jeo-code 0.7.31 → 0.7.32

package/src/agent/lsp-rename-tool.ts

@@ -0,0 +1,108 @@
+/**
+ * `lsp_rename` tool — cross-file TypeScript/JavaScript symbol rename (gjc `lsp`
+ * `action:"rename"` parity), using the same in-process `ts.LanguageService` as the
+ * read-only `lsp` tool. MUTATING: kept as its own tool (not an action on `lsp`) so
+ * the read-only-role toolset filter — which excludes tools by NAME — cannot be
+ * bypassed by an `apply:true` argument hidden inside a nominally "read-only" tool.
+ * Writes go through the existing `writeTool`, so the mutation lock and stale-read
+ * guard apply exactly as they do for `write`/`edit`/`ast_edit`.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import type * as ts from "typescript";
+import type { ToolHandler } from "./engine";
+import type { ToolResult } from "./tools";
+import { writeTool } from "./tools";
+import { languageServiceFor, parseSymbolSelector, resolvePosition, lineTextAt, lineOfPosition, formatLocation } from "./ts-language-service";
+
+/** One-line protocol description appended to the launch system prompt. */
+export const LSP_RENAME_TOOL_PROTOCOL_LINE =
+  `lsp_rename {file, line, symbol?, new_name, apply?} — rename a TypeScript/JavaScript symbol across every ` +
+  `file in the project via the same in-process language service as 'lsp' (same file/line/symbol addressing). ` +
+  `'apply' defaults to true (writes files — mutation lock/stale-read checks apply, same as write/edit); ` +
+  `apply:false previews every location that would change without writing anything.`;
+
+function err(message: string): ToolResult {
+  return { success: false, output: "", error: message };
+}
+
+const IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+export function createLspRenameTool(): ToolHandler {
+  return async (args: Record<string, any>, cwd: string): Promise<ToolResult> => {
+    const fileArg = typeof args.file === "string" ? args.file.trim() : "";
+    if (!fileArg) return err(`lsp_rename requires a non-empty "file".`);
+
+    const newName = typeof args.new_name === "string" ? args.new_name.trim()
+      : typeof args.newName === "string" ? args.newName.trim() : "";
+    if (!newName) return err(`lsp_rename requires a non-empty "new_name".`);
+    if (!IDENTIFIER_RE.test(newName)) return err(`"new_name" must be a valid identifier, got '${newName}'.`);
+
+    const absPath = path.resolve(cwd, fileArg);
+    let text: string;
+    try {
+      text = await fs.readFile(absPath, "utf-8");
+    } catch {
+      return err(`Cannot read file '${fileArg}'.`);
+    }
+
+    const lineRaw = args.line;
+    const line = typeof lineRaw === "number" ? lineRaw : parseInt(String(lineRaw ?? ""), 10);
+    if (!Number.isFinite(line) || line < 1) return err(`lsp_rename requires a positive integer "line".`);
+
+    const symbol = parseSymbolSelector(typeof args.symbol === "string" ? args.symbol : undefined);
+    const pos = resolvePosition(text, line, symbol);
+    if ("error" in pos) return err(pos.error);
+
+    const service = await languageServiceFor(cwd, absPath);
+    const renameInfo = service.getRenameInfo(absPath, pos.position, {});
+    if (!renameInfo.canRename) {
+      const reason = "localizedErrorMessage" in renameInfo ? renameInfo.localizedErrorMessage : "not a renameable symbol here";
+      return err(`Cannot rename here: ${reason}.`);
+    }
+
+    const locations = service.findRenameLocations(absPath, pos.position, false, false, {}) ?? [];
+    if (locations.length === 0) return { success: true, output: "No rename locations found." };
+
+    const apply = args.apply !== false; // default true
+
+    const byFile = new Map<string, ts.TextSpan[]>();
+    for (const loc of locations) {
+      const spans = byFile.get(loc.fileName) ?? [];
+      spans.push(loc.textSpan);
+      byFile.set(loc.fileName, spans);
+    }
+
+    const preview: string[] = [];
+    let totalEdits = 0;
+    for (const [fName, spans] of byFile) {
+      const rel = path.relative(cwd, fName) || fName;
+      let content: string;
+      try {
+        content = await fs.readFile(fName, "utf-8");
+      } catch {
+        return err(`Cannot read file '${rel}' while applying rename.`);
+      }
+
+      for (const span of spans) {
+        totalEdits++;
+        const line1 = lineOfPosition(content, span.start);
+        preview.push(formatLocation(rel, line1, lineTextAt(content, line1)));
+      }
+
+      if (apply) {
+        let newText = content;
+        for (const span of [...spans].sort((a, b) => b.start - a.start)) {
+          newText = newText.slice(0, span.start) + newName + newText.slice(span.start + span.length);
+        }
+        const res = await writeTool(rel, newText, cwd);
+        if (!res.success) return err(`${rel}: ${res.error ?? "write failed"}`);
+      }
+    }
+
+    const header = apply
+      ? `Renamed ${totalEdits} occurrence(s) across ${byFile.size} file(s):`
+      : `Preview: ${totalEdits} occurrence(s) across ${byFile.size} file(s) would be renamed to '${newName}' (apply:false, nothing written):`;
+    return { success: true, output: `${header}\n${preview.join("\n")}` };
+  };
+}

package/src/agent/lsp-tool.ts

@@ -0,0 +1,177 @@
+/**
+ * `lsp` tool — read-only TypeScript/JavaScript language-service queries (gjc `lsp`
+ * parity, scoped to TS/JS/TSX/JSX via the in-process `ts.LanguageService` from
+ * `ts-language-service.ts` — NOT a real LSP client/server, NOT multi-language).
+ * Safe for every subagent role. Cross-file rename (mutating) is the separate
+ * `lsp_rename` tool so the read-only-role toolset filter (which gates by tool
+ * NAME, not by argument) cannot be bypassed by a `rename` action hidden in here.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as ts from "typescript";
+import type { ToolHandler } from "./engine";
+import type { ToolResult } from "./tools";
+import { languageServiceFor, parseSymbolSelector, resolvePosition, lineTextAt, lineOfPosition, formatLocation } from "./ts-language-service";
+import { resolveTargetFiles } from "./ast-file-scan";
+
+/** One-line protocol description appended to the launch system prompt. */
+export const LSP_TOOL_PROTOCOL_LINE =
+  `lsp {action:"definition"|"references"|"hover"|"symbols"|"diagnostics", file, line?, symbol?} — ` +
+  `TypeScript/JavaScript language-service queries (in-process ts.LanguageService, not a real LSP server). ` +
+  `'symbol' is a substring on 'line' used to resolve the column automatically (append "#N" to pick the Nth ` +
+  `occurrence). 'definition'/'references'/'hover' need file+line(+symbol); 'symbols' needs only file; ` +
+  `'diagnostics' takes file (a path, glob, or "*" for the whole project) and needs no line/symbol. Cross-file ` +
+  `rename is the separate 'lsp_rename' tool.`;
+
+async function readAbs(absPath: string): Promise<string | null> {
+  try {
+    return await fs.readFile(absPath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+
+function err(message: string): ToolResult {
+  return { success: false, output: "", error: message };
+}
+
+interface ResolvedTarget {
+  absPath: string;
+  rel: string;
+  text: string;
+  position: number;
+}
+
+async function resolveTarget(args: Record<string, any>, cwd: string): Promise<ResolvedTarget | { error: string }> {
+  const fileArg = typeof args.file === "string" ? args.file.trim() : "";
+  if (!fileArg) return { error: `lsp requires a non-empty "file".` };
+  const absPath = path.resolve(cwd, fileArg);
+  const text = await readAbs(absPath);
+  if (text === null) return { error: `Cannot read file '${fileArg}'.` };
+
+  const lineRaw = args.line;
+  const line = typeof lineRaw === "number" ? lineRaw : parseInt(String(lineRaw ?? ""), 10);
+  if (!Number.isFinite(line) || line < 1) return { error: `lsp requires a positive integer "line".` };
+
+  const symbol = parseSymbolSelector(typeof args.symbol === "string" ? args.symbol : undefined);
+  const pos = resolvePosition(text, line, symbol);
+  if ("error" in pos) return { error: pos.error };
+
+  return { absPath, rel: path.relative(cwd, absPath) || absPath, text, position: pos.position };
+}
+
+const MAX_REFERENCES_FULL = 50;
+const MAX_DIAGNOSTIC_FILES = 50;
+
+export function createLspTool(): ToolHandler {
+  return async (args: Record<string, any>, cwd: string): Promise<ToolResult> => {
+    const action = String(args.action ?? "").trim().toLowerCase();
+
+    if (action === "definition") {
+      const t = await resolveTarget(args, cwd);
+      if ("error" in t) return err(t.error);
+      const service = await languageServiceFor(cwd, t.absPath);
+      const result = service.getDefinitionAndBoundSpan(t.absPath, t.position);
+      const defs = result?.definitions ?? [];
+      if (defs.length === 0) return { success: true, output: "No definition found." };
+      const lines: string[] = [];
+      for (const d of defs) {
+        const dText = (await readAbs(d.fileName)) ?? "";
+        const dLine = lineOfPosition(dText, d.textSpan.start);
+        const rel = path.relative(cwd, d.fileName) || d.fileName;
+        lines.push(formatLocation(rel, dLine, lineTextAt(dText, dLine)));
+      }
+      return { success: true, output: lines.join("\n") };
+    }
+
+    if (action === "references") {
+      const t = await resolveTarget(args, cwd);
+      if ("error" in t) return err(t.error);
+      const service = await languageServiceFor(cwd, t.absPath);
+      const refs = service.getReferencesAtPosition(t.absPath, t.position) ?? [];
+      if (refs.length === 0) return { success: true, output: "No references found." };
+      const lines: string[] = [];
+      for (let i = 0; i < refs.length; i++) {
+        const r = refs[i]!;
+        const rel = path.relative(cwd, r.fileName) || r.fileName;
+        const rText = (await readAbs(r.fileName)) ?? "";
+        const rLine = lineOfPosition(rText, r.textSpan.start);
+        lines.push(i < MAX_REFERENCES_FULL ? formatLocation(rel, rLine, lineTextAt(rText, rLine)) : `${rel}:${rLine}`);
+      }
+      return { success: true, output: `${refs.length} reference(s):\n${lines.join("\n")}` };
+    }
+
+    if (action === "hover") {
+      const t = await resolveTarget(args, cwd);
+      if ("error" in t) return err(t.error);
+      const service = await languageServiceFor(cwd, t.absPath);
+      const info = service.getQuickInfoAtPosition(t.absPath, t.position);
+      if (!info) return { success: true, output: "No hover info available at that position." };
+      const signature = (info.displayParts ?? []).map(p => p.text).join("");
+      const doc = (info.documentation ?? []).map(p => p.text).join("").trim();
+      return { success: true, output: doc ? `${signature}\n\n${doc}` : signature };
+    }
+
+    if (action === "symbols") {
+      const fileArg = typeof args.file === "string" ? args.file.trim() : "";
+      if (!fileArg) return err(`lsp {action:"symbols"} requires a non-empty "file".`);
+      const absPath = path.resolve(cwd, fileArg);
+      const text = await readAbs(absPath);
+      if (text === null) return err(`Cannot read file '${fileArg}'.`);
+      const service = await languageServiceFor(cwd, absPath);
+      const items = service.getNavigationBarItems(absPath);
+      const lines: string[] = [];
+      const walk = (nodes: readonly ts.NavigationBarItem[], depth: number) => {
+        for (const n of nodes) {
+          const span = n.spans[0];
+          const line1 = span ? lineOfPosition(text, span.start) : undefined;
+          lines.push(`${"  ".repeat(depth)}${n.text} (${n.kind})${line1 ? ` — line ${line1}` : ""}`);
+          if (n.childItems && n.childItems.length) walk(n.childItems, depth + 1);
+        }
+      };
+      walk(items, 0);
+      return { success: true, output: lines.length ? lines.join("\n") : "No symbols found." };
+    }
+
+    if (action === "diagnostics") {
+      const fileArg = args.file;
+      const rawPaths = fileArg === "*"
+        ? ["**/*"]
+        : Array.isArray(fileArg) ? fileArg.map((p: unknown) => String(p))
+        : typeof fileArg === "string" && fileArg.trim() ? [fileArg.trim()]
+        : [];
+      if (rawPaths.length === 0) {
+        return err(`lsp {action:"diagnostics"} requires a "file" (path, glob, or "*" for the whole project).`);
+      }
+      let files: string[];
+      try {
+        files = await resolveTargetFiles(rawPaths, cwd);
+      } catch (e: any) {
+        return err(e.message);
+      }
+      if (files.length === 0) return { success: true, output: "No matching TypeScript/JavaScript files." };
+
+      const scanned = files.slice(0, MAX_DIAGNOSTIC_FILES);
+      const lines: string[] = [];
+      let count = 0;
+      for (const absPath of scanned) {
+        const service = await languageServiceFor(cwd, absPath);
+        const text = (await readAbs(absPath)) ?? "";
+        const diags = [...service.getSyntacticDiagnostics(absPath), ...service.getSemanticDiagnostics(absPath)];
+        if (diags.length === 0) continue;
+        const rel = path.relative(cwd, absPath) || absPath;
+        for (const d of diags) {
+          count++;
+          const msg = ts.flattenDiagnosticMessageText(d.messageText, " ");
+          const line1 = d.start !== undefined ? lineOfPosition(text, d.start) : 0;
+          lines.push(`${rel}:${line1}: ${msg}`);
+        }
+      }
+      if (count === 0) return { success: true, output: `0 diagnostics across ${scanned.length} file(s).` };
+      const note = files.length > MAX_DIAGNOSTIC_FILES ? ` (scanned first ${MAX_DIAGNOSTIC_FILES} of ${files.length} files)` : "";
+      return { success: true, output: `${count} diagnostic(s)${note}:\n${lines.join("\n")}` };
+    }
+
+    return err(`Unknown lsp action '${action}'. Use definition | references | hover | symbols | diagnostics.`);
+  };
+}

package/src/agent/session.ts

@@ -316,6 +316,33 @@ export async function latestSessionId(cwd = process.cwd()): Promise<string | und
   return list[0]?.id;
 }
 
+/** Result of resolving a full session id or a short id prefix. */
+export type SessionRefResolution =
+  | { kind: "ok"; id: string }
+  | { kind: "ambiguous"; matches: string[] }
+  | { kind: "not-found" };
+
+/** Resolve a full session id OR a short id PREFIX (gjc-parity: `--resume <prefix>`,
+ *  `/session resume <prefix>`) to exactly one session id. Exact match wins immediately
+ *  (fast path, no directory scan) before falling back to a prefix scan of listSessions(). */
+export async function resolveSessionRef(idOrPrefix: string, cwd = process.cwd()): Promise<SessionRefResolution> {
+  const trimmed = idOrPrefix.trim();
+  if (!trimmed) return { kind: "not-found" };
+  // Fast path: exact file exists.
+  try {
+    await fs.access(sessionPath(trimmed, cwd));
+    return { kind: "ok", id: trimmed };
+  } catch {
+    // fall through to prefix scan
+  }
+  const all = await listSessions(cwd);
+  const lower = trimmed.toLowerCase();
+  const matches = all.filter(s => s.id.toLowerCase().startsWith(lower)).map(s => s.id);
+  if (matches.length === 1) return { kind: "ok", id: matches[0]! };
+  if (matches.length > 1) return { kind: "ambiguous", matches };
+  return { kind: "not-found" };
+}
+
 /**
  * Locate the session's JSONL header, apply `mutate`, and rewrite the file in place.
  * `mutate` returns false to signal "no change needed" (skips the write). Shared by

package/src/agent/subagent-registry.ts

@@ -6,6 +6,11 @@
  * `subagent` control tool. Concurrency is real (JS event loop): a detached run's
  * awaits interleave with the parent's between steps.
  *
+ * Detached runs also support live steering (peer messaging) via `steer()` /
+ * `steerDrainFor()` — a running parent (or another subagent, via the `irc` tool)
+ * can push a message into a running detached subagent's inbox; the subagent's own
+ * agent loop drains it between steps, same mechanism as ordinary task steering.
+ *
  * Lifecycle is bounded to the turn that created the registry — `cancelAll()` on
  * turn teardown guarantees no background promise leaks into the next turn.
  */
@@ -34,13 +39,17 @@ interface Entry {
   abort: AbortController;
 }
 
-/** A detached run: receives its own AbortSignal and resolves to the subagent's
- *  final ToolResult. The runner is responsible for streaming live events itself. */
-export type DetachedRunner = (signal: AbortSignal) => Promise<ToolResult>;
+/** A detached run: receives its own AbortSignal and its own registry id, and
+ *  resolves to the subagent's final ToolResult. The `id` param lets a runner
+ *  wire up its own steer drain (e.g. `registry.steerDrainFor(id)`); runners that
+ *  don't need it can ignore the 2nd param. The runner is responsible for
+ *  streaming live events itself. */
+export type DetachedRunner = (signal: AbortSignal, id: string) => Promise<ToolResult>;
 
 export class SubagentRegistry {
   private readonly entries = new Map<string, Entry>();
   private readonly seq = new Map<string, number>();
+  private readonly steerInboxes = new Map<string, string[]>();
 
   /** Register and START a detached run; returns the (running) record immediately. */
   launch(role: string, task: string, runner: DetachedRunner): SubagentRecord {
@@ -55,9 +64,10 @@ export class SubagentRegistry {
       status: "running",
       startedAt: Date.now(),
     };
+    this.steerInboxes.set(id, []);
     const promise = (async () => {
       try {
-        const res = await runner(abort.signal);
+        const res = await runner(abort.signal, id);
         // A cancel that already fired wins — don't overwrite the terminal state.
         if (record.status === "cancelled") return;
         record.status = res.success ? "completed" : "failed";
@@ -69,6 +79,7 @@ export class SubagentRegistry {
         record.result = err instanceof Error ? err.message : String(err);
       } finally {
         if (record.finishedAt === undefined) record.finishedAt = Date.now();
+        this.steerInboxes.delete(id);
       }
     })();
     this.entries.set(id, { record, promise, abort });
@@ -107,6 +118,31 @@ export class SubagentRegistry {
     return targets.map(e => e.record);
   }
 
+  /** Push a live message into a running id's steer inbox (parent → detached subagent,
+   *  or subagent → subagent via the `irc` tool). Returns false if the id is unknown,
+   *  not running, or the (trimmed) message is empty — true once queued. */
+  steer(id: string, message: string): boolean {
+    const rec = this.get(id);
+    if (!rec || rec.status !== "running") return false;
+    const trimmed = message.trim();
+    if (!trimmed) return false;
+    const inbox = this.steerInboxes.get(id);
+    if (!inbox) return false;
+    inbox.push(trimmed);
+    return true;
+  }
+
+  /** A drain closure bound to one id — splices its inbox to empty on each call.
+   *  Wire this into a detached runner's own agent-loop `steer` option so pending
+   *  messages are picked up between the subagent's own steps. */
+  steerDrainFor(id: string): () => string[] {
+    return () => {
+      const inbox = this.steerInboxes.get(id);
+      if (!inbox || inbox.length === 0) return [];
+      return inbox.splice(0, inbox.length);
+    };
+  }
+
   /** Cancel the given ids (or all running, when empty): aborts the run and marks the
    *  record cancelled. Already-terminal records are returned unchanged. */
   cancel(ids: string[]): SubagentRecord[] {

package/src/agent/subagent-tool.ts

@@ -1,11 +1,13 @@
 /**
  * `subagent` control tool (#9) — the parent's handle on DETACHED subagents launched
  * via `task {detached:true}`. Mirrors gjc's `subagent`/`job` control surface, scoped
- * to an in-process registry: list, inspect, await (optionally bounded), and cancel.
+ * to an in-process registry: list, inspect, await (optionally bounded), cancel, and
+ * steer (live peer messaging into a single running subagent).
  *
- * Out of scope here (separate subsystems, not stubbed): live peer messaging (IRC)
- * and pause/resume — a step-budget loop has no safe mid-step checkpoint to resume
- * from, so those are intentionally absent rather than faked.
+ * Out of scope here (a separate subsystem, not stubbed): pause/resume — a step-budget
+ * loop has no safe mid-step checkpoint to resume from, so that remains intentionally
+ * absent rather than faked. Live peer messaging to/among ALL running subagents (not
+ * just one target id) is the `irc` tool, built on the same registry.steer().
  */
 import type { ToolHandler } from "./engine";
 import type { ToolResult } from "./tools";
@@ -13,9 +15,10 @@ import type { SubagentRegistry, SubagentRecord } from "./subagent-registry";
 
 /** One-line protocol description appended to the launch system prompt. */
 export const SUBAGENT_TOOL_PROTOCOL_LINE =
-  `subagent {action:"list"|"inspect"|"await"|"cancel", ids?, timeoutMs?} — control DETACHED ` +
+  `subagent {action:"list"|"inspect"|"await"|"cancel"|"steer", ids?, id?, message?, timeoutMs?} — control DETACHED ` +
   `subagents started with task{detached:true}. 'await' blocks (optionally up to timeoutMs ms) and ` +
-  `returns their reports; 'inspect' shows status + result; 'cancel' aborts them. Omit ids to target all running.`;
+  `returns their reports; 'inspect' shows status + result; 'cancel' aborts them; 'steer' sends {id, message} ` +
+  `to inject a live instruction into that ONE running subagent, picked up before its next step. Omit ids to target all running (list/inspect/await/cancel).`;
 
 function elapsed(rec: SubagentRecord): string {
   const end = rec.finishedAt ?? Date.now();
@@ -84,6 +87,23 @@ export function createSubagentTool(registry: SubagentRegistry): ToolHandler {
       return { success: true, output: `Cancelled ${recs.length} subagent(s):\n${recs.map(rowLine).join("\n")}` };
     }
 
-    return { success: false, output: "", error: `Unknown subagent action '${action}'. Use list | inspect | await | cancel.` };
+    if (action === "steer") {
+      const targetIds = Array.isArray(args.id) ? [] : args.id !== undefined ? [String(args.id)] : [];
+      const message = typeof args.message === "string" ? args.message : typeof args.text === "string" ? args.text : "";
+      if (targetIds.length !== 1) {
+        return { success: false, output: "", error: `subagent 'steer' requires exactly one target 'id' (a single string, not 'ids'). Got: ${JSON.stringify(args.id)}.` };
+      }
+      const id = targetIds[0]!;
+      if (!message.trim()) {
+        return { success: false, output: "", error: "subagent 'steer' requires a non-empty 'message' (or 'text')." };
+      }
+      const ok = registry.steer(id, message);
+      if (!ok) {
+        return { success: false, output: "", error: `Cannot steer '${id}': no running subagent with that id.` };
+      }
+      return { success: true, output: `Steered ${id}: ${message.trim()}` };
+    }
+
+    return { success: false, output: "", error: `Unknown subagent action '${action}'. Use list | inspect | await | cancel | steer.` };
   };
 }

package/src/agent/subagents.ts

@@ -252,7 +252,7 @@ export function bashCommandAllowed(command: string, prefixes: string[]): boolean
  */
 export function subagentToolset(role: SubagentRole): Record<string, ToolHandler> {
   if (role.readOnly) {
-    const MUTATING = new Set(["write", "edit", "bash", "mkdir", "delete"]);
+    const MUTATING = new Set(["write", "edit", "bash", "mkdir", "delete", "ast_edit", "computer", "lsp_rename", "debug"]);
     const ro: Record<string, ToolHandler> = {};
     for (const [name, handler] of Object.entries(DEFAULT_TOOLS)) {
       if (MUTATING.has(name)) continue;

package/src/agent/task-tool.ts

@@ -78,6 +78,27 @@ const MAX_FANOUT = 4;
  *  parent turn. Split larger efforts into sequential task calls. */
 const MAX_SERIAL_EXECUTOR = 6;
 
+/** Minimum distinct, non-filler words a spawn-gate justification must contain.
+ *  A bare length check (`.length >= 20`) previously accepted any 20-char string
+ *  ("xxxxxxxxxxxxxxxxxxxx", "asdf asdf asdf asdf"), which defeated the intent of
+ *  the gate (force the model to actually justify the parallelism, not just pay a
+ *  cheap toll). This does not attempt real NLP — it only rejects the trivially
+ *  degenerate cases a model would use to rubber-stamp past the gate. */
+const JUSTIFICATION_MIN_DISTINCT_WORDS = 4;
+
+/** True when `text` reads as an actual justification rather than filler padding
+ *  used only to clear the ≥20-char length bar. */
+function isMeaningfulJustification(text: string): boolean {
+  const trimmed = text.trim();
+  if (trimmed.length < 20) return false;
+  // Reject strings that are one character (or one repeated short token) padded out —
+  // e.g. "xxxxxxxxxxxxxxxxxxxx" or "aaaa aaaa aaaa aaaa".
+  if (/^(.)\1*$/.test(trimmed.replace(/\s+/g, ""))) return false;
+  const words = trimmed.toLowerCase().match(/[a-z0-9']+/g) ?? [];
+  const distinct = new Set(words);
+  return distinct.size >= JUSTIFICATION_MIN_DISTINCT_WORDS;
+}
+
 /** Broadcast steering hub for a fan-out batch. Each concurrent worker registers
  *  ONCE and then sees every parent steer message exactly once (append-only log +
  *  per-worker cursor), so a mid-batch redirect reaches all running subagents
@@ -320,13 +341,13 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       // stays bounded at MAX_FANOUT (read-only) or 1 (mutating) regardless.
       if (items.length > MAX_FANOUT) {
         const justification = typeof args.justification === "string" ? args.justification.trim() : "";
-        if (justification.length < 20) {
+        if (!isMeaningfulJustification(justification)) {
           return {
             success: false,
             output: "",
             error:
               `Fan-out of ${items.length} tasks exceeds the default gate of ${MAX_FANOUT}. ` +
-              `Either reduce the batch, or resend with a "justification" string (≥20 chars) explaining why these tasks are independent and must run in one batch.`,
+              `Either reduce the batch, or resend with a "justification" string (≥20 chars, ≥${JUSTIFICATION_MIN_DISTINCT_WORDS} distinct words, not filler) explaining why these tasks are independent and must run in one batch.`,
           };
         }
       }
@@ -371,10 +392,11 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
     }
     // Detached form (#9): register a background run and return immediately so the
     // parent can keep working, then list/inspect/await/cancel via the `subagent`
-    // tool. Steering is not forwarded to a detached run (no single active drainer).
+    // tool. Live peer messaging (steer/irc) DOES reach a detached run — it drains
+    // its own registry inbox (registry.steerDrainFor(id)) between its own steps.
     if (args.detached === true && opts.registry) {
-      const rec = opts.registry.launch(role.id, taskText, signal =>
-        runOne(role, taskText, ctx(args.context), cwd, { signal }),
+      const rec = opts.registry.launch(role.id, taskText, (signal, id) =>
+        runOne(role, taskText, ctx(args.context), cwd, { signal, steer: opts.registry!.steerDrainFor(id) }),
       );
       return {
         success: true,

package/src/agent/tools.ts

@@ -226,7 +226,7 @@ function excerptForRecovery(content: string, centerLine?: number): string {
  *  Refreshes the snapshot to CURRENT so the immediate retry (model just saw fresh content) passes. */
 async function staleReadError(absPath: string, filePath: string, verb: string): Promise<ToolResult | null> {
   const snap = lastReadSnapshots.get(absPath);
-  if (!snap) return null; // never read → no guard (back-compat; read-first is advisory)
+  if (!snap) return null; // never read → no guard here (see the narrow blind-replace guard in editTool)
   const st = await fs.stat(absPath).catch(() => null);
   if (!st || !st.isFile()) return null; // deleted/replaced-by-dir: let the op surface its own error
   if (st.mtimeMs === snap.mtimeMs && st.size === snap.size) return null;
@@ -509,6 +509,24 @@ export async function editTool(
             error: `Invalid edit range ${startLine}..${endLine}: out of bounds or reversed (file has ${lines.length} lines)`,
           };
         }
+        // Narrow blind-replace guard: a ≔A..B REPLACE with NO anchors on EITHER
+        // bound carries zero content verification (SEARCH/REPLACE self-verifies via
+        // the search text matching; an anchored ≔ self-verifies via the hash). If the
+        // agent never read this file THIS SESSION, it has nothing to base a blind
+        // line-range replace on — reject instead of silently overwriting unseen lines.
+        // (Insert/append directives above are unaffected: they don't destroy content.
+        // Checked AFTER the bounds check so an out-of-range request still reports as
+        // out-of-range rather than being masked by this guard.)
+        if (!aStart && !aEnd && !lastReadSnapshots.has(absPath)) {
+          return {
+            success: false,
+            output: "",
+            error:
+              `Edit rejected: ${filePath} — a line-range replace with no anchors and no prior read this session ` +
+              `has nothing to verify against. Read the file first, then retry (or include the hashline anchors ` +
+              `from read output, or use a <<<<<<< SEARCH block instead).`,
+          };
+        }
         const mismatch = anchorMismatch(s, aStart) ?? anchorMismatch(e, aEnd);
         if (mismatch) return mismatch;
         lines.splice(s - 1, e - s + 1, payload);
@@ -647,6 +665,47 @@ async function drainPipe(
   return out;
 }
 
+// ── Destructive-bash hard block (applies to EVERY bash call, main agent and
+// subagent alike — including the bundled `executor` role, whose bash is
+// otherwise unconstrained since `bashAllowedPrefixes` is an opt-in allowlist
+// no bundled role sets). This is a narrow denylist for unambiguously
+// catastrophic, effectively-irreversible commands, not a general policy
+// filter — everyday destructive-but-scoped commands (rm -rf node_modules,
+// git reset --hard, force-push) stay unconstrained by design. ──
+function stripLeadingSudo(tokens: string[]): string[] {
+  return tokens[0] === "sudo" ? tokens.slice(1) : tokens;
+}
+
+/** True for `rm -rf /`, `rm -fr ~`, `sudo rm -Rf /`, etc. — a recursive,
+ *  forced delete whose target normalizes to the filesystem root or the home
+ *  directory. Scoped deletes (`rm -rf ./dist`, `rm -rf /tmp/x`) are untouched. */
+function isRootOrHomeWipe(command: string): boolean {
+  for (const raw of command.split(/(?:&&|\|\||[;|])/)) {
+    const tokens = stripLeadingSudo(raw.trim().split(/\s+/).filter(Boolean));
+    if (tokens.length === 0) continue;
+    const cmd = tokens[0].replace(/^.*\//, "");
+    if (cmd !== "rm") continue;
+    const flagTokens = tokens.slice(1).filter(t => t.startsWith("-"));
+    const flags = flagTokens.join("");
+    if (!/r/i.test(flags) || !/f/i.test(flags)) continue;
+    const targets = tokens.slice(1).filter(t => !t.startsWith("-"));
+    for (const t of targets) {
+      const norm = t.replace(/\/+$/, "");
+      if (norm === "" || norm === "/" || norm === "~" || norm === "$HOME" || norm === "${HOME}") return true;
+    }
+  }
+  return false;
+}
+
+/** Returns a short human-readable reason when `command` matches a catastrophic,
+ *  effectively-irreversible pattern; null when it does not. */
+function bashDestructiveReason(command: string): string | null {
+  if (isRootOrHomeWipe(command)) return "a recursive force-delete of the filesystem root or home directory (rm -rf / or ~)";
+  if (/:\(\)\s*\{\s*:\s*\|\s*:&?\s*;?\s*\}\s*;\s*:/.test(command)) return "a fork-bomb pattern";
+  if (/\bdd\b[^\n]*\bof=\/dev\/(disk|[rs]?[hsv]d[a-z]?|nvme\w*|xvd\w*)/i.test(command)) return "a raw disk-device overwrite (dd ... of=/dev/...)";
+  if (/\bmkfs(?:\.\w+)?\s+.*\/dev\//i.test(command)) return "a filesystem format on a raw device (mkfs)";
+  return null;
+}
 export async function bashTool(
   command: string,
   cwd: string = process.cwd(),
@@ -660,6 +719,14 @@ export async function bashTool(
     const fx = applyBashFixups(command);
     command = fx.command;
   }
+  const destructive = bashDestructiveReason(command);
+  if (destructive) {
+    return {
+      success: false,
+      output: "",
+      error: `bash rejected: this command looks like ${destructive}. If this is genuinely intended, ask the user to run it manually — it is not permitted from the agent.`,
+    };
+  }
   try {
     // The mutation lock is keyed on the PROJECT cwd, not the run subdir.
     await assertBashAllowed(cwd);