jeo-code 0.12.8 → 0.12.10

package/CHANGELOG.md

@@ -7,7 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
-## [Unreleased]
+## [0.12.10] - 2026-11-02
+
+### Added
+- **Messenger computer use** — explicitly allow authorized messenger sessions to use the host computer tool, independently of the global computer setting. Host desktop and filesystem access are shared and not sandboxed.
+
+### Fixed
+- **Literal worker tool isolation** — prevent environment-provided tool lists from bypassing a messenger worker's explicit allowlist.
+
+## [0.12.9] - 2026-11-02
+≔14c4+
+- **Discord model policy** — optionally pin a Discord worker model and fall back on persistent usage or quota exhaustion before any tool execution; other platforms and global routing retain their own settings.
 
 ### Added
 - **Discord session files and control** — local opt-in enables authorized Discord prompts to use host session tools and exchange staged attachments; see the [Discord guide](docs/integrations/discord.md) for limits, public visibility, and revocation boundaries.

package/README.ja.md

@@ -417,11 +417,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
-- **[Unreleased]**
+- **[0.12.10]** (2026-11-02)
+- **[0.12.9]** (2026-11-02)
 - **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
 - **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
-- **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -418,11 +418,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
-- **[Unreleased]**
+- **[0.12.10]** (2026-11-02)
+- **[0.12.9]** (2026-11-02)
 - **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
 - **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
-- **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -410,11 +410,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
-- **[Unreleased]**
+- **[0.12.10]** (2026-11-02)
+- **[0.12.9]** (2026-11-02)
 - **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
 - **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
-- **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -415,11 +415,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
-- **[Unreleased]**
+- **[0.12.10]** (2026-11-02)
+- **[0.12.9]** (2026-11-02)
 - **[0.12.7]** (2026-10-18) — Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization.
 - **[0.12.6]** (2026-10-17) — Preserve OpenAI subscription authentication behind configured proxies, isolate account catalogs, and give provider-specific recovery instructions while retaining Antigravity OAuth calls.
 - **[0.12.5]** (2026-10-17) — Antigravity and Kimi provider support in interactive setup, Kimi live model cache rehydration, immediate discovery caching on provider probing.
-- **[0.12.4]** (2026-10-17) — Refresh Antigravity provider (`antigravity/*`) account catalogs with `antigravity/hub/2.23.1` so entitled Gemini 4 Argon and Gemini 3.8 Flash tiers appear directly in `/model provider antigravity`.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.8",
+  "version": "0.12.10",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",
@@ -53,6 +53,7 @@
     "changelog:sync": "bun scripts/sync-changelog.ts",
     "test": "bun test",
     "verify:browser": "bun scripts/verify-browser.ts",
+    "verify:discord": "bun scripts/verify-discord-integration.ts",
     "verify:tmux": "bash scripts/tmux-verify.sh",
     "dev:link": "bun scripts/dev-link.ts link",
     "dev:doctor": "bun scripts/dev-link.ts doctor"

package/src/agent/notify/discord-attachments.ts

@@ -1,10 +1,12 @@
 import { lstat, mkdir, open, realpath, rm } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 
-const MAX_FILES = 10;
+/** Limit enforced on presented attachment entries, before validation or deduplication. */
+export const MAX_ARTIFACTS = 10;
 const MAX_FILE_BYTES = 25 * 1024 * 1024;
 const MAX_TOTAL_BYTES = 50 * 1024 * 1024;
-const CDN_HOSTS = ["cdn.discordapp.com", "media.discordapp.net"];
+export const DISCORD_ATTACHMENT_CDN_HOSTS = ["cdn.discordapp.com", "media.discordapp.net"] as const;
+export const MAX_DISCORD_ATTACHMENT_REDIRECTS = 5;
 
 interface Attachment {
   filename: string;
@@ -23,12 +25,62 @@ export interface DiscordAttachmentStage {
   cleanup: () => Promise<void>;
 }
 
+/**
+ * Parse and validate one Discord CDN URL without accepting normalization that
+ * could conceal an ambiguous authority. Host matching is exact after URL's
+ * ASCII/case normalization; Unicode, percent-encoded authorities, trailing
+ * dots, user-info, and explicit ports are rejected.
+ */
+export function validateDiscordAttachmentUrl(value: string): URL {
+  if (typeof value !== "string") throw new Error("Untrusted Discord attachment URL");
+  const authority = value.match(/^https:\/\/([^/?#]*)/i)?.[1];
+  if (!authority || /[^\x00-\x7f]/.test(authority) || authority.includes("%") || authority.endsWith(".")) {
+    throw new Error("Untrusted Discord attachment URL");
+  }
+  if (authority.includes("@") || authority.includes(":")) throw new Error("Untrusted Discord attachment URL");
+  let url: URL;
+  try { url = new URL(value); } catch { throw new Error("Invalid Discord attachment URL"); }
+  if (url.protocol !== "https:" ||
+      !(DISCORD_ATTACHMENT_CDN_HOSTS as readonly string[]).includes(url.hostname) ||
+      url.username || url.password || url.port) {
+    throw new Error("Untrusted Discord attachment URL");
+  }
+  return url;
+}
+
+async function fetchTrustedAttachment(
+  initialUrl: string,
+  fetchImpl: typeof fetch,
+  signal: AbortSignal,
+): Promise<Response> {
+  let current = validateDiscordAttachmentUrl(initialUrl);
+  for (let redirects = 0; ; redirects++) {
+    const response = await fetchImpl(current.href, { redirect: "manual", signal });
+    if (response.status >= 300 && response.status < 400) {
+      const location = response.headers.get("location");
+      await response.body?.cancel().catch(() => {});
+      if (!location || redirects >= MAX_DISCORD_ATTACHMENT_REDIRECTS) throw new Error("Discord attachment redirect rejected");
+      // Validate an authority-bearing Location before URL resolution can erase
+      // percent-encoding, IDNA, case, or default-port evidence.
+      if (/^[a-z][a-z0-9+.-]*:\/\//i.test(location)) validateDiscordAttachmentUrl(location);
+      else if (location.startsWith("//")) validateDiscordAttachmentUrl(`${current.protocol}${location}`);
+      current = validateDiscordAttachmentUrl(new URL(location, current).href);
+      continue;
+    }
+    // Native fetch exposes the final URL. Test doubles commonly leave it blank.
+    if (response.url) validateDiscordAttachmentUrl(response.url);
+    return response;
+  }
+}
+
 /** Staged files are private and must be removed with cleanup after the request finishes. */
 export async function stageDiscordAttachments(
   attachments: unknown[],
   options: DiscordAttachmentOptions,
 ): Promise<DiscordAttachmentStage> {
-  if (!Array.isArray(attachments) || attachments.length > MAX_FILES) throw new Error("Invalid Discord attachment count");
+  // Every presented entry consumes the limit, including duplicates and entries
+  // that would later fail metadata validation. Overflow rejects the whole input.
+  if (!Array.isArray(attachments) || attachments.length > MAX_ARTIFACTS) throw new Error("Invalid Discord attachment count");
   const validated: Attachment[] = [];
   let declaredTotal = 0;
   for (const value of attachments) {
@@ -38,11 +90,7 @@ export async function stageDiscordAttachments(
         !Number.isSafeInteger(item.size) || (item.size as number) < 0 || (item.size as number) > MAX_FILE_BYTES) {
       throw new Error("Invalid Discord attachment metadata");
     }
-    let url: URL;
-    try { url = new URL(item.url); } catch { throw new Error("Invalid Discord attachment URL"); }
-    if (url.protocol !== "https:" || !CDN_HOSTS.includes(url.hostname) || url.username || url.password || url.port) {
-      throw new Error("Untrusted Discord attachment URL");
-    }
+    const url = validateDiscordAttachmentUrl(item.url);
     declaredTotal += item.size as number;
     if (declaredTotal > MAX_TOTAL_BYTES) throw new Error("Discord attachments exceed total size limit");
     validated.push({ filename: item.filename, url: url.href, size: item.size as number });
@@ -69,7 +117,7 @@ export async function stageDiscordAttachments(
       const signal = AbortSignal.any([...(options.signal ? [options.signal] : []), AbortSignal.timeout(30_000)]);
       let response: Response;
       try {
-        response = await (options.fetchImpl ?? fetch)(item.url, { redirect: "error", signal });
+        response = await fetchTrustedAttachment(item.url, options.fetchImpl ?? fetch, signal);
       } catch {
         throw new Error("Discord attachment download failed or aborted");
       }

package/src/commands/launch/flags.ts

@@ -252,12 +252,13 @@ export const TOOL_DESCRIPTIONS: Record<string, string> = {
   find: "find   {globPattern}               — find files by name",
   search: "search {pattern, globPattern?, ignoreCase?, context?, maxMatches?} — grep (context: N lines around each match)",
   ls: "ls     {dirPath}                   — list a directory's entries (dirs first)",
+  computer: "computer {action, x?, y?, text?, key?, deltaX?, deltaY?, duration?, actions?} — desktop automation (screenshot, click, double_click, move, drag, scroll, type, keypress, wait, batch)",
 };
 
 export function buildToolProtocol(allowedTools: Set<string>): string {
   const lines: string[] = ["You have these tools (call exactly ONE per step):"];
   let num = 1;
-  for (const name of ["read", "write", "edit", "bash", "find", "search", "ls"]) {
+  for (const name of ["read", "write", "edit", "bash", "find", "search", "ls", "computer"]) {
     if (allowedTools.has(name)) {
       lines.push(`${num}. ${TOOL_DESCRIPTIONS[name]}`);
       num++;

package/src/commands/launch.ts

@@ -67,6 +67,7 @@ import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFrom
 import { RouteHistory } from "../agent/route-history";
 
 import { isRateLimitError, isUsageLimitError, isConnectionError } from "../util/retry";
+import { messengerUsageFallback } from "../messenger/model-policy";
 
 
 import { listAliases } from "../ai/model-registry";
@@ -738,7 +739,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // never persisted to config.
   const routeHistory = new RouteHistory();
   // Computer-use session override: undefined = follow config.computer.enabled, true/false = /computer on|off wins this session.
-  let sessionComputerOverride: boolean | undefined;
+  let sessionComputerOverride: boolean | undefined = flags.literalWorker && process.env.JEO_MESSENGER_COMPUTER_ENABLED === "1" ? true : undefined;
 
   // Cache of live, credential-validated models per provider (refreshed by live pickers).
   // Every successful discovery is also persisted (`writeModelCache`), so the NEXT launch
@@ -1241,7 +1242,8 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // global default (rememberModelPatch), so re-reading turnConfig.defaultModel here let
     // that write silently switch THIS running session's model mid-run. Per-session model
     // selection must stay session-local: running sessions never influence each other.
-    const routingEnabled = sessionRouteOverride ?? !!turnConfig.routing?.enabled;
+    const routingEnabled = flags.literalWorker && process.env.JEO_MESSENGER_FIXED_MODEL === "1"
+      ? false : sessionRouteOverride ?? !!turnConfig.routing?.enabled;
     let routeCredentialNotice: string | undefined;
     let routeVetoNote: string | undefined;
     // Credential SCOPES that have shown an ACCOUNT-LEVEL failure (rate limit,
@@ -1968,6 +1970,15 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           return null;
         };
         result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
+        const messengerFallback = flags.literalWorker && process.env.JEO_MESSENGER_FIXED_MODEL === "1"
+          ? messengerUsageFallback(process.env.JEO_MESSENGER_USAGE_FALLBACK_MODEL, activeModel, result)
+          : undefined;
+        if (messengerFallback) {
+          activeModel = messengerFallback;
+          turnSessionKey = sessionId ? deriveCacheSessionKey(sessionId, activeModel) : undefined;
+          contextTokens = catalogMetadata(activeModel)?.contextTokens;
+          result = await runLoopWithModel(activeModel, activeThinking, turnSessionKey);
+        }
         const routeFallbackMaxRaw = Number(jeoEnv("ROUTE_FALLBACK_MAX_ATTEMPTS") ?? NaN);
         const routeFallbackMax = Number.isFinite(routeFallbackMaxRaw) && routeFallbackMaxRaw >= 0
           ? Math.floor(routeFallbackMaxRaw)

package/src/commands/messenger.ts

@@ -98,7 +98,9 @@ export function createMessengerCliReply(config: MessengerConfig, spawn: typeof B
 		const sourceEntry = process.argv[1]?.endsWith(".ts") ? process.argv[1] : undefined;
 		const tools = [...new Set(config.toolNames.map(name => name === "grep" ? "search" : name === "glob" ? "find" : name))];
 		const toolFlags = tools.length ? ["--tools", tools.join(",")] : ["--no-tools"];
-		const command = [executable, ...(sourceEntry ? ["--no-env-file", sourceEntry] : []), "launch", "--print", "--no-tui", "--no-skills", "--literal-worker", ...toolFlags, "--resume", id, "--", "worker"];
+		const platformConfig = config.platforms[message.platform];
+		const modelFlags = platformConfig?.model ? ["--model", platformConfig.model] : [];
+		const command = [executable, ...(sourceEntry ? ["--no-env-file", sourceEntry] : []), "launch", "--print", "--no-tui", "--no-skills", "--literal-worker", ...toolFlags, ...modelFlags, "--resume", id, "--", "worker"];
 		const secretNames = new Set<string>();
 		for (const platform of Object.values(config.platforms)) {
 			if (!platform) continue;
@@ -112,6 +114,13 @@ export function createMessengerCliReply(config: MessengerConfig, spawn: typeof B
 		const env = Object.fromEntries(Object.entries(process.env).filter(([name, value]) => value !== undefined && !secretNames.has(name))) as Record<string, string>;
 		for (const name of secretNames) env[name] = "";
 		env.JEO_SESSION_DIR = config.sessionDir;
+		// The explicit tool allowlist is the opt-in for this worker only.
+		env.JEO_MESSENGER_COMPUTER_ENABLED = tools.includes("computer") ? "1" : "0";
+		// Never inherit another platform's fallback policy from the gateway environment.
+		delete env.JEO_MESSENGER_USAGE_FALLBACK_MODEL;
+		if (platformConfig?.usageFallbackModel) env.JEO_MESSENGER_USAGE_FALLBACK_MODEL = platformConfig.usageFallbackModel;
+		delete env.JEO_MESSENGER_FIXED_MODEL;
+		if (platformConfig?.model) env.JEO_MESSENGER_FIXED_MODEL = "1";
 		return pool.turn(id, command, config.cwd, env, [message.text, artifactPrompt].filter(Boolean).join("\n\n"), signal, onActivity);
 	};
 	return Object.assign(reply, { close: pool.close });

package/src/messenger/config.ts

@@ -12,6 +12,7 @@ const TOOLS: Record<string, true> = {
 	bash: true,
 	edit: true,
 	write: true,
+	computer: true,
 };
 
 function object(value: unknown, label: string): Record<string, unknown> {
@@ -75,7 +76,7 @@ export function parseMessengerConfig(value: unknown, baseDir: string): Messenger
 			platform === "slack"
 				? ["tokenEnv", "appTokenEnv", "allowedUserIds", "allowedChannelIds"]
 				: platform === "discord"
-					? ["tokenEnv", "allowedUserIds", "allowedChannelIds", "artifactDir"]
+					? ["tokenEnv", "allowedUserIds", "allowedChannelIds", "artifactDir", "model", "usageFallbackModel"]
 					: ["tokenEnv", "allowedUserIds", "allowedChannelIds"],
 			`${platform} config`,
 		);
@@ -89,6 +90,12 @@ export function parseMessengerConfig(value: unknown, baseDir: string): Messenger
 			config.allowedChannelIds = ids(item.allowedChannelIds, `${platform}.allowedChannelIds`);
 		if (platform === "discord" && item.artifactDir !== undefined)
 			config.artifactDir = path.resolve(baseDir, string(item.artifactDir, "discord.artifactDir"));
+		if (platform === "discord" && item.model !== undefined)
+			config.model = string(item.model, "discord.model");
+		if (platform === "discord" && item.usageFallbackModel !== undefined) {
+			if (!config.model) throw new Error("discord.usageFallbackModel requires discord.model");
+			config.usageFallbackModel = string(item.usageFallbackModel, "discord.usageFallbackModel");
+		}
 		platforms[platform] = config;
 	}
 	const toolNames = input.toolNames === undefined ? [] : input.toolNames;
@@ -97,7 +104,7 @@ export function parseMessengerConfig(value: unknown, baseDir: string): Messenger
 		toolNames.some(name => typeof name !== "string" || !Object.hasOwn(TOOLS, name)) ||
 		new Set(toolNames).size !== toolNames.length
 	) {
-		throw new Error("toolNames must be a unique list drawn from read, grep, glob, bash, edit, write");
+		throw new Error("toolNames must be a unique list drawn from read, grep, glob, find, search, bash, edit, write, computer");
 	}
 	return {
 		cwd: path.resolve(baseDir, input.cwd === undefined ? "." : string(input.cwd, "cwd")),

package/src/messenger/model-policy.ts

@@ -0,0 +1,8 @@
+import { isUsageLimitError } from "../util/retry";
+
+/** Only retry a worker's first failed step, before any tools could have executed. */
+export function messengerUsageFallback(fallback: string | undefined, current: string, result: { done: boolean; steps: number; stopClass?: unknown; doneReason?: string }): string | undefined {
+	if (!fallback || fallback === current || result.done || result.stopClass || result.steps !== 1) return undefined;
+	const reason = result.doneReason ?? "";
+	return isUsageLimitError(reason) || /usage\/quota limit reached/i.test(reason) ? fallback : undefined;
+}

package/src/messenger/types.ts

@@ -45,6 +45,9 @@ export interface MessengerPlatformConfig {
 	allowedChannelIds?: string[];
 	/** Dedicated operator-approved directory for Discord output files. */
 	artifactDir?: string;
+	/** Optional platform-specific model and persistent-usage-limit fallback. */
+	model?: string;
+	usageFallbackModel?: string;
 }
 
 export interface MessengerConfig {