jeo-code 0.12.20 → 0.12.21

package/src/agent/task-tool.ts

@@ -570,7 +570,10 @@ export async function runSubagentOnce(
   // `routing.enabled` off = the model is FIXED: no failover reroute at all (the
   // engine bail predicates above are withheld too, so a 429 rides its normal
   // backoff ladder instead of bailing early with nowhere to go).
-  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {    const rateLimited = !result.done && isRateLimitError(new Error(result.doneReason ?? ""));
+  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {
+    // An exhausted completion gate puts the model's own candidate answer in doneReason;
+    // its text (e.g. "HTTP 429") is not a provider failure and must never reroute.
+    const rateLimited = !result.done && !result.completionRejected && isRateLimitError(new Error(result.doneReason ?? ""));
     const safetyBail = !result.done && !rateLimited && isSafetyFallbackBail(result.doneReason);
     if (!rateLimited && !safetyBail) break;
     const previousModel = activeModel;

package/src/agent/workspace-snapshot.ts

@@ -0,0 +1,209 @@
+/**
+ * Host-side workspace fingerprint. The engine brackets bash/computer calls with two snapshots and
+ * counts the call as a mutation only when they differ (workspaceSnapshotChanged). Failures and caps
+ * are reported as `ok:false`, which always counts as a mutation (safe side).
+ *
+ * Entry strings folded into an order-independent digest:
+ * - directory: `d:<rel>` (presence only; directory mtimes are ignored so creating an excluded
+ *   child such as `.jeo/` or `node_modules/` never counts)
+ * - file/link/other: `<f|l|o>:<rel>:<size>:<mtimeNs>:<ctimeNs>:<ino>` from lstat (never followed)
+ *   - link: `:t<readlink target>`
+ *   - regular file with mtime >= anchor - racyWindowMs: `:h<wyhash(content)>` (racy-clean guard
+ *     against coarse timestamps; the after-snapshot reuses the before-snapshot's anchor)
+ *   - FIFO/socket/device: stat only, never opened
+ */
+import * as fs from "node:fs/promises";
+import { constants } from "node:fs";
+import type { BigIntStats, Dirent } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import * as path from "node:path";
+
+export interface WorkspaceSnapshotLimits {
+  /** Max fingerprinted entries (files+dirs+links) before giving up (counts as a mutation). */
+  maxEntries: number;
+  /** Wall-clock budget per snapshot (ms). */
+  maxMs: number;
+  /** Files with mtime within this window of the snapshot start are content-hashed too. */
+  racyWindowMs: number;
+  /** Per-file and per-snapshot byte caps for racy content hashing. */
+  racyMaxFileBytes: number;
+  racyMaxTotalBytes: number;
+}
+
+export const WORKSPACE_SNAPSHOT_LIMITS: Readonly<WorkspaceSnapshotLimits> = Object.freeze({
+  maxEntries: 50_000,
+  maxMs: 2_000,
+  racyWindowMs: 2_000,
+  racyMaxFileBytes: 1024 * 1024,
+  racyMaxTotalBytes: 8 * 1024 * 1024,
+});
+
+/** Directory NAMES skipped at any depth (A2): exactly these three. */
+export const WORKSPACE_SNAPSHOT_EXCLUDED_DIRS: ReadonlySet<string> = new Set([".git", ".jeo", "node_modules"]);
+
+export type WorkspaceSnapshot =
+  | { ok: true; digest: bigint; entries: number; elapsedMs: number; startedAtMs: number }
+  | { ok: false; reason: "error" | "cap"; detail: string };
+
+/** `racySinceMs`: anchor for the racy content-hash predicate. The engine passes the BEFORE snapshot's
+ *  `startedAtMs` to the AFTER snapshot so both sides hash exactly the same set of unchanged files. */
+export type WorkspaceSnapshotter = (cwd: string, racySinceMs?: number) => Promise<WorkspaceSnapshot>;
+
+type Failure = Extract<WorkspaceSnapshot, { ok: false }>;
+
+/** Carries the first failure out of the concurrent walk. */
+class SnapshotStop extends Error {
+  constructor(readonly result: Failure) { super(result.detail); }
+}
+
+const CONCURRENCY = 64;
+const DIGEST_MASK = 0xffff_ffff_ffff_ffffn;
+/** Never follow a link swapped in after lstat, and never block on a FIFO swapped in after lstat. */
+const RACY_OPEN_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+
+const errorMessage = (error: unknown): string => error instanceof Error ? error.message : String(error);
+/** A child removed mid-walk: skipped, since a real deletion still changes the digest. */
+const vanished = (error: unknown): boolean => {
+  const code = (error as NodeJS.ErrnoException | undefined)?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+};
+const stop = (reason: Failure["reason"], detail: string): never => { throw new SnapshotStop({ ok: false, reason, detail }); };
+
+async function chunked<T>(items: readonly T[], run: (item: T) => Promise<void>): Promise<void> {
+  for (let i = 0; i < items.length; i += CONCURRENCY) await Promise.all(items.slice(i, i + CONCURRENCY).map(run));
+}
+
+interface Dir { rel: string; abs: string }
+interface Leaf extends Dir { dirent: Dirent }
+
+export async function snapshotWorkspace(
+  cwd: string,
+  limits: WorkspaceSnapshotLimits = WORKSPACE_SNAPSHOT_LIMITS,
+  racySinceMs?: number,
+): Promise<WorkspaceSnapshot> {
+  const startedAtMs = Date.now();
+  const startedAt = performance.now();
+  const anchorMs = racySinceMs !== undefined && Number.isFinite(racySinceMs) ? racySinceMs : startedAtMs;
+  const racyThresholdNs = BigInt(Math.floor(anchorMs - limits.racyWindowMs)) * 1_000_000n;
+  let digest = 0n;
+  let entries = 0;
+  let racyBytes = 0;
+
+  const record = (entry: string): void => { digest = (digest + Bun.hash.wyhash(entry)) & DIGEST_MASK; };
+  const checkCaps = (): void => {
+    if (entries > limits.maxEntries) stop("cap", `workspace has more than ${limits.maxEntries} entries`);
+    if (performance.now() - startedAt > limits.maxMs) stop("cap", `workspace snapshot exceeded ${limits.maxMs} ms`);
+  };
+
+  /** Bounded read of a regular file's content; `null` when it vanished before it could be read. */
+  const racyHash = async (leaf: Leaf, stat: BigIntStats): Promise<bigint | null> => {
+    const size = Number(stat.size);
+    if (size > limits.racyMaxFileBytes) stop("error", `racy file too large: ${leaf.rel} (${size} bytes)`);
+    racyBytes += size;
+    if (racyBytes > limits.racyMaxTotalBytes) stop("error", `racy files too large: more than ${limits.racyMaxTotalBytes} bytes`);
+    let handle: FileHandle;
+    try { handle = await fs.open(leaf.abs, RACY_OPEN_FLAGS); }
+    catch (error) { if (vanished(error)) return null; return stop("error", `cannot open ${leaf.rel}: ${errorMessage(error)}`); }
+    try {
+      const opened = await handle.stat({ bigint: true });
+      if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev) stop("error", `file changed during workspace snapshot: ${leaf.rel}`);
+      // One spare byte detects growth after lstat without reading past the cap.
+      const buffer = new Uint8Array(size + 1);
+      let read = 0;
+      for (;;) {
+        const { bytesRead } = await handle.read(buffer, read, buffer.length - read, read);
+        if (bytesRead === 0) break;
+        read += bytesRead;
+        if (read > size) stop("error", `file changed during workspace snapshot: ${leaf.rel}`);
+      }
+      return Bun.hash.wyhash(buffer.subarray(0, read));
+    } finally {
+      await handle.close().catch(() => {});
+    }
+  };
+
+  const fingerprint = async (leaf: Leaf, queue: Dir[]): Promise<void> => {
+    let stat: BigIntStats;
+    try { stat = await fs.lstat(leaf.abs, { bigint: true }); }
+    catch (error) {
+      if (vanished(error)) { entries -= 1; return; }
+      return stop("error", `cannot stat ${leaf.rel}: ${errorMessage(error)}`);
+    }
+    if (stat.isDirectory()) {
+      // Unreported or raced dirent type: a real directory is never fingerprinted by metadata.
+      if (WORKSPACE_SNAPSHOT_EXCLUDED_DIRS.has(leaf.dirent.name)) { entries -= 1; return; }
+      record(`d:${leaf.rel}`);
+      queue.push(leaf);
+      return;
+    }
+    const kind = stat.isSymbolicLink() ? "l" : stat.isFile() ? "f" : "o";
+    let entry = `${kind}:${leaf.rel}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}:${stat.ino}`;
+    if (kind === "l") {
+      try { entry += `:t${await fs.readlink(leaf.abs)}`; }
+      catch (error) {
+        if (vanished(error)) { entries -= 1; return; }
+        return stop("error", `cannot read link ${leaf.rel}: ${errorMessage(error)}`);
+      }
+    } else if (kind === "f" && leaf.dirent.isFile() && stat.mtimeNs >= racyThresholdNs) {
+      const hash = await racyHash(leaf, stat);
+      if (hash === null) { entries -= 1; return; }
+      entry += `:h${hash}`;
+    }
+    record(entry);
+  };
+
+  const list = async (dir: Dir, next: Dir[], leaves: Leaf[]): Promise<void> => {
+    let dirents: Dirent[];
+    try { dirents = await fs.readdir(dir.abs, { withFileTypes: true }); }
+    catch (error) {
+      if (dir.rel !== "" && vanished(error)) return;
+      return stop("error", `cannot read directory ${dir.rel || "."}: ${errorMessage(error)}`);
+    }
+    for (const dirent of dirents) {
+      const rel = dir.rel ? `${dir.rel}/${dirent.name}` : dirent.name;
+      const child: Leaf = { rel, abs: path.join(dir.abs, dirent.name), dirent };
+      if (dirent.isDirectory()) {
+        if (WORKSPACE_SNAPSHOT_EXCLUDED_DIRS.has(dirent.name)) continue;
+        entries += 1;
+        record(`d:${rel}`);
+        next.push(child);
+      } else {
+        entries += 1;
+        leaves.push(child);
+      }
+    }
+    checkCaps();
+  };
+
+  try {
+    let root: BigIntStats;
+    try { root = await fs.stat(cwd, { bigint: true }); }
+    catch (error) { return { ok: false, reason: "error", detail: `cannot stat workspace root: ${errorMessage(error)}` }; }
+    if (!root.isDirectory()) return { ok: false, reason: "error", detail: "workspace root is not a directory" };
+
+    let level: Dir[] = [{ rel: "", abs: cwd }];
+    while (level.length) {
+      const next: Dir[] = [];
+      for (let i = 0; i < level.length; i += CONCURRENCY) {
+        const leaves: Leaf[] = [];
+        await Promise.all(level.slice(i, i + CONCURRENCY).map(dir => list(dir, next, leaves)));
+        await chunked(leaves, leaf => fingerprint(leaf, next));
+        checkCaps();
+      }
+      level = next;
+    }
+    return { ok: true, digest, entries, elapsedMs: performance.now() - startedAt, startedAtMs };
+  } catch (error) {
+    if (error instanceof SnapshotStop) return error.result;
+    return { ok: false, reason: "error", detail: errorMessage(error) };
+  }
+}
+
+/** Production default: default limits, forwards the racy anchor. */
+export const defaultWorkspaceSnapshotter: WorkspaceSnapshotter = (cwd, since) => snapshotWorkspace(cwd, WORKSPACE_SNAPSHOT_LIMITS, since);
+
+/** Pure: true when either side failed, or digest/entry count differ. */
+export function workspaceSnapshotChanged(before: WorkspaceSnapshot, after: WorkspaceSnapshot): boolean {
+  if (!before.ok || !after.ok) return true;
+  return before.digest !== after.digest || before.entries !== after.entries;
+}

package/src/commands/launch.ts

@@ -1229,7 +1229,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
     // injected SKILL.md is NOT user-authored and the [skill] card already names it,
     // gjc-style); a string → show that compact label instead of the raw input.
     opts?: { userCard?: string | null; signal?: AbortSignal; trustedContext?: string },
-  ): Promise<{ done: boolean; steps: number; reply: string; rendered: boolean; usage: string }> => {
+  ): Promise<{ done: boolean; steps: number; reply: string; rendered: boolean; usage: string; unverified: boolean }> => {
     opts?.signal?.throwIfAborted();
     if (currentSandboxExecution() && sessionId !== sandboxTranscriptId) throw new Error("SESSION_MISMATCH: start a new launch for the selected transcript; sandbox grants cannot cross sessions");
     let busyDraftHasPaste = false;
@@ -1370,7 +1370,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         sessionNotifyEndpoint?.sendTurnStream(notifyRedact ? "[redacted]" : reply);
         cliTui?.events().onStep?.(result.steps);
         cliTui?.finish(reply);
-        return { done: true, steps: result.steps, reply, rendered: !!cliTui, usage };
+        return { done: true, steps: result.steps, reply, rendered: !!cliTui, usage, unverified: false };
       } catch (error) {
         if (oneShot) {
           process.exitCode = error instanceof AgyCliError
@@ -1883,13 +1883,24 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         // Todos checklist used to end a finished turn stuck at "✓0 ◐1 ·4 / 5"
         // because nothing ever forced the model to update item statuses).
         let turnTodos: { title: string; status: string }[] = [];
+        // Evidence from earlier engine runs of THIS turn always counts; an earlier turn's
+        // unverified mutation counts only while a goal is active (valid or corrupt goal file).
+        let turnPendingMutation = false;
+        try {
+          turnPendingMutation = (await readGoalState(cwd)) !== null && pendingMutationVerification;
+        } catch (error) {
+          if (!(error instanceof GoalStateCorruptError)) throw error;
+          turnPendingMutation = pendingMutationVerification;
+        }
         const onEvidence = async (
           evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean },
         ): Promise<void> => {
           if (evidence.sawVerification && !evidence.verificationStale) {
             pendingMutationVerification = false;
+            turnPendingMutation = false;
           } else if (evidence.sawMutation) {
             pendingMutationVerification = true;
+            turnPendingMutation = true;
           }
 
           let goalState: GoalState | null;
@@ -1965,7 +1976,8 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
             }
             throw error;
           }
-          if ((pendingMutationVerification || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
+          const carriedPending = turnPendingMutation || (goalState !== null && pendingMutationVerification);
+          if ((carriedPending || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
             return (
               `Cannot finish: a workspace mutation from this session still lacks a successful, non-stale verification. ` +
               `Run a relevant test/build/typecheck/lint after the last change (e.g. 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done again.`
@@ -2261,8 +2273,9 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
 
           // A loop guard is a local safety boundary, not a provider failure. A
           // fresh loop on an equivalent model loses the guard state and could
-          // re-execute a previously skipped mutation.
-          const routedFailureReason = !result.done && !result.stopClass
+          // re-execute a previously skipped mutation. A rejected completion carries
+          // the model's own answer in doneReason, which must not be read as a provider error.
+          const routedFailureReason = !result.done && !result.stopClass && !result.completionRejected
             ? routeFailureReason(result.doneReason)
             : null;
           if (!routedFailureReason) break;
@@ -2361,7 +2374,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         : `(reached the ${result.steps}-step limit without signaling done)`);
     // Routing off = the model is fixed and nothing fails over. When the turn died on
     // an account-level limit, say so and name the one switch that re-enables failover.
-    const failoverHint = !routingEnabled && !result.done && (() => {
+    const failoverHint = !routingEnabled && !result.done && !result.completionRejected && (() => {
       const failure = new Error(result.doneReason ?? "");
       return isRateLimitError(failure) || isUsageLimitError(failure);
     })()
@@ -2469,7 +2482,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
     }
 
     lastActiveModel = activeModel;
-    return { done: result.done, steps: result.steps, reply, rendered: !!tui, usage };
+    return { done: result.done, steps: result.steps, reply, rendered: !!tui, usage, unverified: result.completionRejected === true };
     } finally {
       preflightHarness?.dispose();
       interactiveTurnActive = false;
@@ -2514,9 +2527,12 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
             try {
               const message = JSON.parse(line);
               if (typeof message !== "string" || !message.trim()) throw new Error("Invalid messenger request");
-              const { done, reply } = await runTurn(message, false);
-              if (!done) throw new Error("Messenger agent turn did not complete");
-              console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+              const { done, reply, unverified } = await runTurn(message, false);
+              if (done) console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+              // The turn ended in a controlled state with an UNVERIFIED-marked answer:
+              // deliver it as a failure and keep serving this conversation's follow-ups.
+              else if (unverified && reply.trim()) console.log(`JEO_MESSENGER_UNVERIFIED ${JSON.stringify(reply)}`);
+              else throw new Error("Messenger agent turn did not complete");
             } catch {
               console.log("JEO_MESSENGER_ERROR");
               break;
@@ -2752,10 +2768,13 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         return;
       }
       try {
-        const { done, reply, rendered, usage } = await runTurn(messageContent, shouldUseOneShotTui(flags.noTui));
+        const { done, reply, rendered, usage, unverified } = await runTurn(messageContent, shouldUseOneShotTui(flags.noTui));
         if (flags.literalPrompt) {
-          if (!done) throw new Error("Messenger agent turn did not complete");
-          console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+          if (done) console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+          else if (unverified && reply.trim()) {
+            console.log(`JEO_MESSENGER_UNVERIFIED ${JSON.stringify(reply)}`);
+            process.exitCode = 1;
+          } else throw new Error("Messenger agent turn did not complete");
         } else if (!rendered) console.log(stripMarkdown(renderMarkdownTables(reply)) + usage);
         else if (usage) console.log(usage.trim());
       } catch (err) {

package/src/messenger/gateway.ts

@@ -7,7 +7,7 @@ import type {
 	MessengerMessage,
 	MessengerReply,
 } from "./types";
-import { MessengerFatalError } from "./types";
+import { MessengerFatalError, MessengerUnverifiedReplyError } from "./types";
 
 const MAX_MESSAGE_LENGTH = 32_000;
 const MAX_QUEUED_MESSAGES = 100;
@@ -276,8 +276,9 @@ export interface MessengerGatewayOptions {
 	/** Authenticated human controls bypass model queues, including busy sessions. */
 	sandboxControl?: (message: MessengerMessage, signal: AbortSignal) => Promise<{ handled: boolean; output: string }>;
 	/**
-	 * Operator log for a request that failed before or during delivery. Users only ever see the generic failure
-	 * text, so this is the one place the cause is observable; it receives the conversation, never message text.
+	 * Operator log for a request that failed before or during delivery. Users see the generic failure text, except
+	 * an unverified completion, whose marked answer is delivered; this is the one place the cause is observable,
+	 * and it receives the conversation, never message text.
 	 */
 	onRequestError?: (message: MessengerMessage, error: unknown, stage: "prepare" | "reply" | "deliver") => void;
 }
@@ -372,9 +373,11 @@ export function createMessengerGateway(
 				}
 				if (signal.aborted) return;
 				reportError(message, error, "reply");
-				text = error instanceof DiscordModelSelectionError
-					? "Discord could not verify a model. Ask the operator to configure an explicit Discord model, check provider credentials and live model discovery, then restart the messenger service."
-					: "The request could not be completed. Please try again.";
+				text = error instanceof MessengerUnverifiedReplyError
+					? error.reply
+					: error instanceof DiscordModelSelectionError
+						? "Discord could not verify a model. Ask the operator to configure an explicit Discord model, check provider credentials and live model discovery, then restart the messenger service."
+						: "The request could not be completed. Please try again.";
 			}
 			if (!signal.aborted && text.trim()) {
 				// A failed send may already have delivered a chunk: never retry the entire reply.

package/src/messenger/session-pool.ts

@@ -1,4 +1,5 @@
 import type { MessengerActivityReporter } from "./types";
+import { MessengerUnverifiedReplyError } from "./types";
 
 interface WorkerProcess {
 	stdin: { write(data: string): unknown; flush(): unknown; end(): unknown };
@@ -15,6 +16,8 @@ interface Pending {
 	reject(error: Error): void;
 	report?: MessengerActivityReporter;
 	result?: string;
+	/** The result is an UNVERIFIED-marked answer: the turn rejects with it while the worker keeps serving. */
+	unverified?: boolean;
 	written?: boolean;
 }
 
@@ -159,7 +162,8 @@ export function createMessengerSessionPool(spawn: typeof Bun.spawn = Bun.spawn,
 			worker.idleTimer = setTimeout(() => retire(key, worker), idleTimeoutMs);
 			worker.idleTimer.unref();
 		}
-		pending.resolve(pending.result);
+		if (pending.unverified) pending.reject(new MessengerUnverifiedReplyError(pending.result));
+		else pending.resolve(pending.result);
 	}
 
 	async function readLines(stream: ReadableStream<Uint8Array>, handle: (line: string) => void) {
@@ -234,6 +238,17 @@ export function createMessengerSessionPool(spawn: typeof Bun.spawn = Bun.spawn,
 			const pending = worker.pending;
 			if (!pending) return;
 			if (line === "JEO_MESSENGER_ERROR") { retire(key, worker); return; }
+			// An exhausted completion gate is a controlled turn end: deliver the marked answer, keep the worker.
+			if (line.startsWith("JEO_MESSENGER_UNVERIFIED ")) {
+				try {
+					const text: unknown = JSON.parse(line.slice("JEO_MESSENGER_UNVERIFIED ".length));
+					if (typeof text !== "string" || !text.trim()) throw new Error("Invalid response");
+					pending.result = text;
+					pending.unverified = true;
+					finishTurn(key, worker, pending);
+				} catch { retire(key, worker); }
+				return;
+			}
 			if (!line.startsWith("JEO_MESSENGER_RESULT ")) return;
 			try {
 				const text: unknown = JSON.parse(line.slice("JEO_MESSENGER_RESULT ".length));

package/src/messenger/types.ts

@@ -78,6 +78,14 @@ export class MessengerFatalError extends Error {
 	}
 }
 
+/** The agent turn ended without verified completion; `reply` is the UNVERIFIED-marked answer for the user. */
+export class MessengerUnverifiedReplyError extends Error {
+	constructor(readonly reply: string) {
+		super("Messenger agent turn ended without verified completion");
+		this.name = "MessengerUnverifiedReplyError";
+	}
+}
+
 export function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }