new Error("SANDBOX_PRIVATE_STATE: invalid messenger profile directory");
+    const profilePaths = profileDirectory === undefined ? [] : await messengerProfilePrivatePaths(profileDirectory, cwd);
+    if (closing) throw new Error("Messenger worker stopping");
+    // Publish the candidate before creating it so close() removes it even if owner-only creation or ACL verification fails midway.
+    const candidateStateDirectory = path.join(tmpdir(), `jeo-sandbox-authority-${crypto.randomUUID()}`);
+    stateDirectory = candidateStateDirectory;
+    stateDirectory = await ensurePrivateSandboxDirectory(candidateStateDirectory);
+    if (closing) throw new Error("Messenger worker stopping");
     const sessionDirectory = previousSessionDirectory || path.join(jeoHomeDir(), "sandbox-sessions", createHash("sha256").update(path.resolve(cwd)).digest("hex"));
-    const privateRoots = [stateDirectory, sessionDirectory, jeoHomeDir(), notifySessionsDir()];
+    const privateRoots = [stateDirectory, sessionDirectory, jeoHomeDir(), notifySessionsDir(), ...profilePaths];
     const policy = await createSandboxPolicy({ sessionKey, revision: 0, cwd, config: sandboxConfig, privatePaths: privateRoots });
     if (closing) throw new Error("Messenger worker stopping");
     const sessionSupervisor = createSandboxSupervisor({ policy });
@@ -481,6 +494,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     if (closing) throw new Error("Messenger worker stopping");
     await withSandboxExecution({ supervisor: sessionSupervisor, authority, requestAccess: (host, mode) => authority.requestAccess(host, mode) }, runSession);
   } finally {
+    setup.resolve();
     await close();
     process.removeListener("SIGTERM", handleTermination);
     process.removeListener("message", handleControlMessage);
@@ -1953,7 +1967,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
           if ((pendingMutationVerification || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
             return (
               `Cannot finish: a workspace mutation from this session still lacks a successful, non-stale verification. ` +
-              `Run a relevant test/build/typecheck/lint after the last change, then call done again.`
+              `Run a relevant test/build/typecheck/lint after the last change (e.g. 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done again.`
             );
           }
 
@@ -3163,7 +3177,14 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
   queueBusySnapshot = () => ({
     text: queuedPromptInput.partial,
   });
-  queueBusyClear = () => { queuedPromptInput.partial = ""; };
+  queueBusyClear = () => {
+    queuedPromptInput.partial = "";
+    const r = rl as unknown as { line?: string; cursor?: number };
+    if (typeof r.line === "string") {
+      r.line = "";
+      r.cursor = 0;
+    }
+  };
   queueBusyCommand = (line: string) => {
     // NO_MIDTURN_DISPATCH=1 keeps the legacy prefill path (tee up, press Enter); the
     // default routes to the immediate-dispatch queue served at the top of the loop.

package/src/commands/messenger.ts

@@ -159,6 +159,8 @@ export function createMessengerCliReply(config: MessengerConfig, spawn: typeof B
 		delete env.JEO_MESSENGER_SANDBOX;
 		delete env.JEO_MESSENGER_ALLOWED_USER_IDS;
 		delete env.JEO_MESSENGER_SESSION_KEY;
+		delete env.JEO_MESSENGER_PROFILE_DIR;
+		if (config.profileDir !== undefined) env.JEO_MESSENGER_PROFILE_DIR = config.profileDir;
 		if (sandbox) {
 			env.JEO_MESSENGER_SANDBOX = JSON.stringify(sandbox);
 			env.JEO_MESSENGER_ALLOWED_USER_IDS = JSON.stringify(platformConfig?.allowedUserIds ?? []);

package/src/commands/ralplan.ts

@@ -80,15 +80,28 @@ export async function runConsensusCriticGate(args: {
   // is gated the SAME way: zero observed read/search/find/ast_grep/lsp calls means
   // the [OKAY]/[ITERATE]/[REJECT] text is unevidenced regardless of what it claims.
   let evidenceCalls = 0;
+  let contractCorrections = 0;
   const runOnce = () => runAgentLoop(history, {
     cwd: args.cwd,
     model: activeModel,
     maxSteps,
-    budget: { maxExtensions: 0 },
+    budget: { maxExtensions: 1 },
     signal: args.signal,
     tools: subagentToolset(role),
     rateLimitFallbackAvailable,
     events: {
+      onBeforeDone: reason => {
+        if (evidenceCalls === 0 || contractCorrections >= 1) return null;
+        const check = validateSubagentDoneReason(role, reason);
+        if (!check.ok) {
+          contractCorrections++;
+          return (
+            `Your critic report is missing required section(s): ${check.missing?.join(", ")}. ` +
+            `Call done again starting with [OKAY], [ITERATE], or [REJECT] and include a non-empty 'Justification:' section.`
+          );
+        }
+        return null;
+      },
       onToolResult: (tool, success) => {
         if (success && (tool === "read" || tool === "search" || tool === "find" || tool === "ast_grep" || tool === "lsp")) evidenceCalls++;
       },

package/src/messenger/config.ts

@@ -147,6 +147,12 @@ export async function validateMessengerStorage(config: MessengerConfig): Promise
 	if (sandboxPathContains(cwd, sessionDir) || sandboxPathContains(sessionDir, cwd)) {
 		throw new Error("sessionDir must be outside and disjoint from the sandbox workspace");
 	}
+	if (config.profileDir !== undefined) {
+		const profile = await canonicalSandboxPath(config.profileDir);
+		if (sandboxPathContains(cwd, profile) || sandboxPathContains(profile, cwd)) {
+			throw new Error("The sandbox workspace must be disjoint from the messenger profile directory (configuration and credentials); set cwd to a directory outside it");
+		}
+	}
 	const pending = [path.join(cwd, ".jeo", "sessions"), path.join(cwd, ".jeo", "messenger-sessions"), path.join(cwd, ".jeo", "memory", "raw")];
 	while (pending.length) {
 		const directory = pending.pop()!;
@@ -162,6 +168,25 @@ export async function validateMessengerStorage(config: MessengerConfig): Promise
 	}
 }
 
+/**
+ * Host paths a sandbox mount or grant must never touch: the whole profile directory (messenger.json, token file,
+ * run script, anything created later) and every direct entry that is a symlink leaving it. Entries are canonicalized,
+ * so a symlink cannot move a secret outside the list. The workspace must be disjoint from the profile in both
+ * directions; any failure to inspect the profile throws instead of returning a shorter list.
+ */
+export async function messengerProfilePrivatePaths(profileDir: string, cwd: string): Promise<string[]> {
+	const [profile, workspace] = await Promise.all([canonicalSandboxPath(profileDir), canonicalSandboxPath(cwd)]);
+	if (sandboxPathContains(workspace, profile) || sandboxPathContains(profile, workspace)) {
+		throw new Error("SANDBOX_PRIVATE_STATE: the sandbox workspace must be disjoint from the messenger profile directory (configuration and credentials)");
+	}
+	const privatePaths = [profile];
+	for (const name of await fs.readdir(profile)) {
+		const entry = await canonicalSandboxPath(path.join(profile, name), false);
+		if (!sandboxPathContains(profile, entry)) privatePaths.push(entry);
+	}
+	return privatePaths;
+}
+
 export async function loadMessengerConfig(file: string): Promise<MessengerConfig> {
 	let value: unknown;
 	try {
@@ -169,7 +194,8 @@ export async function loadMessengerConfig(file: string): Promise<MessengerConfig
 	} catch {
 		throw new Error("Cannot read messenger configuration as JSON");
 	}
-	const config = parseMessengerConfig(value, path.dirname(path.resolve(file)));
+	const profileDir = path.dirname(path.resolve(file));
+	const config: MessengerConfig = { ...parseMessengerConfig(value, profileDir), profileDir };
 	await validateMessengerStorage(config);
 	const artifactDir = config.platforms.discord?.artifactDir;
 	if (artifactDir) {

package/src/messenger/discord-setup.ts

@@ -1,14 +1,20 @@
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
-import { loadMessengerConfig, parseMessengerSandbox, resolveMessengerToken, validateMessengerEnvironment } from "./config";
+import { DEFAULT_MESSENGER_TOOLS, loadMessengerConfig, messengerProfilePrivatePaths, parseMessengerSandbox, resolveMessengerToken, validateMessengerEnvironment } from "./config";
 import { DISCORD_API, DISCORD_GATEWAY_INTENTS, discordGatewayUrl } from "./discord";
 import { MessengerHttpError, messengerFetchJson } from "./http";
 import { installMessengerService, messengerServicePlan } from "./service";
 import { isEnoent, isRecord } from "./types";
-import { notifyDir } from "../agent/notify/paths";
+import { jeoHomeDir, notifyDir, notifySessionsDir } from "../agent/notify/paths";
+import { createSandboxPolicy } from "../agent/sandbox/policy";
+import type { SandboxConfig } from "../agent/sandbox/types";
 
 export const DISCORD_TOKEN_ENV = "JEO_DISCORD_BOT_TOKEN";
 const TOKEN_FILE = "discord-token";
+/** Fresh-setup workspace: a jeo-owned directory in the user's home, outside every sandbox-private root. */
+const WORKSPACE_DIR = "jeo-discord-workspace";
+const WORKSPACE_MARKER = ".jeo-workspace";
 const RUN_SCRIPT_POSIX = "run-discord.sh";
 const RUN_SCRIPT_WINDOWS = "run-discord.cmd";
 const MESSAGE_CONTENT = 1 << 18;
@@ -495,11 +501,18 @@ export function discordRunCommand(command: string[], configName: string, tokenEn
 	return `@echo off\r\nsetlocal DisableDelayedExpansion\r\nset /p "${tokenEnv}="<"%~dp0${TOKEN_FILE}"\r\n${command.map(quote).join(" ")} messenger run --config "%~dp0${literal(configName, "config name")}"\r\n`;
 }
 
-async function writePrivate(file: string, content: string, mode: number): Promise<void> {
+/** Stage `content` beside `file`, run `validate` on the staged copy, and only then replace `file`; failure leaves `file` untouched. */
+async function writePrivate(file: string, content: string, mode: number, validate?: (staged: string) => Promise<void>): Promise<void> {
 	const temporary = `${file}.${process.pid}.tmp`;
-	await Bun.write(temporary, content);
-	await fs.chmod(temporary, mode);
-	await fs.rename(temporary, file);
+	try {
+		await Bun.write(temporary, content);
+		await fs.chmod(temporary, mode);
+		await validate?.(temporary);
+		await fs.rename(temporary, file);
+	} catch (error) {
+		await fs.unlink(temporary).catch(() => undefined);
+		throw error;
+	}
 }
 
 async function readExistingConfig(configPath: string): Promise<Record<string, unknown> | undefined> {
@@ -519,6 +532,61 @@ async function readExistingConfig(configPath: string): Promise<Record<string, un
 	throw new Error(`${configPath} exists but is not a JSON object; fix or move it before setup`);
 }
 
+/**
+ * The policy admission `messenger run` performs before starting the sandbox worker (commands/launch.ts), with the same
+ * private roots: the authority state directory, the session directory, the jeo home, the notify sessions directory and
+ * the profile paths from messengerProfilePrivatePaths, which also refuses a workspace that overlaps the profile. The authority state
+ * directory is a fresh random temp directory at launch, so a representative path under os.tmpdir() stands in for it.
+ * Throws on any refusal, so setup cannot succeed for a workspace that launch would reject.
+ */
+async function admitSandboxWorkspace(sandbox: SandboxConfig, profileDir: string, sessionDir: string, cwd: string): Promise<void> {
+	const profilePaths = await messengerProfilePrivatePaths(profileDir, cwd);
+	await createSandboxPolicy({
+		sessionKey: "setup",
+		revision: 0,
+		cwd,
+		config: sandbox,
+		privatePaths: [path.join(os.tmpdir(), "jeo-sandbox-authority-setup"), sessionDir, jeoHomeDir(), notifySessionsDir(), ...profilePaths],
+	});
+}
+
+/**
+ * Create the default workspace (or reuse one that carries the marker an earlier setup run left), then prove `admit`
+ * accepts it. The marker is a re-run convention, not proof of ownership; reuse is still gated by `admit`, and an
+ * unmarked existing directory is never adopted. Failure cleanup is non-recursive and best-effort: it can only remove
+ * the marker this call wrote and the then-empty directory, so concurrently added data survives.
+ */
+async function createDefaultWorkspace(admit: (workspace: string) => Promise<void>): Promise<string> {
+	const workspace = path.join(os.homedir(), WORKSPACE_DIR);
+	const marker = path.join(workspace, WORKSPACE_MARKER);
+	let created = false;
+	let wroteMarker = false;
+	try {
+		await fs.mkdir(workspace, { mode: 0o700 });
+		created = true;
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+	}
+	try {
+		if (created) {
+			await fs.writeFile(marker, "", { flag: "wx", mode: 0o600 });
+			wroteMarker = true;
+		} else {
+			const [stat, tag] = await Promise.all([fs.lstat(workspace), fs.lstat(marker).catch(() => undefined)]);
+			if (!stat.isDirectory() || !tag?.isFile()) {
+				throw new Error(`${workspace} already exists without the jeo setup marker`);
+			}
+		}
+		await admit(workspace);
+	} catch (error) {
+		if (wroteMarker) await fs.unlink(marker).catch(() => undefined);
+		// rmdir refuses a non-empty directory, so anything added meanwhile is preserved.
+		if (created) await fs.rmdir(workspace).catch(() => undefined);
+		throw new Error(`Default workspace ${workspace} is unusable (${error instanceof Error ? error.message : String(error)}); set "cwd" in the config to a directory outside private jeo and config roots`, { cause: error });
+	}
+	return workspace;
+}
+
 export function currentJeoCommand(entry = Bun.main, execPath = process.execPath): string[] {
 	return entry === execPath || entry.startsWith("/$bunfs/") || entry.replaceAll("\\", "/").startsWith("B:/~BUN/") ? [execPath] : [execPath, entry];
 }
@@ -606,13 +674,22 @@ export async function setupDiscordMessenger(
 
 	const discord: Record<string, unknown> = { ...previous, tokenEnv, allowedUserIds: userIds, allowedChannelIds };
 	if (options.artifacts) discord.artifactDir = "./artifacts";
-	const defaultTools = ["read", "find", "search", "write", "edit", "bash", "computer"];
+	const sessionDir = str(existing?.sessionDir) ?? path.join(notifyDir(), "messenger-sessions");
+	let cwd: unknown;
+	if (existing && Object.hasOwn(existing, "cwd")) {
+		// An explicit value is never replaced; an unusable one fails the loader below before the config is touched.
+		cwd = existing.cwd;
+	} else {
+		cwd = await createDefaultWorkspace(workspace => admitSandboxWorkspace(sandbox, directory, path.resolve(directory, sessionDir), workspace));
+		if (existing) io.say(`The existing config had no "cwd"; its sandbox workspace is now ${cwd}. No existing files were moved or deleted.`);
+	}
+	throwIfAborted(deps.signal);
 	const config = {
 		...existing,
-		cwd: str(existing?.cwd) ?? "./workspace",
-		sessionDir: str(existing?.sessionDir) ?? path.join(notifyDir(), "messenger-sessions"),
+		cwd,
+		sessionDir,
 		sandbox,
-		toolNames: options.toolNames ?? (Array.isArray(existing?.toolNames) ? existing.toolNames : defaultTools),
+		toolNames: options.toolNames ?? (Array.isArray(existing?.toolNames) ? existing.toolNames : [...DEFAULT_MESSENGER_TOOLS]),
 		platforms: { ...platforms, discord },
 	};
 	for (const relative of [config.cwd, config.sessionDir, discord.artifactDir]) {
@@ -620,7 +697,16 @@ export async function setupDiscordMessenger(
 			await fs.mkdir(path.resolve(directory, relative), { recursive: true, mode: 0o700 });
 		throwIfAborted(deps.signal);
 	}
-	await writePrivate(configPath, `${JSON.stringify(config, null, 2)}\n`, 0o600);
+	// The loader `messenger run` uses, then the policy admission it performs, must accept the staged file before it replaces a working config.
+	await writePrivate(configPath, `${JSON.stringify(config, null, 2)}\n`, 0o600, async staged => {
+		const loaded = await loadMessengerConfig(staged);
+		validateMessengerEnvironment({ ...loaded, platforms: { discord: loaded.platforms.discord } }, { [tokenEnv]: token });
+		try {
+			await admitSandboxWorkspace(sandbox, loaded.profileDir ?? directory, loaded.sessionDir, loaded.cwd);
+		} catch (error) {
+			throw new Error(`Sandbox workspace ${loaded.cwd} would be refused at launch (${error instanceof Error ? error.message : String(error)}); set "cwd" in the config to a directory outside private jeo and config roots`, { cause: error });
+		}
+	});
 	throwIfAborted(deps.signal);
 	await writePrivate(
 		runScript,
@@ -630,12 +716,6 @@ export async function setupDiscordMessenger(
 		0o700,
 	);
 	throwIfAborted(deps.signal);
-	// The same loader `messenger run` uses must accept what was written.
-	const written = await loadMessengerConfig(configPath);
-	validateMessengerEnvironment(
-		{ ...written, platforms: { discord: written.platforms.discord } },
-		{ [tokenEnv]: token },
-	);
 
 	await probeDiscordGateway(api, token, deps.WebSocket ?? WebSocket, deps.signal);
 	throwIfAborted(deps.signal);