jeo-code 0.12.16 → 0.12.17

package/src/agent/sandbox/supervisor.ts

@@ -162,20 +162,29 @@ export function createSandboxSupervisor(options: { policy: SandboxPolicy; backen
     return effect.result.promise;
   }
 
+  /** A Windows host path that matches no mount is not "relative" to the Linux guest; it must never be forwarded. */
   function guestPath(value: string): string {
-    if (!path.isAbsolute(value)) return value;
-    const mount = [...policy.mounts].sort((a, b) => b.host.length - a.host.length).find(item => sandboxPathContains(item.host, value));
-    if (!mount) return value;
-    const relative = path.relative(mount.host, value).split(path.sep).join("/");
-    return relative ? `${mount.guest}/${relative}` : mount.guest;
+    const mount = path.isAbsolute(value) ? [...policy.mounts].sort((a, b) => b.host.length - a.host.length).find(item => sandboxPathContains(item.host, value)) : undefined;
+    if (mount) {
+      const relative = path.relative(mount.host, value).split(path.sep).join("/");
+      return relative ? `${mount.guest}/${relative}` : mount.guest;
+    }
+    if (process.platform === "win32" && /^(?:[A-Za-z]:|[\\/]{2}|\\)/.test(value)) throw new Error("SANDBOX_POLICY: host path is outside approved mounts");
+    return value;
   }
 
   function call(tool: string, args: Record<string, unknown>, callOptions?: SandboxCallOptions): Promise<ToolResult> {
     const mapped = { ...args };
-    for (const key of ["filePath", "path", "dirPath", "dir", "targetPath", "cwd", "subdir"]) {
-      if (typeof mapped[key] === "string") mapped[key] = guestPath(mapped[key]);
+    let cwd: string | undefined;
+    try {
+      for (const key of ["filePath", "path", "dirPath", "dir", "targetPath", "cwd", "subdir"]) {
+        if (typeof mapped[key] === "string") mapped[key] = guestPath(mapped[key]);
+      }
+      if (callOptions?.cwd) cwd = guestPath(callOptions.cwd);
+    } catch (error) {
+      return Promise.resolve({ success: false, output: "", error: error instanceof Error ? error.message : String(error) });
     }
-    return enqueue({ id: crypto.randomUUID(), type: "tool", tool: tool === "approve" ? "__plan_approve" : tool, args: mapped, ...(callOptions?.cwd ? { cwd: guestPath(callOptions.cwd) } : {}) }, callOptions);
+    return enqueue({ id: crypto.randomUUID(), type: "tool", tool: tool === "approve" ? "__plan_approve" : tool, args: mapped, ...(cwd ? { cwd } : {}) }, callOptions);
   }
 
   return {
@@ -184,7 +193,10 @@ export function createSandboxSupervisor(options: { policy: SandboxPolicy; backen
       return Object.fromEntries(names.map(name => [name, (args: Record<string, unknown>, cwd: string, onProgress?: (text: string) => void) => call(name, args, { cwd, onProgress })]));
     },
     exec(argv: readonly string[], execOptions: SandboxExecOptions = {}): Promise<SandboxExecResult> {
-      return enqueue({ id: crypto.randomUUID(), type: "exec", argv: [...argv], ...(execOptions.cwd ? { cwd: guestPath(execOptions.cwd) } : {}), ...(execOptions.env ? { env: execOptions.env } : {}), ...(execOptions.stdin !== undefined ? { stdin: execOptions.stdin } : {}) }, { signal: execOptions.signal });
+      let cwd: string | undefined;
+      try { if (execOptions.cwd) cwd = guestPath(execOptions.cwd); }
+      catch (error) { return Promise.resolve({ success: false, output: "", error: error instanceof Error ? error.message : String(error) }); }
+      return enqueue({ id: crypto.randomUUID(), type: "exec", argv: [...argv], ...(cwd ? { cwd } : {}), ...(execOptions.env ? { env: execOptions.env } : {}), ...(execOptions.stdin !== undefined ? { stdin: execOptions.stdin } : {}) }, { signal: execOptions.signal });
     },
     async replacePolicy(next): Promise<void> {
       if (state === "closed" || state === "changing" || next.sessionKey !== policy.sessionKey || next.revision <= policy.revision) throw new Error("SANDBOX_POLICY: closed, changing or invalid policy revision");

package/src/agent/shell-lease.ts

@@ -33,6 +33,7 @@
  */
 import * as cp from "node:child_process";
 import * as fs from "node:fs";
+import { resolvePosixTool } from "../util/posix-tools";
 import * as os from "node:os";
 import * as path from "node:path";
 import { Readable } from "node:stream";
@@ -96,7 +97,7 @@ export function spawnLeasedShell(command: string, cwd: string): LeasedShell {
 }
 
 function spawnDirect(command: string, cwd: string): LeasedShell {
-  const proc = Bun.spawn(["bash", "-c", command], { cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const proc = Bun.spawn([resolvePosixTool("bash"), "-c", command], { cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
   const stdout = proc.stdout.getReader();
   const stderr = proc.stderr.getReader();
   const reaped = proc.exited.then(() => undefined);

package/src/agent/task-tool.ts

@@ -467,6 +467,7 @@ export async function runSubagentOnce(
   const failoverEnabled = !!opts.config.routing?.enabled;
   let activeModel = initialModel;
   emit({ role: role.id, kind: "start", detail: taskText, maxSteps, model: activeModel });
+  let contractCorrections = 0;
   const runOnce = () => {
     return runAgentLoop(history, {
       cwd,
@@ -474,14 +475,27 @@ export async function runSubagentOnce(
       maxSteps,
       maxTokens: resolveMaxOutputTokens(activeModel, thinking),
       sessionKey,
-      // Bounded delegation: a subagent's step contract stays exact — the parent
-      // owns any retry/extension decision, so the gjc retry flow is disabled here.
-      budget: { maxExtensions: 0 },
+      // Allow bounded step-budget extensions when a subagent is actively making
+      // progress so multi-file edits + test verification do not get cut off mid-run.
+      budget: { maxExtensions: role.readOnly ? 1 : 2 },
       signal,
       steer,
       tools: subagentToolset(role),
       ...(failoverEnabled ? { rateLimitFallbackAvailable, safetyFallbackAvailable } : {}),
       events: {
+        onBeforeDone: reason => {
+          const hasToolActivity = fileMutations > 0 || bashRuns > 0 || readOnlyEvidenceCalls > 0;
+          if (!hasToolActivity || contractCorrections >= 1) return null;
+          const check = validateSubagentDoneReason(role, reason);
+          if (!check.ok) {
+            contractCorrections++;
+            return (
+              `Your done.reason is missing required section(s) for ${role.title}: ${check.missing?.join(", ")}. ` +
+              `Call done again with non-empty content under every required section header.`
+            );
+          }
+          return null;
+        },
         onEvidence: evidence => {
           if (evidence.sawMutation) mutationMayHaveOccurred = true;
         },

package/src/agent/tools.ts

@@ -1,4 +1,5 @@
 import { applyBashFixups } from "./bash-fixups";
+import { resolvePosixTool } from "../util/posix-tools";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { readWorkflowStateStrict, type WorkflowState } from "./state";
@@ -727,7 +728,7 @@ export async function bashTool(
     const reapBackground = isBackgroundReapEnabled();
     const grouped = reapBackground && process.platform !== "win32";
     if (grouped) ensureBackgroundSweeper();
-    const proc = Bun.spawn(["bash", "-c", command], {
+    const proc = Bun.spawn([resolvePosixTool("bash"), "-c", command], {
       cwd: runCwd,
       // Detach stdin (no inherited TTY): a command that reads stdin (`cat`, `read`,
       // a REPL, an interactive prompt) then gets immediate EOF and exits instead of

package/src/commands/launch/input.ts

@@ -439,7 +439,7 @@ export function captureLivePromptInputChunk(
       const plain = start === -1 ? rest : rest.slice(0, start);
       if (start !== -1) state.inPaste = true;
       rest = start === -1 ? "" : rest.slice(start + PASTE_START.length);
-      if (feedLivePromptSegment(state, plain)) accepted = true;
+      if (feedLivePromptSegment(state, decodeExtendedKeys(stripMouseReports(plain)))) accepted = true;
     }
   }
   return accepted;
@@ -506,10 +506,17 @@ export function createInFlightAbortHarness(opts: AbortHarnessOptions = {}): InFl
       opts.onBufferedInput?.(raw);
       return;
     }
+    // Strip mouse reports and terminal capability replies (OSC/CSI device attributes)
+    // first so terminal responses arriving mid-turn never leak into the live draft.
+    const stripped = stripMouseReports(raw);
+    if (!stripped && raw.length > 0) {
+      opts.onNoise?.();
+      return;
+    }
     // Kitty/modifyOtherKeys re-encodings → legacy bytes FIRST, so Esc (`CSI 27u`) and
     // Ctrl+C (`CSI 99;5u` / `CSI 27;5;99~`) cancel a live turn on every terminal —
     // previously they fell into the "noise" branch and did NOTHING mid-turn.
-    const text = decodeExtendedKeys(raw);
+    const text = decodeExtendedKeys(stripped);
     if (text === "\u000f") {
       opts.onDetailKey?.();
       return;
@@ -579,7 +586,22 @@ export function classifyMidTurnLine(line: string): "command" | "steer" | "empty"
   // A lone sigil ("/" or "$") has no command name — ignore it instead of aborting the
   // running turn to dispatch an empty command (a stray slash should not interrupt work).
   if (t === "/" || t === "$") return "empty";
-  return /^[/$]/.test(t) ? "command" : "steer";
+  const firstToken = t.split(/\s+/, 1)[0] ?? "";
+  if (firstToken.startsWith("/")) {
+    // A slash command is a single leading token (/model, /help, /?); a token containing
+    // additional slashes (/Users/foo/bar, /tmp/a.ts, //comment) is a path or comment,
+    // never a REPL command that should abort the running turn.
+    const name = firstToken.slice(1);
+    if (!name || name.includes("/")) return "steer";
+    return /^[a-zA-Z?][a-zA-Z0-9_-]*$/.test(name) ? "command" : "steer";
+  }
+  if (firstToken.startsWith("$")) {
+    // A skill invocation starts with a skill identifier ($team, $ralplan), not a
+    // numeric dollar amount ($100) or path ($/foo).
+    const name = firstToken.slice(1);
+    return /^[a-zA-Z][a-zA-Z0-9_:-]*$/.test(name) ? "command" : "steer";
+  }
+  return "steer";
 }
 /** Default window (ms) over which the several delivery paths of ONE physical Ctrl+C
  *  press — readline 'keypress', the rl/process 'SIGINT' event, and the raw \u0003 stdin

package/src/commands/launch.ts

@@ -1967,7 +1967,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
           if ((pendingMutationVerification || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
             return (
               `Cannot finish: a workspace mutation from this session still lacks a successful, non-stale verification. ` +
-              `Run a relevant test/build/typecheck/lint after the last change, then call done again.`
+              `Run a relevant test/build/typecheck/lint after the last change (e.g. 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done again.`
             );
           }
 
@@ -3177,7 +3177,14 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
   queueBusySnapshot = () => ({
     text: queuedPromptInput.partial,
   });
-  queueBusyClear = () => { queuedPromptInput.partial = ""; };
+  queueBusyClear = () => {
+    queuedPromptInput.partial = "";
+    const r = rl as unknown as { line?: string; cursor?: number };
+    if (typeof r.line === "string") {
+      r.line = "";
+      r.cursor = 0;
+    }
+  };
   queueBusyCommand = (line: string) => {
     // NO_MIDTURN_DISPATCH=1 keeps the legacy prefill path (tee up, press Enter); the
     // default routes to the immediate-dispatch queue served at the top of the loop.

package/src/commands/ralplan.ts

@@ -80,15 +80,28 @@ export async function runConsensusCriticGate(args: {
   // is gated the SAME way: zero observed read/search/find/ast_grep/lsp calls means
   // the [OKAY]/[ITERATE]/[REJECT] text is unevidenced regardless of what it claims.
   let evidenceCalls = 0;
+  let contractCorrections = 0;
   const runOnce = () => runAgentLoop(history, {
     cwd: args.cwd,
     model: activeModel,
     maxSteps,
-    budget: { maxExtensions: 0 },
+    budget: { maxExtensions: 1 },
     signal: args.signal,
     tools: subagentToolset(role),
     rateLimitFallbackAvailable,
     events: {
+      onBeforeDone: reason => {
+        if (evidenceCalls === 0 || contractCorrections >= 1) return null;
+        const check = validateSubagentDoneReason(role, reason);
+        if (!check.ok) {
+          contractCorrections++;
+          return (
+            `Your critic report is missing required section(s): ${check.missing?.join(", ")}. ` +
+            `Call done again starting with [OKAY], [ITERATE], or [REJECT] and include a non-empty 'Justification:' section.`
+          );
+        }
+        return null;
+      },
       onToolResult: (tool, success) => {
         if (success && (tool === "read" || tool === "search" || tool === "find" || tool === "ast_grep" || tool === "lsp")) evidenceCalls++;
       },

package/src/prompts/AGENTS.md

@@ -23,7 +23,7 @@ Bundled system prompts, role definitions, and workflow skill documentation for t
 - Do not remove existing constraints without explicit reason.
 
 ### Testing Requirements
-- Prompt changes should be verified via end-to-end testing or `bun run run-evolution.sh`.
+- Prompt changes should be verified via end-to-end testing.
 
 ### Common Patterns
 - XML-like tags for structural organization within prompts.

package/src/util/posix-tools.ts

@@ -0,0 +1,66 @@
+/**
+ * POSIX tool resolution for Windows hosts.
+ *
+ * `Bun.spawn(["bash"|"grep"|"find", …])` resolves from PATH, where Windows
+ * ships imposters ahead of Git for Windows:
+ *  - `C:\Windows\System32\bash.exe` launches WSL — Windows paths
+ *    (`C:\Users\…`) do not exist inside it and caller env vars are dropped.
+ *  - `C:\Windows\System32\find.exe` is the legacy DOS FIND (substring
+ *    filter), not POSIX find.
+ *
+ * Resolve to real Git for Windows binaries instead, with an env override.
+ * Non-Windows platforms pass the bare name through unchanged.
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+export type PosixTool = "bash" | "grep" | "find";
+
+export interface ResolveOptions {
+  /** Platform override for tests (default: process.platform). */
+  readonly platform?: NodeJS.Platform;
+  /** Env override for tests (default: process.env). */
+  readonly env?: Record<string, string | undefined>;
+  /** File-existence probe override for tests (default: fs.existsSync). */
+  readonly exists?: (p: string) => boolean;
+}
+
+/** Candidate absolute paths for a tool, in preference order. */
+export function candidatePaths(
+  tool: PosixTool,
+  env: Record<string, string | undefined>
+): string[] {
+  const override = env[`JOC_${tool.toUpperCase()}_PATH`];
+  const roots = [
+    env["ProgramFiles"] && path.join(env["ProgramFiles"], "Git"),
+    env["ProgramFiles(x86)"] && path.join(env["ProgramFiles(x86)"], "Git"),
+    env["LOCALAPPDATA"] && path.join(env["LOCALAPPDATA"], "Programs", "Git"),
+  ].filter((r): r is string => Boolean(r));
+  // bash lives in both bin/ and usr/bin/; grep/find only in usr/bin/.
+  const subdirs = tool === "bash" ? ["bin", path.join("usr", "bin")] : [path.join("usr", "bin")];
+  return [
+    ...(override ? [override] : []),
+    ...roots.flatMap(root => subdirs.map(sub => path.join(root, sub, `${tool}.exe`))),
+  ];
+}
+
+const cache = new Map<PosixTool, string>();
+
+/**
+ * Resolve `tool` to a Unix-semantics executable. Returns an absolute Git
+ * for Windows path when found, otherwise the bare name (PATH fallback).
+ */
+export function resolvePosixTool(tool: PosixTool, opts: ResolveOptions = {}): string {
+  const platform = opts.platform ?? process.platform;
+  if (platform !== "win32") return tool;
+  const injected = opts.env || opts.exists;
+  if (!injected) {
+    const hit = cache.get(tool);
+    if (hit) return hit;
+  }
+  const env = opts.env ?? process.env;
+  const exists = opts.exists ?? existsSync;
+  const found = candidatePaths(tool, env).find(c => exists(c)) ?? tool;
+  if (!injected) cache.set(tool, found);
+  return found;
+}