jeo-code 0.12.16 → 0.12.17

package/CHANGELOG.md

@@ -9,6 +9,18 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.17] - 2026-11-04
+
+### Fixed
+- **Windows sandbox unmapped host paths** — a host path that matches no approved mount (`C:\…`, drive-relative `C:name`, UNC `\\server\share`, or a leading `\`) was forwarded to the Linux guest unchanged, where it is a *relative* name; a write to it succeeded and created an oddly named file inside the read-write workspace mount instead of being denied. It stayed inside the mount (no host path was written), but it violated the "unmounted paths are denied" contract. The supervisor now rejects such paths (tool arguments, `cwd`, and `exec` cwd) with `SANDBOX_POLICY: host path is outside approved mounts` before anything reaches the guest. POSIX hosts and mounted paths are unchanged. Found by `verify:sandbox` (`unmounted-sentinel`) on a native Windows host.
+- **Windows shell resolution** — the `bash` tool, background jobs/monitors, and post-turn hooks spawned a bare `bash`, which on Windows resolves to WSL's `System32\bash.exe` (no `bun`, Windows paths absent). They now use the existing Git for Windows resolver, so verification commands no longer fail with exit 127 and hooks no longer time out.
+- **Mid-turn premature stop** — plain-text progress narration after tools have run, or while mutations/hooks are pending, now bounces for a JSON tool call instead of ending the turn; a post-verification completion grace step and verification-cycle step-budget extensions keep iterative edit-test-fix loops from being cut off.
+- **Live input** — mouse reports and terminal capability replies are stripped before they can reach the live draft; mid-turn file paths (`/tmp/a.ts`) and dollar amounts (`$100`) are steered to the model rather than treated as commands that abort the turn.
+- **Subagents** — executors, read-only roles, and critics get bounded step-budget extensions, and a subagent whose `done` lacks the required role-contract sections is bounced once to complete them.
+
+### Known issues
+- **Windows `verify:discord`** — 27 of 101 focused Discord tests fail on a native Windows host, both with and without the changes in this release (measured on the pre-change commit; not measured on other platforms), so its authoritative report is `failed` there. At least the attachment-staging check rejects a private directory because Windows reports mode `0o666`; the remainder are not yet triaged.
+
 ## [0.12.16] - 2026-11-04
 
 ### Upgrade
@@ -2682,7 +2694,8 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.16...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.17...HEAD
+[0.12.17]: https://github.com/akillness/jeo-code/releases/tag/v0.12.17
 [0.12.16]: https://github.com/akillness/jeo-code/releases/tag/v0.12.16
 [0.12.6]: https://github.com/akillness/jeo-code/releases/tag/v0.12.6
 [0.11.4]: https://github.com/akillness/jeo-code/releases/tag/v0.11.4

package/README.ja.md

@@ -447,10 +447,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
 - **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -502,10 +502,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
 - **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -37,6 +37,15 @@
   <a href="README.zh.md">中文</a>
 </p>
 
+## Install
+
+Requires Bun `1.3.14+`.
+
+```bash
+bun install -g jeo-code
+jeo --version
+```
+
 Run `jeo` inside a repository and it reads files, edits them, runs commands, and drives the task to completion — streaming every step live in an inline, scrollback-friendly TUI.
 
 ## Documentation
@@ -105,15 +114,6 @@ jeo-code is a **local-first AI coding agent CLI** designed to safely drive entir
 - **macOS low file-descriptor-limit warning** — a low `ulimit -n` (BSD's 256/1024 default) risks opaque `EMFILE` failures from file watching, the browser tool, or a broad repo scan; jeo now warns once at launch (stderr only, never piped `-p` output) with concrete `ulimit`/`launchctl` guidance. Opt out with `JEO_SKIP_NOFILE_CHECK=1`.
 
 
-## Install
-
-Requires Bun `1.3.14+`.
-
-```bash
-bun install -g jeo-code
-jeo --version
-```
-
 
 ## Quick start
 
@@ -491,10 +491,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
 - **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -445,10 +445,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.17]** (2026-11-04)
 - **[0.12.16]** (2026-11-04)
 - **[0.12.15]** (2026-11-03)
 - **[0.12.14]** (2026-11-03)
-- **[0.12.13]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.16",
+  "version": "0.12.17",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
 

package/src/agent/engine.ts

@@ -35,6 +35,13 @@ import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, verificationProducedEvidence, repeatHint, classifyDoneGate } from "./loop-guards";
 import { stripLeakedReasoningTags } from "../ai/think-tags";
 
+const MID_TASK_PROSE_RE =
+  /\b(?:i\s+will\s+now|i'll\s+now|let\s+me\s+(?:now\s+)?(?:read|check|inspect|search|find|edit|write|run|verify|update|fix|implement|create|test)|next,?\s+i\s+(?:will|need\s+to)|now\s+i\s+(?:will|need\s+to))\b|(?:이제|다음으로|먼저|이어서)\s+[^\n]{0,80}(?:수정|작성|실행|확인|구현|검증|진행|추가|변경|점검)(?:하겠|할게|해\s*보겠)/i;
+
+export function looksLikeMidTaskProse(text: string): boolean {
+  return MID_TASK_PROSE_RE.test(text.trim());
+}
+
 
 async function invokeCallLlm(history: Message[], options: {
   jsonMode: boolean;
@@ -653,6 +660,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   let mutVerSeq = 0;
   let lastMutationSeq = 0;
   let lastVerificationSeq = 0;
+  let verificationCycles = 0;
+  let completionGraceUsed = false;
   let doneCorrections = 0;
   // F1 (round 4): the run-command of the most recent post-turn hook FAILURE whose
   // diagnostics the model saw but has not yet resolved (a later clean hook run
@@ -715,12 +724,17 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     if (step > budget.limit()) {
       const decision = budget.tryExtend();
       if (!decision.extend) {
-        budgetStopReason = decision.reason;
-        break;
+        if (!completionGraceUsed && sawMutation && sawVerification && lastMutationSeq < lastVerificationSeq && !pendingHookFailure) {
+          completionGraceUsed = true;
+        } else {
+          budgetStopReason = decision.reason;
+          break;
+        }
+      } else {
+        // One surface per sink: budget-aware consumers get onBudget; others the notice.
+        if (ev.onBudget) ev.onBudget(decision.limit, decision.reason);
+        else ev.onNotice?.(decision.reason);
       }
-      // One surface per sink: budget-aware consumers get onBudget; others the notice.
-      if (ev.onBudget) ev.onBudget(decision.limit, decision.reason);
-      else ev.onNotice?.(decision.reason);
     }
     if (opts.signal?.aborted) {
       return finish({ done: false, steps: step - 1, doneReason: "Cancelled." });
@@ -1043,11 +1057,45 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     } catch (err) {
       // Preserve chat-style final answers, but subject them to the same completion
       // gates as explicit done calls rather than treating prose as proof of success.
+      // Mid-turn prose (after tools have already run, while mutations/hooks are
+      // pending, or when the text narrates an upcoming action) must bounce for a
+      // JSON tool call first instead of prematurely terminating the turn on step 1.
       const trimmed = responseText.trim();
       parseFailures++;
-      if (trimmed && (!trimmed.includes("{") || parseFailures > MAX_PARSE_BOUNCES)) {
+      const hasTools = Object.keys(tools).length > 0;
+      const midTurnInProgress =
+        (step > 1 && hasTools) ||
+        sawMutation ||
+        pendingHookFailure !== null ||
+        (hasTools && looksLikeMidTaskProse(trimmed));
+      if (trimmed && (parseFailures > MAX_PARSE_BOUNCES || (!trimmed.includes("{") && !midTurnInProgress))) {
+        const candidateReason = stripLeakedReasoningTags(trimmed) || trimmed;
+        if (parseFailures <= MAX_PARSE_BOUNCES && ev.onBeforeDone) {
+          const preCheck = await ev.onBeforeDone(candidateReason, {
+            sawMutation,
+            sawVerification,
+            verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
+          });
+          if (preCheck) {
+            if (doneCorrections >= GUARD_LIMITS.MAX_DONE_CORRECTIONS) {
+              return finish({ done: false, steps: step, doneReason: `Stopped: completion rejected after ${doneCorrections} corrections. ${preCheck}` });
+            }
+            doneCorrections++;
+            ev.onNotice?.(`done deferred — completion correction ${doneCorrections}/${GUARD_LIMITS.MAX_DONE_CORRECTIONS}`);
+            ev.onAssistant?.(responseText, null);
+            pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
+            history.push({
+              role: "user",
+              content:
+                `Your last reply was plain text instead of a JSON tool call, and completion cannot finish yet (${preCheck}). ` +
+                `Do NOT apologize. Reply with ONLY the next JSON tool call: {"tool":"<name>","arguments":{...}}.`,
+            });
+            step++;
+            continue;
+          }
+        }
         salvagedAnswer = true;
-        invocation = { tool: "done", arguments: { reason: stripLeakedReasoningTags(trimmed) || trimmed } };
+        invocation = { tool: "done", arguments: { reason: candidateReason } };
       } else {
         ev.onAssistant?.(responseText, null);
         pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
@@ -1187,8 +1235,10 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // coarse target" and let `budget.record` fall back to the exact-args signature
     // instead (unchanged legacy novelty for tools this helper doesn't specifically know).
     const callTargets = toolCalls.map(c => {
+      if ((c.tool || "").toLowerCase() === "task") return undefined;
       const t = toolTarget(c.tool, c.arguments);
-      return t.toLowerCase() === (c.tool || "").toLowerCase() ? undefined : t;
+      if (t.toLowerCase() === (c.tool || "").toLowerCase()) return undefined;
+      return verificationCycles > 0 ? `${t}@v${verificationCycles}` : t;
     });
 
 
@@ -1484,9 +1534,11 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       const command = String(toolCalls[i].arguments?.command ?? toolCalls[i].arguments?.cmd ?? "");
       const verificationCall = t === "bash" && isVerificationSignal(command);
       if (verificationCall) {
+        if (sawMutation && verificationCycles < 4) verificationCycles++;
         if (results[i].success && verificationProducedEvidence(command, String(results[i].output ?? ""))) {
           sawVerification = true;
           lastVerificationSeq = ++mutVerSeq;
+          if (!pendingHookFailure) doneCorrections = 0;
         } else {
           sawVerification = false;
           if (results[i].mutationMayHaveOccurred === true) {
@@ -1496,6 +1548,9 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
         }
         continue;
       }
+      if (t === "todo" && results[i].success && doneCorrections > 0 && (!sawMutation || (sawVerification && lastMutationSeq < lastVerificationSeq)) && !pendingHookFailure) {
+        doneCorrections = 0;
+      }
 
       const output = String(results[i].output ?? "").trim();
       const noOpMutation = results[i].success && (

package/src/agent/hooks.ts

@@ -21,6 +21,7 @@ export function withSandboxExecution<T>(scope: SandboxExecutionScope, run: () =>
 
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { resolvePosixTool } from "../util/posix-tools";
 import { readGlobalConfig } from "./state";
 import type { HookConfig } from "./state";
 
@@ -134,7 +135,7 @@ async function runHookCommand(
     };
   }
 
-  const proc = Bun.spawn(["bash", "-c", runCmd], {
+  const proc = Bun.spawn([resolvePosixTool("bash"), "-c", runCmd], {
     cwd,
     stdin: "pipe",
     stdout: "pipe",

package/src/agent/loop-guards.ts

@@ -72,20 +72,31 @@ export const GUARD_LIMITS = Object.freeze({
  * Recognized standalone verification commands. Matching the full command prevents
  * filenames, prose, and shell output from impersonating verification evidence.
  */
-export const VERIFY_SIGNAL_RE = /^(?:(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?(?:test|tests|typecheck|lint|build|check|spec|tsc|eslint|vitest|jest)(?::[\w-]+)?|(?:npx|bunx)\s+(?:tsc|eslint|vitest|jest|pytest)|(?:tsc|eslint|vitest|jest|pytest)|(?:python(?:3(?:\.\d+)?)?|uv)\s+(?:-m\s+)?pytest|cargo\s+(?:test|check|build|clippy)|go\s+(?:test|vet|build)|(?:make|just)\s+(?:test|check|lint|build|typecheck))(?:\s+[A-Za-z0-9_./:@+*?,=-]+)*$/i;
+export const VERIFY_SIGNAL_RE = /^(?:(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?(?:test|tests|typecheck|lint|build|check|spec|tsc|eslint|vitest|jest)(?::[\w-]+)?|(?:npx|bunx)\s+(?:tsc|eslint|vitest|jest|pytest)|(?:tsc|eslint|vitest|jest|pytest)|(?:python(?:3(?:\.\d+)?)?|uv)\s+(?:(?:-m\s+)?pytest|-m\s+(?:unittest|py_compile|mypy|flake8|ruff\s+check))|node\s+(?:--test|--check|-c)|deno\s+(?:test|check|lint)|cargo\s+(?:test|check|build|clippy)|go\s+(?:test|vet|build)|(?:make|just)\s+(?:test|check|lint|build|typecheck))(?:\s+[A-Za-z0-9_./:@+*?,=-]+)*$/i;
 const NONEXECUTING_VERIFY_FLAG_RE = /(?:^|\s)(?:--help|-h|--version|-version|--list(?:-tests|Tests)?|-list|--collect-only|--co|--show-?config|--init|--dry-run|--no-run|--passWithNoTests|--if-present)(?=$|\s|=)/i;
 const MUTATING_VERIFY_FLAG_RE = /(?:^|\s)(?:--fix|--write|--update|-u|--update[-_]snapshots?|--updateSnapshots?|--snapshot[-_]updates?)(?=$|\s|=)/i;
 const MUTATING_VERIFY_SCRIPT_RE = /^(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?[\w-]+:[^\s]*(?:fix|update|write|deploy|publish)[^\s]*/i;
 
+function isSingleVerificationSegment(segment: string): boolean {
+  const command = segment.trim();
+  if (!command) return false;
+  const shortNoOp = /^(?:(?:npx|bunx|bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?)?tsc\b.*(?:^|\s)-[vV](?=\s|$)/.test(command)
+    || /^(?:make|just|go)\s+.*(?:^|\s)-n(?=\s|$)/.test(command);
+  return !shortNoOp && !/[;&|<>`$(){}\n\r]/.test(command) && VERIFY_SIGNAL_RE.test(command) && !NONEXECUTING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_SCRIPT_RE.test(command);
+}
+
 /**
- * True only when the command itself is a recognized verifier invocation. Output
+ * True only when the command itself is a recognized verifier invocation (or a
+ * pure `&&` chain where every segment is a recognized verifier invocation). Output
  * is never evidence: arbitrary commands can print words such as "tests passed".
  */
 export function isVerificationSignal(cmd: string): boolean {
   const command = cmd.trim();
-  const shortNoOp = /^(?:(?:npx|bunx|bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?)?tsc\b.*(?:^|\s)-[vV](?=\s|$)/.test(command)
-    || /^(?:make|just|go)\s+.*(?:^|\s)-n(?=\s|$)/.test(command);
-  return !shortNoOp && !/[;&|<>`$(){}\n\r]/.test(command) && VERIFY_SIGNAL_RE.test(command) && !NONEXECUTING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_SCRIPT_RE.test(command);
+  if (!command) return false;
+  const withoutAndChain = command.replace(/&&/g, " ");
+  if (/[;&|<>`$(){}\n\r]/.test(withoutAndChain)) return false;
+  const segments = command.split("&&").map(s => s.trim());
+  return segments.length > 0 && segments.every(isSingleVerificationSegment);
 }
 
 /** Require test-run evidence for Go and Cargo's recognized text output. */
@@ -181,7 +192,7 @@ export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
       block: true,
       message:
         "You verified earlier, but then modified files again — your last passing test/build no longer reflects the current tree. " +
-        "Re-run the narrowest verification command against the latest changes, then call done.",
+        "Re-run the narrowest verification command against the latest changes (e.g. a standalone bash call such as 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done.",
     };
   }
   return {
@@ -189,6 +200,6 @@ export function classifyDoneGate(input: DoneGateInput): DoneGateVerdict {
     block: true,
     message:
       "You modified files this turn but have no passing verification (no test/build/typecheck command succeeded, or the latest recognized verification failed). " +
-      "Run the narrowest command that proves your change works, then call done.",
+      "Run the narrowest command that proves your change works (e.g. a standalone bash call such as 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done.",
   };
 }