jeo-code 0.12.20 → 0.12.22

package/src/agent/task-tool.ts

@@ -570,7 +570,10 @@ export async function runSubagentOnce(
   // `routing.enabled` off = the model is FIXED: no failover reroute at all (the
   // engine bail predicates above are withheld too, so a 429 rides its normal
   // backoff ladder instead of bailing early with nowhere to go).
-  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {    const rateLimited = !result.done && isRateLimitError(new Error(result.doneReason ?? ""));
+  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {
+    // An exhausted completion gate puts the model's own candidate answer in doneReason;
+    // its text (e.g. "HTTP 429") is not a provider failure and must never reroute.
+    const rateLimited = !result.done && !result.completionRejected && isRateLimitError(new Error(result.doneReason ?? ""));
     const safetyBail = !result.done && !rateLimited && isSafetyFallbackBail(result.doneReason);
     if (!rateLimited && !safetyBail) break;
     const previousModel = activeModel;

package/src/agent/workspace-snapshot.ts

@@ -0,0 +1,209 @@
+/**
+ * Host-side workspace fingerprint. The engine brackets bash/computer calls with two snapshots and
+ * counts the call as a mutation only when they differ (workspaceSnapshotChanged). Failures and caps
+ * are reported as `ok:false`, which always counts as a mutation (safe side).
+ *
+ * Entry strings folded into an order-independent digest:
+ * - directory: `d:<rel>` (presence only; directory mtimes are ignored so creating an excluded
+ *   child such as `.jeo/` or `node_modules/` never counts)
+ * - file/link/other: `<f|l|o>:<rel>:<size>:<mtimeNs>:<ctimeNs>:<ino>` from lstat (never followed)
+ *   - link: `:t<readlink target>`
+ *   - regular file with mtime >= anchor - racyWindowMs: `:h<wyhash(content)>` (racy-clean guard
+ *     against coarse timestamps; the after-snapshot reuses the before-snapshot's anchor)
+ *   - FIFO/socket/device: stat only, never opened
+ */
+import * as fs from "node:fs/promises";
+import { constants } from "node:fs";
+import type { BigIntStats, Dirent } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import * as path from "node:path";
+
+export interface WorkspaceSnapshotLimits {
+  /** Max fingerprinted entries (files+dirs+links) before giving up (counts as a mutation). */
+  maxEntries: number;
+  /** Wall-clock budget per snapshot (ms). */
+  maxMs: number;
+  /** Files with mtime within this window of the snapshot start are content-hashed too. */
+  racyWindowMs: number;
+  /** Per-file and per-snapshot byte caps for racy content hashing. */
+  racyMaxFileBytes: number;
+  racyMaxTotalBytes: number;
+}
+
+export const WORKSPACE_SNAPSHOT_LIMITS: Readonly<WorkspaceSnapshotLimits> = Object.freeze({
+  maxEntries: 50_000,
+  maxMs: 2_000,
+  racyWindowMs: 2_000,
+  racyMaxFileBytes: 1024 * 1024,
+  racyMaxTotalBytes: 8 * 1024 * 1024,
+});
+
+/** Directory NAMES skipped at any depth (A2): exactly these three. */
+export const WORKSPACE_SNAPSHOT_EXCLUDED_DIRS: ReadonlySet<string> = new Set([".git", ".jeo", "node_modules"]);
+
+export type WorkspaceSnapshot =
+  | { ok: true; digest: bigint; entries: number; elapsedMs: number; startedAtMs: number }
+  | { ok: false; reason: "error" | "cap"; detail: string };
+
+/** `racySinceMs`: anchor for the racy content-hash predicate. The engine passes the BEFORE snapshot's
+ *  `startedAtMs` to the AFTER snapshot so both sides hash exactly the same set of unchanged files. */
+export type WorkspaceSnapshotter = (cwd: string, racySinceMs?: number) => Promise<WorkspaceSnapshot>;
+
+type Failure = Extract<WorkspaceSnapshot, { ok: false }>;
+
+/** Carries the first failure out of the concurrent walk. */
+class SnapshotStop extends Error {
+  constructor(readonly result: Failure) { super(result.detail); }
+}
+
+const CONCURRENCY = 64;
+const DIGEST_MASK = 0xffff_ffff_ffff_ffffn;
+/** Never follow a link swapped in after lstat, and never block on a FIFO swapped in after lstat. */
+const RACY_OPEN_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+
+const errorMessage = (error: unknown): string => error instanceof Error ? error.message : String(error);
+/** A child removed mid-walk: skipped, since a real deletion still changes the digest. */
+const vanished = (error: unknown): boolean => {
+  const code = (error as NodeJS.ErrnoException | undefined)?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+};
+const stop = (reason: Failure["reason"], detail: string): never => { throw new SnapshotStop({ ok: false, reason, detail }); };
+
+async function chunked<T>(items: readonly T[], run: (item: T) => Promise<void>): Promise<void> {
+  for (let i = 0; i < items.length; i += CONCURRENCY) await Promise.all(items.slice(i, i + CONCURRENCY).map(run));
+}
+
+interface Dir { rel: string; abs: string }
+interface Leaf extends Dir { dirent: Dirent }
+
+export async function snapshotWorkspace(
+  cwd: string,
+  limits: WorkspaceSnapshotLimits = WORKSPACE_SNAPSHOT_LIMITS,
+  racySinceMs?: number,
+): Promise<WorkspaceSnapshot> {
+  const startedAtMs = Date.now();
+  const startedAt = performance.now();
+  const anchorMs = racySinceMs !== undefined && Number.isFinite(racySinceMs) ? racySinceMs : startedAtMs;
+  const racyThresholdNs = BigInt(Math.floor(anchorMs - limits.racyWindowMs)) * 1_000_000n;
+  let digest = 0n;
+  let entries = 0;
+  let racyBytes = 0;
+
+  const record = (entry: string): void => { digest = (digest + Bun.hash.wyhash(entry)) & DIGEST_MASK; };
+  const checkCaps = (): void => {
+    if (entries > limits.maxEntries) stop("cap", `workspace has more than ${limits.maxEntries} entries`);
+    if (performance.now() - startedAt > limits.maxMs) stop("cap", `workspace snapshot exceeded ${limits.maxMs} ms`);
+  };
+
+  /** Bounded read of a regular file's content; `null` when it vanished before it could be read. */
+  const racyHash = async (leaf: Leaf, stat: BigIntStats): Promise<bigint | null> => {
+    const size = Number(stat.size);
+    if (size > limits.racyMaxFileBytes) stop("error", `racy file too large: ${leaf.rel} (${size} bytes)`);
+    racyBytes += size;
+    if (racyBytes > limits.racyMaxTotalBytes) stop("error", `racy files too large: more than ${limits.racyMaxTotalBytes} bytes`);
+    let handle: FileHandle;
+    try { handle = await fs.open(leaf.abs, RACY_OPEN_FLAGS); }
+    catch (error) { if (vanished(error)) return null; return stop("error", `cannot open ${leaf.rel}: ${errorMessage(error)}`); }
+    try {
+      const opened = await handle.stat({ bigint: true });
+      if (!opened.isFile() || opened.ino !== stat.ino || opened.dev !== stat.dev) stop("error", `file changed during workspace snapshot: ${leaf.rel}`);
+      // One spare byte detects growth after lstat without reading past the cap.
+      const buffer = new Uint8Array(size + 1);
+      let read = 0;
+      for (;;) {
+        const { bytesRead } = await handle.read(buffer, read, buffer.length - read, read);
+        if (bytesRead === 0) break;
+        read += bytesRead;
+        if (read > size) stop("error", `file changed during workspace snapshot: ${leaf.rel}`);
+      }
+      return Bun.hash.wyhash(buffer.subarray(0, read));
+    } finally {
+      await handle.close().catch(() => {});
+    }
+  };
+
+  const fingerprint = async (leaf: Leaf, queue: Dir[]): Promise<void> => {
+    let stat: BigIntStats;
+    try { stat = await fs.lstat(leaf.abs, { bigint: true }); }
+    catch (error) {
+      if (vanished(error)) { entries -= 1; return; }
+      return stop("error", `cannot stat ${leaf.rel}: ${errorMessage(error)}`);
+    }
+    if (stat.isDirectory()) {
+      // Unreported or raced dirent type: a real directory is never fingerprinted by metadata.
+      if (WORKSPACE_SNAPSHOT_EXCLUDED_DIRS.has(leaf.dirent.name)) { entries -= 1; return; }
+      record(`d:${leaf.rel}`);
+      queue.push(leaf);
+      return;
+    }
+    const kind = stat.isSymbolicLink() ? "l" : stat.isFile() ? "f" : "o";
+    let entry = `${kind}:${leaf.rel}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}:${stat.ino}`;
+    if (kind === "l") {
+      try { entry += `:t${await fs.readlink(leaf.abs)}`; }
+      catch (error) {
+        if (vanished(error)) { entries -= 1; return; }
+        return stop("error", `cannot read link ${leaf.rel}: ${errorMessage(error)}`);
+      }
+    } else if (kind === "f" && leaf.dirent.isFile() && stat.mtimeNs >= racyThresholdNs) {
+      const hash = await racyHash(leaf, stat);
+      if (hash === null) { entries -= 1; return; }
+      entry += `:h${hash}`;
+    }
+    record(entry);
+  };
+
+  const list = async (dir: Dir, next: Dir[], leaves: Leaf[]): Promise<void> => {
+    let dirents: Dirent[];
+    try { dirents = await fs.readdir(dir.abs, { withFileTypes: true }); }
+    catch (error) {
+      if (dir.rel !== "" && vanished(error)) return;
+      return stop("error", `cannot read directory ${dir.rel || "."}: ${errorMessage(error)}`);
+    }
+    for (const dirent of dirents) {
+      const rel = dir.rel ? `${dir.rel}/${dirent.name}` : dirent.name;
+      const child: Leaf = { rel, abs: path.join(dir.abs, dirent.name), dirent };
+      if (dirent.isDirectory()) {
+        if (WORKSPACE_SNAPSHOT_EXCLUDED_DIRS.has(dirent.name)) continue;
+        entries += 1;
+        record(`d:${rel}`);
+        next.push(child);
+      } else {
+        entries += 1;
+        leaves.push(child);
+      }
+    }
+    checkCaps();
+  };
+
+  try {
+    let root: BigIntStats;
+    try { root = await fs.stat(cwd, { bigint: true }); }
+    catch (error) { return { ok: false, reason: "error", detail: `cannot stat workspace root: ${errorMessage(error)}` }; }
+    if (!root.isDirectory()) return { ok: false, reason: "error", detail: "workspace root is not a directory" };
+
+    let level: Dir[] = [{ rel: "", abs: cwd }];
+    while (level.length) {
+      const next: Dir[] = [];
+      for (let i = 0; i < level.length; i += CONCURRENCY) {
+        const leaves: Leaf[] = [];
+        await Promise.all(level.slice(i, i + CONCURRENCY).map(dir => list(dir, next, leaves)));
+        await chunked(leaves, leaf => fingerprint(leaf, next));
+        checkCaps();
+      }
+      level = next;
+    }
+    return { ok: true, digest, entries, elapsedMs: performance.now() - startedAt, startedAtMs };
+  } catch (error) {
+    if (error instanceof SnapshotStop) return error.result;
+    return { ok: false, reason: "error", detail: errorMessage(error) };
+  }
+}
+
+/** Production default: default limits, forwards the racy anchor. */
+export const defaultWorkspaceSnapshotter: WorkspaceSnapshotter = (cwd, since) => snapshotWorkspace(cwd, WORKSPACE_SNAPSHOT_LIMITS, since);
+
+/** Pure: true when either side failed, or digest/entry count differ. */
+export function workspaceSnapshotChanged(before: WorkspaceSnapshot, after: WorkspaceSnapshot): boolean {
+  if (!before.ok || !after.ok) return true;
+  return before.digest !== after.digest || before.entries !== after.entries;
+}

package/src/cli/runner.ts

@@ -235,7 +235,7 @@ export const COMMANDS: readonly CommandSpec[] = [
   {
     name: "update",
     summary: "Update jeo-code to the latest npm release (bare = install; --check only checks).",
-    usage: "update [--check|--install] [--json] [--strict] [--version <semver>]",
+    usage: "update [--check|--install] [--json] [--strict] [--version <semver>] [--allow-unlocked-global]",
     loader: async () => {
       const m = await import("../commands/update");
       return args => m.runUpdateCommand(args);

package/src/commands/doctor.ts

@@ -14,6 +14,9 @@ import { visibleWidth, truncateToWidth } from "../tui/components/width";
 import chalk from "chalk";
 import { extractChatgptAccountId, CODEX_RESPONSES_URL } from "../ai/providers/openai-responses";
 import { resolveTierModel, tierModelPool, cheapestCredentialed } from "../agent/prompt-router";
+import { DEFAULT_SIZE_CAP_MS, collectSharedInstallReport, type SharedInstallReport } from "../util/shared-install-report";
+import { formatBytes } from "../tui/components/session-picker";
+import { compareVersions } from "./update";
 
 interface ProbeResult {
   status: "ok" | "fail" | "skipped";
@@ -219,7 +222,93 @@ function providerTableLines(
   return renderMarkdownTables(md, { unicode, maxColWidth: detailBudget }).split("\n");
 }
 
-export async function runDoctorCommand(args: string[] = []): Promise<void> {
+export interface DoctorDeps {
+  /** Produces the shared bun global report; tests inject it, the default scans the real machine (memoized). */
+  sharedInstall?: () => SharedInstallReport | Promise<SharedInstallReport>;
+}
+
+const SHARED_INSTALL_TTL_MS = 30_000;
+let sharedInstallMemo: { key: string; at: number; report: SharedInstallReport } | undefined;
+
+/** The real scan, memoized for 30 s per environment so repeated doctor runs in one process walk the global dir once. */
+function defaultSharedInstall(): SharedInstallReport {
+  const key = [process.env.HOME, process.env.BUN_INSTALL, process.env.BUN_INSTALL_GLOBAL_DIR, process.env.XDG_CONFIG_HOME, process.env.PATH, process.platform].join("|");
+  if (sharedInstallMemo?.key === key && Date.now() - sharedInstallMemo.at < SHARED_INSTALL_TTL_MS) return sharedInstallMemo.report;
+  const report = collectSharedInstallReport();
+  sharedInstallMemo = { key, at: Date.now(), report };
+  return report;
+}
+
+const ORPHAN_KIND_NOTE: Record<"directory" | "symlink" | "dangling-symlink", string> = {
+  directory: "possible orphan",
+  symlink: "possible orphan, symlink",
+  "dangling-symlink": "possible orphan, dangling symlink",
+};
+
+/** Human text for the shared install section. Warnings are yellow, an ok lockfile green; paths are never truncated. */
+function sharedInstallLines(report: SharedInstallReport): string[] {
+  const lines: string[] = [];
+  const { manifest, lockfile, leftovers, sizes } = report;
+  if (report.skipped !== null) {
+    lines.push(`Shared install: no usable bun global (${report.skipped}); lockfile, leftover and size checks skipped.`);
+  } else {
+    lines.push(`Shared install (${report.globalDir ?? "unknown"}):`);
+  }
+  if (manifest !== null) lines.push(`  packages:  ${manifest.dependencies} in manifest (${manifest.external} besides jeo-code)`);
+  if (lockfile !== null) {
+    if (lockfile.status === "ok") {
+      const total = manifest?.external ?? lockfile.uncovered.length;
+      lines.push(chalk.green(`  bun.lock:  ok (${total - lockfile.uncovered.length} of ${total} covered)`));
+    } else if (lockfile.status === "not-required") {
+      lines.push("  bun.lock:  not required (jeo-code is the only package)");
+    } else if (lockfile.status === "missing") {
+      lines.push(chalk.yellow("  bun.lock:  MISSING - jeo update will refuse until it is restored (or pass --allow-unlocked-global)"));
+    } else if (lockfile.status === "incomplete") {
+      lines.push(chalk.yellow(`  bun.lock:  INCOMPLETE - no resolved entry for: ${lockfile.uncovered.join(", ")}`));
+    } else {
+      lines.push(chalk.yellow(`  bun.lock:  UNREADABLE${lockfile.detail ? ` (${lockfile.detail})` : ""}`));
+    }
+  }
+  if (report.jeoOnPath.length === 0) {
+    lines.push("  jeo on PATH: none found");
+  } else {
+    const activeVersion = report.jeoOnPath.find(entry => entry.active)?.version ?? null;
+    lines.push("  jeo on PATH (first = active):");
+    for (const entry of report.jeoOnPath) {
+      const marker = entry.active ? "*" : " ";
+      const text = `    ${marker} ${entry.path}  ${entry.version ?? "(version unknown)"}${entry.active ? " (active)" : ""}`;
+      if (entry.stale && entry.version !== null && activeVersion !== null) {
+        const direction = compareVersions(entry.version, activeVersion) < 0 ? "older" : "newer";
+        lines.push(chalk.yellow(`${text} [stale: ${direction} than active ${activeVersion}]`));
+      } else {
+        lines.push(text);
+      }
+    }
+  }
+  if (leftovers !== null) {
+    if (leftovers.backupFiles.length === 0 && leftovers.possibleOrphans.length === 0 && leftovers.orphanScanComplete) {
+      lines.push("  leftovers: none");
+    } else {
+      lines.push("  leftovers (not touched):");
+      for (const file of leftovers.backupFiles) lines.push(chalk.yellow(`    file    ${file}`));
+      for (const orphan of leftovers.possibleOrphans) lines.push(chalk.yellow(`    orphan  ${orphan.name} (${ORPHAN_KIND_NOTE[orphan.kind]})`));
+      if (!leftovers.orphanScanComplete) lines.push(chalk.yellow("    orphan scan stopped at its cap; no orphans reported"));
+    }
+  }
+  if (sizes !== null) {
+    const top = `top ${sizes.top.length}: ${sizes.top.map(p => `${p.name} ${formatBytes(p.bytes)}`).join(", ")}`;
+    if (sizes.capped === null) {
+      lines.push(`  size: ${formatBytes(sizes.totalBytes)} total${sizes.top.length > 0 ? `; ${top}` : ""}`);
+    } else {
+      const cap = sizes.capped === "time" ? `time cap (${DEFAULT_SIZE_CAP_MS} ms)` : `entry cap (${sizes.scannedEntries} entries)`;
+      lines.push(chalk.yellow(`  size scan stopped at the ${cap}; figures are lower bounds`));
+      lines.push(`    at least ${formatBytes(sizes.totalBytes)} scanned${sizes.top.length > 0 ? `; ${top}` : ""}`);
+    }
+  }
+  return lines;
+}
+
+export async function runDoctorCommand(args: string[] = [], deps: DoctorDeps = {}): Promise<void> {
   const strict = args.includes("--strict");
   const json = args.includes("--json");
   const config = await readGlobalConfig();
@@ -379,6 +468,14 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
     ? defaultProbe?.result.status === "skipped"
     : defaultProbe?.result.status === "ok";
 
+  // Shared bun global diagnostics: read-only, never affects `ready` or the exit code.
+  let sharedInstall: SharedInstallReport | { error: string };
+  try {
+    sharedInstall = await (deps.sharedInstall ?? defaultSharedInstall)();
+  } catch (err) {
+    sharedInstall = { error: err instanceof Error ? err.message : String(err) };
+  }
+
   // --- JSON output mode (CI / scripting) ---
   if (json) {
     const report = {
@@ -402,6 +499,7 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
       oauth: oauthHealth,
       ready,
       ...(routingEnabled ? { routing: { enabled: true, smolConfigured, preview: routingPreview, ...(routingNotes.length ? { notes: routingNotes } : {}) } } : {}),
+      sharedInstall,
 
     };
     console.log(JSON.stringify(report, null, 2));
@@ -490,6 +588,13 @@ export async function runDoctorCommand(args: string[] = []): Promise<void> {
     console.log("");
   }
 
+  if ("error" in sharedInstall) {
+    console.log(chalk.yellow(`Shared install: check failed (${sharedInstall.error})`));
+  } else {
+    for (const line of sharedInstallLines(sharedInstall)) console.log(line);
+  }
+  console.log("");
+
   // Final verdict
   if (ready) {
     console.log(`${chalk.green("[READY]")} Default model '${config.defaultModel}' is reachable.`);

package/src/commands/launch.ts

@@ -1229,7 +1229,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
     // injected SKILL.md is NOT user-authored and the [skill] card already names it,
     // gjc-style); a string → show that compact label instead of the raw input.
     opts?: { userCard?: string | null; signal?: AbortSignal; trustedContext?: string },
-  ): Promise<{ done: boolean; steps: number; reply: string; rendered: boolean; usage: string }> => {
+  ): Promise<{ done: boolean; steps: number; reply: string; rendered: boolean; usage: string; unverified: boolean }> => {
     opts?.signal?.throwIfAborted();
     if (currentSandboxExecution() && sessionId !== sandboxTranscriptId) throw new Error("SESSION_MISMATCH: start a new launch for the selected transcript; sandbox grants cannot cross sessions");
     let busyDraftHasPaste = false;
@@ -1370,7 +1370,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         sessionNotifyEndpoint?.sendTurnStream(notifyRedact ? "[redacted]" : reply);
         cliTui?.events().onStep?.(result.steps);
         cliTui?.finish(reply);
-        return { done: true, steps: result.steps, reply, rendered: !!cliTui, usage };
+        return { done: true, steps: result.steps, reply, rendered: !!cliTui, usage, unverified: false };
       } catch (error) {
         if (oneShot) {
           process.exitCode = error instanceof AgyCliError
@@ -1883,13 +1883,24 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         // Todos checklist used to end a finished turn stuck at "✓0 ◐1 ·4 / 5"
         // because nothing ever forced the model to update item statuses).
         let turnTodos: { title: string; status: string }[] = [];
+        // Evidence from earlier engine runs of THIS turn always counts; an earlier turn's
+        // unverified mutation counts only while a goal is active (valid or corrupt goal file).
+        let turnPendingMutation = false;
+        try {
+          turnPendingMutation = (await readGoalState(cwd)) !== null && pendingMutationVerification;
+        } catch (error) {
+          if (!(error instanceof GoalStateCorruptError)) throw error;
+          turnPendingMutation = pendingMutationVerification;
+        }
         const onEvidence = async (
           evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean },
         ): Promise<void> => {
           if (evidence.sawVerification && !evidence.verificationStale) {
             pendingMutationVerification = false;
+            turnPendingMutation = false;
           } else if (evidence.sawMutation) {
             pendingMutationVerification = true;
+            turnPendingMutation = true;
           }
 
           let goalState: GoalState | null;
@@ -1965,7 +1976,8 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
             }
             throw error;
           }
-          if ((pendingMutationVerification || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
+          const carriedPending = turnPendingMutation || (goalState !== null && pendingMutationVerification);
+          if ((carriedPending || evidence.sawMutation) && !(evidence.sawVerification && !evidence.verificationStale)) {
             return (
               `Cannot finish: a workspace mutation from this session still lacks a successful, non-stale verification. ` +
               `Run a relevant test/build/typecheck/lint after the last change (e.g. 'bun test', 'bun run typecheck', 'tsc --noEmit', 'npm test', 'pytest', 'cargo test', or 'go test ./...'), then call done again.`
@@ -2261,8 +2273,9 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
 
           // A loop guard is a local safety boundary, not a provider failure. A
           // fresh loop on an equivalent model loses the guard state and could
-          // re-execute a previously skipped mutation.
-          const routedFailureReason = !result.done && !result.stopClass
+          // re-execute a previously skipped mutation. A rejected completion carries
+          // the model's own answer in doneReason, which must not be read as a provider error.
+          const routedFailureReason = !result.done && !result.stopClass && !result.completionRejected
             ? routeFailureReason(result.doneReason)
             : null;
           if (!routedFailureReason) break;
@@ -2361,7 +2374,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         : `(reached the ${result.steps}-step limit without signaling done)`);
     // Routing off = the model is fixed and nothing fails over. When the turn died on
     // an account-level limit, say so and name the one switch that re-enables failover.
-    const failoverHint = !routingEnabled && !result.done && (() => {
+    const failoverHint = !routingEnabled && !result.done && !result.completionRejected && (() => {
       const failure = new Error(result.doneReason ?? "");
       return isRateLimitError(failure) || isUsageLimitError(failure);
     })()
@@ -2469,7 +2482,7 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
     }
 
     lastActiveModel = activeModel;
-    return { done: result.done, steps: result.steps, reply, rendered: !!tui, usage };
+    return { done: result.done, steps: result.steps, reply, rendered: !!tui, usage, unverified: result.completionRejected === true };
     } finally {
       preflightHarness?.dispose();
       interactiveTurnActive = false;
@@ -2514,9 +2527,12 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
             try {
               const message = JSON.parse(line);
               if (typeof message !== "string" || !message.trim()) throw new Error("Invalid messenger request");
-              const { done, reply } = await runTurn(message, false);
-              if (!done) throw new Error("Messenger agent turn did not complete");
-              console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+              const { done, reply, unverified } = await runTurn(message, false);
+              if (done) console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+              // The turn ended in a controlled state with an UNVERIFIED-marked answer:
+              // deliver it as a failure and keep serving this conversation's follow-ups.
+              else if (unverified && reply.trim()) console.log(`JEO_MESSENGER_UNVERIFIED ${JSON.stringify(reply)}`);
+              else throw new Error("Messenger agent turn did not complete");
             } catch {
               console.log("JEO_MESSENGER_ERROR");
               break;
@@ -2752,10 +2768,13 @@ async function runLaunchSession(args: string[], registerEndpointCleanup?: (clean
         return;
       }
       try {
-        const { done, reply, rendered, usage } = await runTurn(messageContent, shouldUseOneShotTui(flags.noTui));
+        const { done, reply, rendered, usage, unverified } = await runTurn(messageContent, shouldUseOneShotTui(flags.noTui));
         if (flags.literalPrompt) {
-          if (!done) throw new Error("Messenger agent turn did not complete");
-          console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+          if (done) console.log(`JEO_MESSENGER_RESULT ${JSON.stringify(reply)}`);
+          else if (unverified && reply.trim()) {
+            console.log(`JEO_MESSENGER_UNVERIFIED ${JSON.stringify(reply)}`);
+            process.exitCode = 1;
+          } else throw new Error("Messenger agent turn did not complete");
         } else if (!rendered) console.log(stripMarkdown(renderMarkdownTables(reply)) + usage);
         else if (usage) console.log(usage.trim());
       } catch (err) {