jeo-code 0.12.9 → 0.12.11

package/src/agent/subagents.ts

@@ -258,14 +258,16 @@ export function subagentSystemPrompt(role: SubagentRole): string {
 
 /**
  * True when EVERY shell segment of `command` starts with one of `prefixes`
- * (after stripping leading env-assignments and a leading `sudo`). Splitting on
- * `; && || |` means a chained `… && rm -rf` cannot smuggle an un-vetted command
- * past a single allowed head. Command substitution (`$(…)`, backticks) can't be
- * statically vetted, so it is rejected outright. Empty allowlist = unconstrained.
+ * (after stripping leading env-assignments and a leading `sudo`). Only `&&`,
+ * `||`, `;`, and `|` chaining is understood; other shell operators, newlines,
+ * and substitutions are rejected rather than approximated. Empty allowlist =
+ * unconstrained.
  */
 export function bashCommandAllowed(command: string, prefixes: string[]): boolean {
   if (prefixes.length === 0) return true;
-  if (/[`]|\$\(/.test(command)) return false; // un-vettable command substitution
+  if (/[$`]/.test(command)) return false; // un-vettable expansion/substitution
+  const unsupportedSyntax = command.replace(/&&|\|\||[;|]/g, "");
+  if (/[&<>(){}\\\r\n]/.test(unsupportedSyntax)) return false;
   const matches = (seg: string, p: string) =>
     seg === p || seg.startsWith(p + " ") || seg.startsWith(p + "\t");
   for (const raw of command.split(/(?:&&|\|\||[;|])/)) {

package/src/agent/task-tool.ts

@@ -9,7 +9,7 @@
  * repo). Subagents are spawned with `subagentToolset(role)`, which never includes
  * `task` itself, so delegation cannot recurse infinitely.
  */
-import { runAgentLoop, isSafetyFallbackBail, stripSafetyFallbackTag, type ToolHandler } from "./engine";
+import { runAgentLoop, isSafetyFallbackBail, stripSafetyFallbackTag, type AgentLoopResult, type ToolHandler } from "./engine";
 import { toolTarget } from "./step-budget";
 
 import type { ToolResult } from "./tools";
@@ -279,8 +279,11 @@ export interface RunSubagentOptions {
   modelOverride?: string;
   /** Stable detached id (from SubagentRegistry), attached to all emitted TaskSubEvents. */
   detachedId?: string;
+  /** SubagentRegistry to report live activity into (e.g. current tool or step). */
+  registry?: SubagentRegistry;
 }
 
+
 /** `runSubagentOnce`'s result — a superset of `ToolResult` exposing the raw
  *  (unwrapped, unfenced) done reason and mutation-audit counters so a caller with
  *  its OWN pass/fail policy on top (e.g. `jeo team`'s role-gate-verdict parsing and
@@ -288,6 +291,8 @@ export interface RunSubagentOptions {
  *  report text. `task`/`subagent` tool callers only ever need `success`/`output`/
  *  `error`, which stay structurally identical to plain `ToolResult`. */
 export interface SubagentRunResult extends ToolResult {
+  /** True when delegated execution observed a successful or potentially partial mutation. */
+  mutationMayHaveOccurred?: boolean;
   /** Raw subagent done reason, before contract validation or fencing. */
   doneReason: string;
   /** True when the subagent actually called `done` (vs. exhausting its step
@@ -297,7 +302,8 @@ export interface SubagentRunResult extends ToolResult {
   contractOk: boolean;
   /** Required markers missing from the done reason, when `contractOk` is false. */
   missingMarkers?: string[];
-  /** Successful write/edit/mkdir/delete calls observed (mutation audit evidence). */
+  /** Successful workspace mutation calls observed (write/edit/mkdir/delete,
+   *  ast_edit, or lsp_rename). */
   fileMutations: number;
   /** Successful bash calls observed (tracked apart — bash CAN mutate but isn't proof). */
   bashRuns: number;
@@ -329,7 +335,18 @@ export async function runSubagentOnce(
   const { steer, slot, detachedId, projectContext: preloadedContext, signal } = opts;
   // Tag every live event with its fan-out slot or detached ID so a parent monitor can tell
   // task 1 from task 3 or detached tasks apart when several subagents stream concurrently.
-  const emit = (ev: TaskSubEvent) =>
+  const emit = (ev: TaskSubEvent) => {
+    if (detachedId && opts.registry) {
+      if (ev.kind === "tool") {
+        opts.registry.setActivity(detachedId, ev.detail ? `tool: ${ev.detail}` : "running tool");
+      } else if (ev.kind === "thinking") {
+        opts.registry.setActivity(detachedId, "thinking");
+      } else if (ev.kind === "step") {
+        opts.registry.setActivity(detachedId, ev.detail ? `step: ${ev.detail}` : "next step");
+      } else if (ev.kind === "done") {
+        opts.registry.setActivity(detachedId, undefined);
+      }
+    }
     opts.onEvent?.(
       detachedId
         ? { ...ev, detachedId }
@@ -337,6 +354,8 @@ export async function runSubagentOnce(
         ? { ...ev, index: slot.index, total: slot.total }
         : ev
     );
+  };
+
   const initialModel = opts.modelOverride || resolveSubagentModel(role.id, opts.config);
   const maxSteps = resolveSubagentMaxSteps(role.id, opts.config);
   // gjc parity: a role may pin its own reasoning budget; absent = inherit the
@@ -365,6 +384,9 @@ export async function runSubagentOnce(
   let fileMutations = 0;
   let bashRuns = 0;
   let readOnlyEvidenceCalls = 0;
+  // The engine's evidence signal is cumulative across tool batches and includes
+  // failed mutators whose handlers report that state may have changed.
+  let mutationMayHaveOccurred = false;
   // Per-run prompt-cache key: the subagent replays its own growing history each
   // step, so a stable key (even across a model switch below — a stale cache key
   // on a NEW provider is simply unused, never wrong) gets provider cache hits
@@ -454,6 +476,9 @@ export async function runSubagentOnce(
       tools: subagentToolset(role),
       ...(failoverEnabled ? { rateLimitFallbackAvailable, safetyFallbackAvailable } : {}),
       events: {
+        onEvidence: evidence => {
+          if (evidence.sawMutation) mutationMayHaveOccurred = true;
+        },
         onStep: n => { currentStep = n; },
         // Live reasoning preview (native extended-thinking models only — the JSON-protocol
         // "reasoning" field the main turn also extracts from onModelStream is intentionally
@@ -475,7 +500,7 @@ export async function runSubagentOnce(
         },
         onToolResult: (tool, success, output) => {
           if (success) {
-            if (tool === "write" || tool === "edit" || tool === "mkdir" || tool === "delete") fileMutations++;
+            if (tool === "write" || tool === "edit" || tool === "mkdir" || tool === "delete" || tool === "ast_edit" || tool === "lsp_rename") fileMutations++;
             else if (tool === "bash") bashRuns++;
             else if (tool === "read" || tool === "search" || tool === "find" || tool === "ast_grep" || tool === "lsp") readOnlyEvidenceCalls++;
           }
@@ -496,12 +521,36 @@ export async function runSubagentOnce(
     });
   };
 
-  let result = await runOnce();
+  const failureResult = (error: unknown): SubagentRunResult => {
+    const explicitSignal = typeof error === "object" && error !== null && "mutationMayHaveOccurred" in error && error.mutationMayHaveOccurred === true;
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      success: false,
+      output: "",
+      error: message,
+      doneReason: message,
+      done: false,
+      contractOk: false,
+      fileMutations,
+      bashRuns,
+      readOnlyEvidenceCalls,
+      mutationMayHaveOccurred: mutationMayHaveOccurred || explicitSignal || (!role.readOnly ? true : undefined),
+    };
+  };
+  const runSafely = async (): Promise<{ ok: true; result: AgentLoopResult } | { ok: false; error: unknown }> => {
+    try {
+      return { ok: true, result: await runOnce() };
+    } catch (error: unknown) {
+      return { ok: false, error };
+    }
+  };
+  let outcome = await runSafely();
+  if (!outcome.ok) return failureResult(outcome.error);
+  let result = outcome.result;
   // `routing.enabled` off = the model is FIXED: no failover reroute at all (the
   // engine bail predicates above are withheld too, so a 429 rides its normal
   // backoff ladder instead of bailing early with nowhere to go).
-  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {
-    const rateLimited = !result.done && isRateLimitError(new Error(result.doneReason ?? ""));
+  for (let attempt = 0; failoverEnabled && attempt < MAX_SUBAGENT_REROUTES; attempt++) {    const rateLimited = !result.done && isRateLimitError(new Error(result.doneReason ?? ""));
     const safetyBail = !result.done && !rateLimited && isSafetyFallbackBail(result.doneReason);
     if (!rateLimited && !safetyBail) break;
     const previousModel = activeModel;
@@ -526,7 +575,9 @@ export async function runSubagentOnce(
       emit({ role: role.id, kind: "step", detail: `↳ refused on '${previousModel}' — switching to '${activeModel}' in case of a classifier false positive`, step: currentStep, maxSteps, model: activeModel });
     }
     attemptedModels.add(activeModel);
-    result = await runOnce();
+    outcome = await runSafely();
+    if (!outcome.ok) return failureResult(outcome.error);
+    result = outcome.result;
   }
 
   const reason = stripSafetyFallbackTag(result.doneReason?.trim() || "") || `(subagent reached the ${result.steps}-step limit without signaling done)`;
@@ -543,8 +594,8 @@ export async function runSubagentOnce(
   // "verify independently" instead of the stronger UNVERIFIED.
   const audit = complete && !role.readOnly && fileMutations === 0
     ? bashRuns === 0
-      ? `\n[parent audit] No successful write/edit/bash was observed in this run — treat any "Changed Files:" claims above as UNVERIFIED.`
-      : `\n[parent audit] No successful write/edit was observed (only bash ran); bash may or may not have mutated files — verify any "Changed Files:" claims above independently.`
+      ? `\n[parent audit] No successful workspace mutation or bash call was observed in this run — treat any "Changed Files:" claims above as UNVERIFIED.`
+      : `\n[parent audit] No successful workspace mutation was observed (only bash ran); bash may or may not have mutated files — verify any "Changed Files:" claims above independently.`
     : "";
   return {
     success: complete,
@@ -556,6 +607,7 @@ export async function runSubagentOnce(
     fileMutations,
     bashRuns,
     readOnlyEvidenceCalls,
+    mutationMayHaveOccurred,
   };
 }
 
@@ -585,8 +637,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       modelOverride?: string;
       /** Stable detached id from SubagentRegistry. */
       detachedId?: string;
+      /** SubagentRegistry to report live activity into. */
+      registry?: SubagentRegistry;
     } = {},
-  ): Promise<ToolResult> =>
+  ): Promise<SubagentRunResult> =>
     runSubagentOnce(role, taskText, context, cwd, {
       config: opts.config,
       signal: extra.signal ?? opts.signal,
@@ -597,8 +651,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       excludedCredentialScopes: extra.excludedCredentialScopes,
       modelOverride: extra.modelOverride,
       detachedId: extra.detachedId,
+      registry: extra.registry,
     });
 
+
   return async (args: Record<string, any>, cwd: string): Promise<ToolResult> => {
     const roleArg = typeof args.role === "string" ? args.role.trim() : "";
     const role = roleArg ? getSubagentRole(roleArg, opts.config) : defaultSubagentRole();
@@ -689,7 +745,7 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       // `executor`'s single resolved model), so the first worker to exclude a
       // scope saves every sibling worker the same wasted round.
       const batchExcludedScopes = new Set<string>();
-      const results: ToolResult[] = new Array(items.length);
+      const results: SubagentRunResult[] = new Array(items.length);
       let next = 0;
       // #7: broadcast steering hub — each concurrent worker sees every parent
       // steer message exactly once (safe even for parallel read-only fan-out).
@@ -714,7 +770,11 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       const ok = results.filter(r => r.success).length;
       const head = `[${role.title} fan-out] ${ok}/${items.length} completed (concurrency ${limit}).`;
       const combined = results.map((r, i) => `### Task ${i + 1}/${items.length}\n${r.output}`).join("\n\n");
-      return { success: ok === items.length, output: `${head}\n\n${combined}` };
+      return {
+        success: ok === items.length,
+        output: `${head}\n\n${combined}`,
+        mutationMayHaveOccurred: results.some(r => r.mutationMayHaveOccurred === true),
+      };
     }
 
     // Single-task form.
@@ -728,8 +788,15 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
     // its own registry inbox (registry.steerDrainFor(id)) between its own steps.
     if (args.detached === true && opts.registry) {
       const rec = opts.registry.launch(role.id, taskText, (signal, id) =>
-        runOne(role, taskText, ctx(args.context), cwd, { signal, steer: opts.registry!.steerDrainFor(id), detachedId: id }),
+        runOne(role, taskText, ctx(args.context), cwd, {
+          signal,
+          steer: opts.registry!.steerDrainFor(id),
+          detachedId: id,
+          registry: opts.registry,
+        }),
+        { readOnly: role.readOnly },
       );
+
       // Remote subagent visibility/control over Telegram (gjc daemon parity, see
       // `src/agent/notify/`): best-effort, no-op unless `notifications.enabled`.
       ensureSessionNotifyEndpoint(opts.registry, cwd, opts.sessionEndpoint);
@@ -739,6 +806,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
         output:
           `[detached] launched ${role.title} subagent '${rec.id}'. It runs in the background — ` +
           `keep working, then use the 'subagent' tool ({action:"await"|"list"|"inspect"|"cancel", ids?}) to collect its result.`,
+        // A mutating detached run may change the workspace after this tool returns;
+        // surface that possibility immediately so the parent cannot claim a clean
+        // workspace before collecting and verifying the settled result.
+        mutationMayHaveOccurred: role.readOnly ? undefined : true,
       };
     }
     return runOne(role, taskText, ctx(args.context), cwd, { steer: opts.steer });

package/src/agent/tools.ts

@@ -26,6 +26,8 @@ export interface ToolResult {
   success: boolean;
   output: string;
   error?: string;
+  /** Failed operations set this when an attempted filesystem write may have partially changed state. */
+  mutationMayHaveOccurred?: boolean;
 }
 
 /**
@@ -315,18 +317,20 @@ export async function writeTool(
   content: string,
   cwd: string = process.cwd()
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof filePath !== "string" || filePath.trim() === "") {
       return { success: false, output: "", error: 'write requires a non-empty "filePath".' };
     }
     await assertMutationAllowed(filePath, cwd);
     const absPath = path.resolve(cwd, filePath);
+    mutationMayHaveOccurred = true;
     await fs.mkdir(path.dirname(absPath), { recursive: true });
     await fs.writeFile(absPath, content, "utf-8");
     markRead(absPath); // own change counts as having seen the file
     return { success: true, output: `Successfully wrote ${content.length} characters to ${filePath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 
@@ -363,6 +367,7 @@ export async function editTool(
   editBlock: string,
   cwd: string = process.cwd()
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof filePath !== "string" || filePath.trim() === "") {
       return { success: false, output: "", error: 'edit requires a non-empty "filePath".' };
@@ -582,11 +587,12 @@ export async function editTool(
       };
     }
 
+    mutationMayHaveOccurred = true;
     await fs.writeFile(absPath, content, "utf-8");
     markRead(absPath); // own change counts as having seen the file
     return { success: true, output: `Successfully updated ${filePath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 
@@ -1079,6 +1085,7 @@ export async function mkdirTool(
   dirPath: string,
   cwd: string = process.cwd()
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof dirPath !== "string" || dirPath.trim() === "") {
       return { success: false, output: "", error: 'mkdir requires a non-empty "dirPath".' };
@@ -1089,10 +1096,11 @@ export async function mkdirTool(
     if (existing && !existing.isDirectory()) {
       return { success: false, output: "", error: `Path exists and is not a directory: ${dirPath}` };
     }
+    mutationMayHaveOccurred = true;
     await fs.mkdir(abs, { recursive: true });
     return { success: true, output: `Directory ready: ${dirPath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 
@@ -1108,6 +1116,7 @@ export async function deleteTool(
   cwd: string = process.cwd(),
   recursive: boolean = false
 ): Promise<ToolResult> {
+  let mutationMayHaveOccurred = false;
   try {
     if (typeof targetPath !== "string" || targetPath.trim() === "") {
       return { success: false, output: "", error: 'delete requires a non-empty "path".' };
@@ -1124,11 +1133,12 @@ export async function deleteTool(
     if (st.isDirectory() && !recursive) {
       return { success: false, output: "", error: `${targetPath} is a directory — pass recursive:true to remove it and its contents.` };
     }
+    mutationMayHaveOccurred = true;
     await fs.rm(abs, { recursive, force: false });
     readThisSession.delete(abs); // a future edit against this path must read it again first
     return { success: true, output: `Deleted ${st.isDirectory() ? "directory" : "file"}: ${targetPath}` };
   } catch (err: any) {
-    return { success: false, output: "", error: err.message };
+    return { success: false, output: "", error: err.message, mutationMayHaveOccurred };
   }
 }
 

package/src/cli.ts

@@ -49,6 +49,7 @@ process.on("unhandledRejection", fatal);
 process.stdout.on("error", fatal);
 process.stderr.on("error", fatal);
 
+
 try {
   const code = await dispatch(process.argv.slice(2), { appName: APP_NAME, version: VERSION });
   if (code !== 0) process.exit(code);

package/src/commands/launch/flags.ts

@@ -252,12 +252,13 @@ export const TOOL_DESCRIPTIONS: Record<string, string> = {
   find: "find   {globPattern}               — find files by name",
   search: "search {pattern, globPattern?, ignoreCase?, context?, maxMatches?} — grep (context: N lines around each match)",
   ls: "ls     {dirPath}                   — list a directory's entries (dirs first)",
+  computer: "computer {action, x?, y?, text?, key?, deltaX?, deltaY?, duration?, actions?} — desktop automation (screenshot, click, double_click, move, drag, scroll, type, keypress, wait, batch)",
 };
 
 export function buildToolProtocol(allowedTools: Set<string>): string {
   const lines: string[] = ["You have these tools (call exactly ONE per step):"];
   let num = 1;
-  for (const name of ["read", "write", "edit", "bash", "find", "search", "ls"]) {
+  for (const name of ["read", "write", "edit", "bash", "find", "search", "ls", "computer"]) {
     if (allowedTools.has(name)) {
       lines.push(`${num}. ${TOOL_DESCRIPTIONS[name]}`);
       num++;