jeo-code 0.12.18 → 0.12.21

package/CHANGELOG.md

@@ -9,6 +9,30 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+## [0.12.21] - 2026-11-04
+
+### Fixed
+- **Completion gate no longer blocks read-only turns** - a `bash` or `computer` call now counts as a workspace mutation only when a host-side snapshot of the session workspace taken right before and after the call differs (`.git`, `.jeo` and `node_modules` excluded; content changes to an already-modified file are detected). Read-only commands such as `date`, `ls -a`, `osascript` or opening a browser tab complete without a test run. A failed or over-cap snapshot still counts as a mutation, and `write`, `edit`, mutating `debug` actions and `job`/`monitor` starts are unchanged.
+- **Wrapped verification commands are recognized** - `cd <dir> && <verifier>`, `VAR=value` and `env -u NAME` prefixes, `timeout N`, `2>&1`, `uv run` / `poetry run` / `pipenv run`, absolute or relative paths to a verifier binary, and the `rtk` / `rtk test` wrappers now count as verification. Pipes, `;`, `||`, other redirections, command substitution and the existing mutating or non-executing flag exclusions are still rejected.
+- **Unverified state no longer leaks across turns** - an earlier turn's unverified mutation blocks completion of later turns only while a `/goal` is active; ordinary turns and messenger thread follow-ups are judged on their own evidence.
+- **Exhausted completions keep the answer** - when the gate rejects `done` after the maximum corrections, the result stays incomplete but shows the model's last answer under an `UNVERIFIED` marker with the gate reason, instead of replacing it. Messenger workers send that marked answer with a failure reaction (new `JEO_MESSENGER_UNVERIFIED` worker line) instead of the generic "The request could not be completed", and keep serving follow-ups. Route fallback, failover hints and the task tool's rate-limit reroute ignore rejected completions.
+
+## [0.12.20] - 2026-11-04
+
+The GitHub-only 0.12.19 release was not published to npm (its publish run failed a welcome-banner test); its changes, listed under [0.12.19], are included in this release.
+
+### Fixed
+- **Welcome banner test** — the resize test measured padded rows in UTF-16 units, so a wide (CJK or emoji) character in the latest changelog item made the publish gate fail even though the banner rendered correctly; it now uses the renderer's display-width measure.
+
+## [0.12.19] - 2026-11-04
+
+### Added
+- **Managed messenger runtime** — a Discord messenger profile no longer runs whatever `jeo` entry happened to execute setup. When `jeo` is a package install, `jeo messenger setup` pins a private copy of the published package under `<profile>/runtime/<version>` (jeopi's `runtime-<version>` layout) and points the launcher at it; `jeo update` provisions the new version there, rewrites the launcher, restarts the installed service and prunes runtimes older than the predecessor kept for rollback. `jeo messenger update [--config <file>]` performs the same refresh on demand, and `jeo update --json` reports `messengersRefreshed` when any profile is registered. Setup run from a source checkout or compiled binary keeps an external launcher that updates leave alone, and says so. Re-running setup without `--service` now restarts an already installed service so the new launcher takes effect.
+- **Messenger operator diagnostics** — `jeo messenger run` now logs each failed request to stderr with its stage (`prepare`, `reply`, `deliver`), an 8-character conversation id and the cause, plus bounded worker diagnostics (non-protocol worker stderr lines and abnormal exits). Users still receive only the generic failure text; message content and platform tokens never reach the log. Previously a worker that could not start (for example after the jeo checkout embedded in `run-discord.sh` was moved) produced only a `Failed` status in Discord and nothing in the service log.
+
+### Verified (live Discord, 2026-11-04)
+- A request-channel mention of the jeo-code bot failed with `The request could not be completed` while the launchd service ran from a deleted checkout (`error: Module not found ".../src/cli.ts"` reproduced locally). Re-running `jeo messenger setup --config ~/.jeo/discord/messenger.json --service --no-dm` from the live checkout regenerated the launcher, restarted `dev.jeo.messenger.discord`, and a follow-up mention returned the exact requested token in a new request thread with the hourglass-then-check reactions.
+
 ## [0.12.18] - 2026-11-04
 
 ### Changed
@@ -2700,7 +2724,10 @@ _Initial release._
 ### Added
 - Initial jeo-code agent and CLI.
 
-[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.18...HEAD
+[Unreleased]: https://github.com/akillness/jeo-code/compare/v0.12.21...HEAD
+[0.12.21]: https://github.com/akillness/jeo-code/releases/tag/v0.12.21
+[0.12.20]: https://github.com/akillness/jeo-code/releases/tag/v0.12.20
+[0.12.19]: https://github.com/akillness/jeo-code/releases/tag/v0.12.19
 [0.12.18]: https://github.com/akillness/jeo-code/releases/tag/v0.12.18
 [0.12.17]: https://github.com/akillness/jeo-code/releases/tag/v0.12.17
 [0.12.16]: https://github.com/akillness/jeo-code/releases/tag/v0.12.16

package/README.ja.md

@@ -447,10 +447,10 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.21]** (2026-11-04)
+- **[0.12.20]** (2026-11-04)
+- **[0.12.19]** (2026-11-04)
 - **[0.12.18]** (2026-11-04)
-- **[0.12.17]** (2026-11-04)
-- **[0.12.16]** (2026-11-04)
-- **[0.12.15]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -502,10 +502,10 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.21]** (2026-11-04)
+- **[0.12.20]** (2026-11-04)
+- **[0.12.19]** (2026-11-04)
 - **[0.12.18]** (2026-11-04)
-- **[0.12.17]** (2026-11-04)
-- **[0.12.16]** (2026-11-04)
-- **[0.12.15]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -491,10 +491,10 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.21]** (2026-11-04)
+- **[0.12.20]** (2026-11-04)
+- **[0.12.19]** (2026-11-04)
 - **[0.12.18]** (2026-11-04)
-- **[0.12.17]** (2026-11-04)
-- **[0.12.16]** (2026-11-04)
-- **[0.12.15]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -445,10 +445,10 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
 - **[Unreleased]**
+- **[0.12.21]** (2026-11-04)
+- **[0.12.20]** (2026-11-04)
+- **[0.12.19]** (2026-11-04)
 - **[0.12.18]** (2026-11-04)
-- **[0.12.17]** (2026-11-04)
-- **[0.12.16]** (2026-11-04)
-- **[0.12.15]** (2026-11-03)
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.18",
+  "version": "0.12.21",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
 

package/src/agent/AGENTS.md

@@ -29,7 +29,8 @@ The core runtime loop, tool registry, session management, and state persistence
 | `hooks.ts` | Brief description of purpose |
 | `json.ts` | Brief description of purpose |
 | `loop.ts` | The primary execution loop orchestrating model calls and tool execution |
-| `loop-guards.ts` | Intermediate-judgment classification (gjc ultragoal-guard parity): named `GuardState` taxonomy, `GUARD_LIMITS` thresholds, and pure classifiers (`isVerificationSignal`, `repeatHint`, `classifyDoneGate` — incl. `done_stale_verification` for a passing test/build that predates the last edit) consumed by `engine.ts` |
+| `loop-guards.ts` | Intermediate-judgment classification (gjc ultragoal-guard parity): named `GuardState` taxonomy, `GUARD_LIMITS` thresholds, and pure classifiers (`verifierCores`/`isVerificationSignal` — recognizes wrapped verifiers such as `cd x && bun test`, env/`timeout`/`uv run`/`rtk` prefixes and `2>&1`, never pipes or `;` — `repeatHint`, `classifyDoneGate` incl. `done_stale_verification`, and `formatRejectedCompletion`, which keeps the last candidate answer under an `UNVERIFIED` marker when corrections are exhausted) consumed by `engine.ts` |
+| `workspace-snapshot.ts` | Host-side workspace fingerprint (`snapshotWorkspace`, `defaultWorkspaceSnapshotter`, `workspaceSnapshotChanged`): bounded lstat walk excluding `.git`/`.jeo`/`node_modules`, racy content hash for files modified near the bracket anchor; the engine brackets non-verifier `bash` and state-affecting `computer` calls with it so only a real workspace change counts as a mutation (snapshot error or cap counts as a mutation) |
 | `memory.ts` | OKF concept-bundle memory: session distill, query-aware budget injection with a **hybrid reranker ported from memsearch** — `priorityOrder` fuses two ranked channels via `reciprocalRankFusion` (RRF, k=60): lexical IDF relevance (`buildCorpusStats`/`scoreConcept`, the sparse/BM25 channel so rare discriminating terms steer retrieval) ⊕ graph proximity (`graphProximityOrder`, the local dense/semantic-neighbour channel — a hub linked from multiple query hits surfaces even with no keyword of its own); all embedding-free, deterministic, atop the failure-first tier + pinned-invariant reserved budget. Plus mid-loop `recordFailedAttempt` capture, shared `upsertConceptFile` writer, legacy MEMORY.md migration (`migrateLegacyMemory`) + `JEO_MEMORY_LEGACY` rollback toggle |
 | `memory-okf.ts` | OKF v0.1 format layer: frontmatter parse/serialize, concept IDs, conformance validation |
 | `memory-graph.ts` | Concept cross-link graph: build/expand (1-hop search), broken-link-tolerant lint, optional graphify detection |

package/src/agent/engine.ts

@@ -32,7 +32,8 @@ import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSigna
 
 import { historyTokens, trimToolResultsInPlace, stripReasoningArtifactsInPlace } from "./compaction";
 import { jeoEnv } from "../util/env";
-import { GUARD_LIMITS, isVerificationSignal, verificationProducedEvidence, repeatHint, classifyDoneGate } from "./loop-guards";
+import { GUARD_LIMITS, isVerificationSignal, verificationProducedEvidence, repeatHint, classifyDoneGate, formatRejectedCompletion } from "./loop-guards";
+import { defaultWorkspaceSnapshotter, workspaceSnapshotChanged, type WorkspaceSnapshot, type WorkspaceSnapshotter } from "./workspace-snapshot";
 import { stripLeakedReasoningTags } from "../ai/think-tags";
 
 const MID_TASK_PROSE_RE =
@@ -407,6 +408,9 @@ export interface AgentLoopOptions {
    *  just the max-token ceiling. When unset the model-manager falls back to the global config. */
   reasoningEffort?: import("../ai/types").CallOptions["reasoningEffort"];
   tools?: Record<string, ToolHandler>;
+  /** Host-side workspace fingerprint used to decide whether a bash/computer call mutated the
+   *  workspace. Defaults to defaultWorkspaceSnapshotter; tests inject fakes. */
+  workspaceSnapshot?: WorkspaceSnapshotter;
   signal?: AbortSignal;
   events?: AgentLoopEvents;
   /** Step-budget overrides (gjc-style retry flow). `{ maxExtensions: 0 }` restores the
@@ -461,6 +465,9 @@ export interface AgentLoopResult {
    *  recover from (repeated/cycled/consecutively-failing calls). Lets the caller
    *  capture the stall into failure memory; `undefined` for done/budget/cancelled. */
   stopClass?: "consecutive_failure" | "cycle" | "repeat";
+  /** True when the turn ended because completion was rejected MAX_DONE_CORRECTIONS times; doneReason then
+   *  carries the last candidate answer under the UNVERIFIED marker. Never set together with done:true. */
+  completionRejected?: boolean;
 }
 
 
@@ -538,6 +545,25 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     history.unshift({ role: "system", content: opts.systemPrompt });
   }
   const tools = opts.tools ?? DEFAULT_TOOLS;
+  const snapshotter: WorkspaceSnapshotter = opts.workspaceSnapshot ?? defaultWorkspaceSnapshotter;
+  // Turn-scoped memo: once the workspace is over the snapshot cap, gated calls count as
+  // mutations without re-walking a tree that is known to be too large.
+  let snapshotCapped = false;
+  const takeSnapshot = async (racySinceMs?: number): Promise<WorkspaceSnapshot> => {
+    if (snapshotCapped) return { ok: false, reason: "cap", detail: "workspace exceeded the snapshot cap earlier this turn" };
+    try {
+      const snap = await snapshotter(cwd, racySinceMs);
+      if (!snap.ok && snap.reason === "cap") snapshotCapped = true;
+      return snap;
+    } catch (err) {
+      return { ok: false, reason: "error", detail: err instanceof Error ? err.message : String(err) };
+    }
+  };
+  // bash/computer calls whose mutation status is decided by a workspace diff. Recognized
+  // verifiers are never mutations, and observe-only computer actions are read-only.
+  const snapshotGated = (tool: string, args: Record<string, any> | undefined): boolean =>
+    (tool === "bash" && !isVerificationSignal(String(args?.command ?? args?.cmd ?? ""))) ||
+    (tool === "computer" && computerActionMayAffectState(args));
   const sandbox = currentSandboxExecution();
   const parentTools: Record<string, true> = { task: true, subagent: true, irc: true, todo: true, sandbox_request: true };
   const maxSteps = opts.maxSteps ?? 15;
@@ -663,6 +689,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
   let verificationCycles = 0;
   let completionGraceUsed = false;
   let doneCorrections = 0;
+  // Most recent non-empty completion candidate, kept so an exhausted gate still shows it.
+  let lastCompletionCandidate = "";
   // F1 (round 4): the run-command of the most recent post-turn hook FAILURE whose
   // diagnostics the model saw but has not yet resolved (a later clean hook run
   // clears it). The done guard treats this as "verification missing" — the hook
@@ -1070,6 +1098,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
         (hasTools && looksLikeMidTaskProse(trimmed));
       if (trimmed && (parseFailures > MAX_PARSE_BOUNCES || (!trimmed.includes("{") && !midTurnInProgress))) {
         const candidateReason = stripLeakedReasoningTags(trimmed) || trimmed;
+        if (candidateReason.trim()) lastCompletionCandidate = candidateReason;
         if (parseFailures <= MAX_PARSE_BOUNCES && ev.onBeforeDone) {
           const preCheck = await ev.onBeforeDone(candidateReason, {
             sawMutation,
@@ -1078,7 +1107,12 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           });
           if (preCheck) {
             if (doneCorrections >= GUARD_LIMITS.MAX_DONE_CORRECTIONS) {
-              return finish({ done: false, steps: step, doneReason: `Stopped: completion rejected after ${doneCorrections} corrections. ${preCheck}` });
+              return finish({
+                done: false,
+                steps: step,
+                completionRejected: true,
+                doneReason: formatRejectedCompletion(lastCompletionCandidate, doneCorrections, preCheck),
+              });
             }
             doneCorrections++;
             ev.onNotice?.(`done deferred — completion correction ${doneCorrections}/${GUARD_LIMITS.MAX_DONE_CORRECTIONS}`);
@@ -1169,12 +1203,19 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
         sawVerification,
         verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
       };
+      const candidate = stripLeakedReasoningTags(String(toolCalls[0].arguments?.reason ?? ""));
+      if (candidate.trim()) lastCompletionCandidate = candidate;
       const doneGate = classifyDoneGate({ ...evidence, pendingHookFailure });
       const nudge = await ev.onBeforeDone?.((toolCalls[0].arguments?.reason as string) ?? "", evidence);
       const rejection = [doneGate.block ? doneGate.message : "", nudge].filter(Boolean).join("\n\n");
       if (rejection) {
         if (doneCorrections >= GUARD_LIMITS.MAX_DONE_CORRECTIONS) {
-          return finish({ done: false, steps: step, doneReason: `Stopped: completion rejected after ${doneCorrections} corrections. ${rejection}` });
+          return finish({
+            done: false,
+            steps: step,
+            completionRejected: true,
+            doneReason: formatRejectedCompletion(lastCompletionCandidate, doneCorrections, rejection),
+          });
         }
         doneCorrections++;
         pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
@@ -1338,6 +1379,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
             success = false;
             output = preHookResult.error + (preHookResult.output ? `\n${preHookResult.output}` : "");
           } else {
+            // Taken after pre-tool hooks so hook writes are never attributed to the call.
+            const before = snapshotGated(tool, args) ? await takeSnapshot() : undefined;
             try {
               const onProgress = ev.onToolProgress ? (partial: string) => ev.onToolProgress!(tool, partial) : undefined;
               const sandboxedHandler = sandbox && !Object.hasOwn(parentTools, tool) && !SANDBOX_MEDIATED_TOOLS.has(handler)
@@ -1362,6 +1405,12 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
                 ((tool === "monitor" || tool === "job") && String(args?.action ?? "").trim().toLowerCase() === "start");
               if (explicitSignal || knownMutatingCall) mutationMayHaveOccurred = true;
             }
+            if (before) {
+              // bash/computer: the workspace diff is the sole mutation authority (overrides
+              // handler flags and the catch heuristic). Both sides share one racy anchor so
+              // an unchanged recently-modified file is hashed on both sides or neither.
+              mutationMayHaveOccurred = before.ok ? workspaceSnapshotChanged(before, await takeSnapshot(before.startedAtMs)) : true;
+            }
           }
         }
       }
@@ -1528,6 +1577,9 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // mutation evidence before it, but anything after that verification remains
     // stale. Verification commands are shell calls, so do not let a wrapper's
     // mutationMayHaveOccurred flag turn the verifier itself into a later mutation.
+    // Non-verifier bash and state-changing computer calls carry an explicit
+    // mutationMayHaveOccurred from the workspace snapshot bracket in executeTool,
+    // which flows through the structured-mutation branch below.
     for (let i = 0; i < toolCalls.length; i++) {
       if (!results[i].executed) continue;
       const t = toolCalls[i].tool;
@@ -1573,10 +1625,6 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       } else if (t === "debug" && MUTATING_DEBUG_ACTIONS[String(toolCalls[i].arguments?.action ?? "")] === true) {
         sawMutation = true;
         lastMutationSeq = ++mutVerSeq;
-      } else if (t === "computer" && computerActionMayAffectState(toolCalls[i].arguments)) {
-        // Failed UI actions may have partially changed external state.
-        sawMutation = true;
-        lastMutationSeq = ++mutVerSeq;
       } else if (t === "monitor" && String(toolCalls[i].arguments?.action ?? "").trim().toLowerCase() === "start") {
         // Starting a background monitor can mutate the workspace asynchronously;
         // read-only monitor controls (list/tail/await/cancel) do not invalidate verification.
@@ -1587,10 +1635,6 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
         // read-only job controls (list/tail/await/cancel) do not invalidate verification.
         sawMutation = true;
         lastMutationSeq = ++mutVerSeq;
-      } else if (t === "bash") {
-        // Even simple commands can run shell startup hooks or inherited functions.
-        sawMutation = true;
-        lastMutationSeq = ++mutVerSeq;
       }
     }
     await ev.onEvidence?.({

package/src/agent/loop-guards.ts

@@ -77,40 +77,120 @@ const NONEXECUTING_VERIFY_FLAG_RE = /(?:^|\s)(?:--help|-h|--version|-version|--l
 const MUTATING_VERIFY_FLAG_RE = /(?:^|\s)(?:--fix|--write|--update|-u|--update[-_]snapshots?|--updateSnapshots?|--snapshot[-_]updates?)(?=$|\s|=)/i;
 const MUTATING_VERIFY_SCRIPT_RE = /^(?:bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?[\w-]+:[^\s]*(?:fix|update|write|deploy|publish)[^\s]*/i;
 
-function isSingleVerificationSegment(segment: string): boolean {
-  const command = segment.trim();
-  if (!command) return false;
-  const shortNoOp = /^(?:(?:npx|bunx|bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?)?tsc\b.*(?:^|\s)-[vV](?=\s|$)/.test(command)
-    || /^(?:make|just|go)\s+.*(?:^|\s)-n(?=\s|$)/.test(command);
-  return !shortNoOp && !/[;&|<>`$(){}\n\r]/.test(command) && VERIFY_SIGNAL_RE.test(command) && !NONEXECUTING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_FLAG_RE.test(command) && !MUTATING_VERIFY_SCRIPT_RE.test(command);
+// ── Verifier command grammar ──────────────────────────────────────────────────
+// command    := segment ( "&&" segment )*   after removing every standalone `2>&1` token
+// segment[0] := cdSeg | verifierSeg         cdSeg only as the first segment, and only when >=1 segment follows
+// segment[i] := verifierSeg                 (i >= 1)
+// verifierSeg:= prefix* core                prefixes: `NAME=VALUE`, `env [-u NAME]... [NAME=VALUE]...`,
+//                                           `timeout N[s|m]`, `uv|poetry|pipenv run`, `rtk [test]`
+// core       := first `/`-bearing token replaced by its basename, then VERIFY_SIGNAL_RE with no
+//               non-executing / mutating flag, no mutating script, and no short no-op form.
+// Only plain tokens are accepted: `$`, backticks, quotes and parentheses never match the token classes
+// and are rejected by the global metacharacter check. Every prefix propagates the verifier's exit code.
+const STDERR_MERGE_RE = /(^|\s)2>&1(?=\s|$)/g;
+const ASSIGN_PREFIX_RE = /^([A-Za-z_][A-Za-z0-9_]*)=[A-Za-z0-9_./:@+,=%-]*\s+/;
+const ENV_PREFIX_RE = /^env(?:\s+-u\s+[A-Za-z_][A-Za-z0-9_]*)*(?:\s+([A-Za-z_][A-Za-z0-9_]*)=[A-Za-z0-9_./:@+,=%-]*)*\s+/;
+const TIMEOUT_PREFIX_RE = /^timeout\s+\d+[sm]?\s+/;
+const RUNNER_PREFIX_RE = /^(?:uv|poetry|pipenv)\s+run\s+/;
+const RTK_PREFIX_RE = /^rtk\s+(?:test\s+)?/;
+const CD_SEGMENT_RE = /^cd\s+[A-Za-z0-9_./:@+,=~-]+$/;
+const BINARY_PATH_RE = /^([A-Za-z0-9_.@+-]*\/[A-Za-z0-9_./@+-]*)(?=\s|$)/;
+/** Env names that are the env-form of an update/snapshot flag (parity with MUTATING_VERIFY_FLAG_RE). */
+const MUTATING_VERIFY_ENV_RE = /UPDATE|SNAPSHOT|GOLDEN/i;
+const ENV_ASSIGNMENT_NAME_RE = /([A-Za-z_][A-Za-z0-9_]*)=/g;
+
+/**
+ * Normalized verifier invocations (cores) of a command, or null when the command is not a
+ * pure recognized verification. Wrapper prefixes and a leading `cd <path> &&` are stripped,
+ * so flag/script exclusions are judged on the verifier itself, never on the wrappers.
+ */
+export function verifierCores(cmd: string): string[] | null {
+  const command = cmd.trim().replace(STDERR_MERGE_RE, "$1").trim();
+  if (!command) return null;
+  // Pipes, `;`, `||`, redirections, substitution, grouping and multi-line scripts.
+  if (/[;&|<>`$(){}\n\r]/.test(command.replace(/&&/g, " "))) return null;
+  const segments = command.split("&&").map(s => s.trim());
+  if (segments.some(s => !s)) return null;
+  const start = segments.length > 1 && CD_SEGMENT_RE.test(segments[0]) ? 1 : 0;
+  const cores: string[] = [];
+  for (const segment of segments.slice(start)) {
+    const core = verifierCore(segment);
+    if (!core) return null;
+    cores.push(core);
+  }
+  return cores.length ? cores : null;
+}
+
+function verifierCore(segment: string): string | null {
+  let rest = segment;
+  for (;;) { // terminates: every successful match strictly shortens `rest`
+    const assign = ASSIGN_PREFIX_RE.exec(rest);
+    if (assign) {
+      if (MUTATING_VERIFY_ENV_RE.test(assign[1])) return null;
+      rest = rest.slice(assign[0].length);
+      continue;
+    }
+    const env = ENV_PREFIX_RE.exec(rest);
+    if (env) {
+      if ([...env[0].matchAll(ENV_ASSIGNMENT_NAME_RE)].some(m => MUTATING_VERIFY_ENV_RE.test(m[1]))) return null;
+      rest = rest.slice(env[0].length);
+      continue;
+    }
+    const other = TIMEOUT_PREFIX_RE.exec(rest) ?? RUNNER_PREFIX_RE.exec(rest) ?? RTK_PREFIX_RE.exec(rest);
+    if (other) {
+      rest = rest.slice(other[0].length);
+      continue;
+    }
+    break;
+  }
+  const bin = BINARY_PATH_RE.exec(rest);
+  if (bin) rest = bin[1].slice(bin[1].lastIndexOf("/") + 1) + rest.slice(bin[1].length);
+  const shortNoOp = /^(?:(?:npx|bunx|bun|npm|pnpm|yarn)\s+(?:(?:run|exec|x|dlx)\s+)?)?tsc\b.*(?:^|\s)-[vV](?=\s|$)/.test(rest)
+    || /^(?:make|just|go)\s+.*(?:^|\s)-n(?=\s|$)/.test(rest);
+  return !shortNoOp && VERIFY_SIGNAL_RE.test(rest) && !NONEXECUTING_VERIFY_FLAG_RE.test(rest)
+    && !MUTATING_VERIFY_FLAG_RE.test(rest) && !MUTATING_VERIFY_SCRIPT_RE.test(rest) ? rest : null;
 }
 
 /**
- * True only when the command itself is a recognized verifier invocation (or a
- * pure `&&` chain where every segment is a recognized verifier invocation). Output
- * is never evidence: arbitrary commands can print words such as "tests passed".
+ * True only when the command itself is a recognized verifier invocation (or a pure `&&`
+ * chain of them, optionally led by `cd <path> &&` and wrapped in exit-code-propagating
+ * prefixes — see {@link verifierCores}). Output is never evidence: arbitrary commands can
+ * print words such as "tests passed".
  */
 export function isVerificationSignal(cmd: string): boolean {
-  const command = cmd.trim();
-  if (!command) return false;
-  const withoutAndChain = command.replace(/&&/g, " ");
-  if (/[;&|<>`$(){}\n\r]/.test(withoutAndChain)) return false;
-  const segments = command.split("&&").map(s => s.trim());
-  return segments.length > 0 && segments.every(isSingleVerificationSegment);
+  return verifierCores(cmd) !== null;
 }
 
-/** Require test-run evidence for Go and Cargo's recognized text output. */
+/**
+ * Require test-run evidence for Go and Cargo's recognized text output. Judged on the
+ * verifier cores, so a wrapped `timeout 60 go test ./...` or `cd x && cargo test` still
+ * needs real test evidence.
+ */
 export function verificationProducedEvidence(cmd: string, output: string): boolean {
-  if (/^go\s+test(?:\s|$)/.test(cmd.trim())) {
+  const cores = verifierCores(cmd) ?? [cmd.trim()];
+  if (cores.some(c => /^go\s+test(?:\s|$)/.test(c))) {
     const summaries = output.split(/\r?\n/).filter(line => /^(?:ok|\?)\s+/.test(line));
-    return summaries.some(line => !/\[no tests to run\]|\[no test files\]/i.test(line));
-  }
-  if (/^cargo\s+test(?:\s|$)/.test(cmd.trim())) {
-    return [...output.matchAll(/test result: ok\.\s+(\d+) passed/g)].some(match => Number(match[1]) > 0);
+    if (!summaries.some(line => !/\[no tests to run\]|\[no test files\]/i.test(line))) return false;
   }
+  if (cores.some(c => /^cargo\s+test(?:\s|$)/.test(c))
+    && ![...output.matchAll(/test result: ok\.\s+(\d+) passed/g)].some(match => Number(match[1]) > 0)) return false;
   return true;
 }
 
+/** Marker that prefixes a candidate answer the completion gate never accepted. */
+export const UNVERIFIED_MARKER = "UNVERIFIED";
+
+/**
+ * Result text when completion was rejected GUARD_LIMITS.MAX_DONE_CORRECTIONS times. Keeps the
+ * model's last candidate answer, never presents it as accepted, and keeps the gate reason.
+ */
+export function formatRejectedCompletion(candidate: string, corrections: number, rejection: string): string {
+  const stop = `Stopped: completion rejected after ${corrections} corrections. ${rejection}`;
+  const answer = candidate.trim();
+  if (!answer) return stop;
+  return `${UNVERIFIED_MARKER} - the completion gate did not accept this answer; treat it as unconfirmed.\n\n${answer}\n\n${stop}`;
+}
+
 /**
  * Result-aware repeat nudge: tells the model WHY repeating the call won't help and what
  * to try instead, tailored to the repeated tool and its last actual result. When the