jeo-code 0.7.33 → 0.7.37

package/src/agent/task-tool.ts

@@ -29,6 +29,8 @@ import {
 } from "./subagents";
 import { resolveMaxOutputTokens } from "../ai/model-manager";
 import type { SubagentRegistry } from "./subagent-registry";
+import { ensureSessionNotifyEndpoint } from "./notify/session-endpoint";
+
 
 /** Lifecycle event emitted while a delegated subagent runs. */
 export interface TaskSubEvent {
@@ -187,13 +189,171 @@ export function fenceSubagentReport(detail: string): string {
   ].join("\n");
 }
 
+/**
+ * Build a `task` ToolHandler bound to a config + (optional) abort signal. The
+ * handler accepts `{ role?, task | prompt | assignment, context? }`.
+ */
+export interface RunSubagentOptions {
+  /** Resolves per-role model/step/thinking overrides; `defaultModel` is the fallback. */
+  config: Pick<Config, "defaultModel" | "subagents" | "thinkingLevel">;
+  /** Forwarded to the subagent's own runAgentLoop so Ctrl-C cancels nested work too. */
+  signal?: AbortSignal;
+  /** Optional live sink (e.g. plain-stream rendering of nested progress). */
+  onEvent?: (ev: TaskSubEvent) => void;
+  /** Mid-turn steering drain — see TaskToolOptions.steer for the exact contract. */
+  steer?: () => string[];
+  /** 1-based position within a fan-out/parallel batch, for event tagging. */
+  slot?: { index: number; total: number };
+  /** Pre-loaded project context to avoid re-scanning AGENTS.md per batch item. */
+  projectContext?: Awaited<ReturnType<typeof loadProjectContext>>;
+}
+
+/** `runSubagentOnce`'s result — a superset of `ToolResult` exposing the raw
+ *  (unwrapped, unfenced) done reason and mutation-audit counters so a caller with
+ *  its OWN pass/fail policy on top (e.g. `jeo team`'s role-gate-verdict parsing and
+ *  `--strict-mutations`) doesn't have to re-derive them by parsing the formatted
+ *  report text. `task`/`subagent` tool callers only ever need `success`/`output`/
+ *  `error`, which stay structurally identical to plain `ToolResult`. */
+export interface SubagentRunResult extends ToolResult {
+  /** Raw subagent done reason, before contract validation or fencing. */
+  doneReason: string;
+  /** True when the subagent actually called `done` (vs. exhausting its step
+   *  budget or being force-stopped by an engine guard, e.g. a repeat-call loop). */
+  done: boolean;
+  /** Whether the done reason satisfied the role's required-marker contract. */
+  contractOk: boolean;
+  /** Required markers missing from the done reason, when `contractOk` is false. */
+  missingMarkers?: string[];
+  /** Successful write/edit/mkdir/delete calls observed (mutation audit evidence). */
+  fileMutations: number;
+  /** Successful bash calls observed (tracked apart — bash CAN mutate but isn't proof). */
+  bashRuns: number;
+}
+
+/**
+ * Run ONE subagent role to completion against `taskText`/`context` and format its
+ * report (fenced against prompt injection). This is the single execution core
+ * shared by the `task` tool's single/fan-out/detached paths AND `jeo team`'s plan
+ * executor (`src/commands/team.ts`) — there is exactly one way a jeo-code subagent
+ * runs, whether it was launched interactively, in a batch, detached, or as a team
+ * plan step.
+ */
+export async function runSubagentOnce(
+  role: ReturnType<typeof getSubagentRole> & {},
+  taskText: string,
+  context: string,
+  cwd: string,
+  opts: RunSubagentOptions,
+): Promise<SubagentRunResult> {
+  const { steer, slot, projectContext: preloadedContext, signal } = opts;
+  // Tag every live event with its fan-out slot so a parent monitor can tell
+  // task 1 from task 3 when several same-role subagents stream concurrently.
+  const emit = (ev: TaskSubEvent) =>
+    opts.onEvent?.(slot ? { ...ev, index: slot.index, total: slot.total } : ev);
+  const model = resolveSubagentModel(role.id, opts.config);
+  const maxSteps = resolveSubagentMaxSteps(role.id, opts.config);
+  // gjc parity: a role may pin its own reasoning budget; absent = inherit the
+  // session/global thinking level (the "(inherit)" row in the picker).
+  const thinking = resolveSubagentThinking(role.id, opts.config) ?? opts.config.thinkingLevel;
+  const projectContext = preloadedContext ?? await loadProjectContext(cwd);
+  const memorySection = await memoryPromptSection(cwd, taskText);
+  const systemBase = withProjectContext(subagentSystemPrompt(role), projectContext);
+  const history: Message[] = [
+    { role: "system", content: memorySection ? `${systemBase}\n\n${memorySection}` : systemBase },
+    { role: "user", content: `${taskText}${context}` },
+  ];
+
+  const trace: string[] = [];
+  let lastTarget = "";
+  let currentStep = 0;
+  // Round-8 (architect ref 7-Round7Workflow): count the subagent's SUCCESSFUL
+  // calls so the parent can audit a "Changed Files:" claim against observed
+  // reality. File-writing tools (write/edit/mkdir/delete) are tracked apart from
+  // bash: read-only bash (e.g. `bun test`) MUST NOT count as edit evidence, but
+  // bash CAN mutate, so the audit message distinguishes the two cases.
+  let fileMutations = 0;
+  let bashRuns = 0;
+  emit({ role: role.id, kind: "start", detail: taskText, maxSteps, model });
+  const result = await runAgentLoop(history, {
+    cwd,
+    model,
+    maxSteps,
+    maxTokens: resolveMaxOutputTokens(model, thinking),
+    // Per-run prompt-cache key: the subagent replays its own growing history each
+    // step, so a stable per-run key gets provider cache hits (gjc sub-session parity).
+    sessionKey: crypto.randomUUID(),
+    // Bounded delegation: a subagent's step contract stays exact — the parent
+    // owns any retry/extension decision, so the gjc retry flow is disabled here.
+    budget: { maxExtensions: 0 },
+    signal,
+    steer,
+    tools: subagentToolset(role),
+    events: {
+      onStep: n => { currentStep = n; },
+      onAssistant: (_raw, invocation) => {
+        if (invocation && invocation.tool && invocation.tool !== "done") {
+          lastTarget = toolTarget(invocation.tool, invocation.arguments);
+          trace.push(`  step ${currentStep}/${maxSteps}: ${lastTarget}`);
+          emit({ role: role.id, kind: "step", detail: lastTarget, step: currentStep, maxSteps, model });
+        }
+      },
+      onToolResult: (tool, success, output) => {
+        if (success) {
+          if (tool === "write" || tool === "edit" || tool === "mkdir" || tool === "delete") fileMutations++;
+          else if (tool === "bash") bashRuns++;
+        }
+        const label = lastTarget || tool;
+        const summary = firstUsefulLine(output);
+        const suffix = summary ? ` — ${summary}` : "";
+        trace.push(`  ${success ? "✓" : "✗"} ${label}${suffix}`);
+        emit({ role: role.id, kind: "tool", detail: label, success, summary, step: currentStep, maxSteps, model });
+        lastTarget = "";
+      },
+      // Retry notices (rate-limit backoff etc.) surface as live "step" beats so the
+      // parent's monitor shows WHY a subagent is pausing instead of going silent.
+      onNotice: msg => emit({ role: role.id, kind: "step", detail: msg, step: currentStep, maxSteps, model }),
+      // Mid-turn steering reached this subagent: surface it as a live beat so the
+      // parent's monitor shows the redirect instead of an unexplained behavior change.
+      onSteer: text => emit({ role: role.id, kind: "step", detail: `↳ steer: ${text}`, step: currentStep, maxSteps, model }),
+    },
+  });
+  const reason = result.doneReason?.trim() || `(subagent reached the ${result.steps}-step limit without signaling done)`;
+  const validation = validateSubagentDoneReason(role, reason);
+  const complete = result.done && validation.ok;
+  const detail = validation.ok ? reason : `${reason}\n\n[contract incomplete: missing ${validation.missing?.join(", ")}]`;
+  emit({ role: role.id, kind: "done", detail, success: complete, step: result.steps, maxSteps, model, tokens: result.usage ? { input: result.usage.inputTokens, output: result.usage.outputTokens } : undefined });
+  const tokNote = result.usage ? `, ${result.usage.inputTokens + result.usage.outputTokens} tok` : "";
+  const header = `[${role.title} subagent] ${complete ? "completed" : "stopped"} in ${result.steps} step(s) on ${model}${tokNote}.`;
+  const body = trace.length ? `\nSteps:\n${trace.join("\n")}` : "";
+  // Parent-side audit: a mutating role that "completed" without a successful file
+  // mutation (write/edit/mkdir/delete) likely changed nothing — flag the claim.
+  // bash is tracked separately: it CAN mutate, so an only-bash run downgrades to
+  // "verify independently" instead of the stronger UNVERIFIED.
+  const audit = complete && !role.readOnly && fileMutations === 0
+    ? bashRuns === 0
+      ? `\n[parent audit] No successful write/edit/bash was observed in this run — treat any "Changed Files:" claims above as UNVERIFIED.`
+      : `\n[parent audit] No successful write/edit was observed (only bash ran); bash may or may not have mutated files — verify any "Changed Files:" claims above independently.`
+    : "";
+  return {
+    success: complete,
+    output: `${header}${body}\n\nResult:\n${fenceSubagentReport(detail)}${audit}`,
+    doneReason: reason,
+    done: result.done,
+    contractOk: validation.ok,
+    missingMarkers: validation.ok ? undefined : validation.missing,
+    fileMutations,
+    bashRuns,
+  };
+}
+
 /**
  * Build a `task` ToolHandler bound to a config + (optional) abort signal. The
  * handler accepts `{ role?, task | prompt | assignment, context? }`.
  */
 export function createTaskTool(opts: TaskToolOptions): ToolHandler {
-  /** Run ONE subagent to completion and format its result (the original single-task path). */
-  const runOne = async (
+  /** Run ONE subagent via the shared execution core, binding this tool instance's
+   *  config/signal/onEvent (the original single-task path). */
+  const runOne = (
     role: ReturnType<typeof getSubagentRole> & {},
     taskText: string,
     context: string,
@@ -206,98 +366,15 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
        *  is cancellable independently of the parent turn. */
       signal?: AbortSignal;
     } = {},
-  ): Promise<ToolResult> => {
-    const { steer, slot, projectContext: preloadedContext, signal: signalOverride } = extra;
-    // Tag every live event with its fan-out slot so a parent monitor can tell
-    // task 1 from task 3 when several same-role subagents stream concurrently.
-    const emit = (ev: TaskSubEvent) =>
-      opts.onEvent?.(slot ? { ...ev, index: slot.index, total: slot.total } : ev);
-    const model = resolveSubagentModel(role.id, opts.config);
-    const maxSteps = resolveSubagentMaxSteps(role.id, opts.config);
-    // gjc parity: a role may pin its own reasoning budget; absent = inherit the
-    // session/global thinking level (the "(inherit)" row in the picker).
-    const thinking = resolveSubagentThinking(role.id, opts.config) ?? opts.config.thinkingLevel;
-    const projectContext = preloadedContext ?? await loadProjectContext(cwd);
-    const memorySection = await memoryPromptSection(cwd, taskText);
-    const systemBase = withProjectContext(subagentSystemPrompt(role), projectContext);
-    const history: Message[] = [
-      { role: "system", content: memorySection ? `${systemBase}\n\n${memorySection}` : systemBase },
-      { role: "user", content: `${taskText}${context}` },
-    ];
-
-    const trace: string[] = [];
-    let lastTarget = "";
-    let currentStep = 0;
-    // Round-8 (architect ref 7-Round7Workflow): count the subagent's SUCCESSFUL
-    // calls so the parent can audit a "Changed Files:" claim against observed
-    // reality. File-writing tools (write/edit/mkdir/delete) are tracked apart from
-    // bash: read-only bash (e.g. `bun test`) MUST NOT count as edit evidence, but
-    // bash CAN mutate, so the audit message distinguishes the two cases.
-    let fileMutations = 0;
-    let bashRuns = 0;
-    emit({ role: role.id, kind: "start", detail: taskText, maxSteps, model });
-    const result = await runAgentLoop(history, {
-      cwd,
-      model,
-      maxSteps,
-      maxTokens: resolveMaxOutputTokens(model, thinking),
-      // Per-run prompt-cache key: the subagent replays its own growing history each
-      // step, so a stable per-run key gets provider cache hits (gjc sub-session parity).
-      sessionKey: crypto.randomUUID(),
-      // Bounded delegation: a subagent's step contract stays exact — the parent
-      // owns any retry/extension decision, so the gjc retry flow is disabled here.
-      budget: { maxExtensions: 0 },
-      signal: signalOverride ?? opts.signal,
-      steer,
-      tools: subagentToolset(role),
-      events: {
-        onStep: n => { currentStep = n; },
-        onAssistant: (_raw, invocation) => {
-          if (invocation && invocation.tool && invocation.tool !== "done") {
-            lastTarget = toolTarget(invocation.tool, invocation.arguments);
-            trace.push(`  step ${currentStep}/${maxSteps}: ${lastTarget}`);
-            emit({ role: role.id, kind: "step", detail: lastTarget, step: currentStep, maxSteps, model });
-          }
-        },
-        onToolResult: (tool, success, output) => {
-          if (success) {
-            if (tool === "write" || tool === "edit" || tool === "mkdir" || tool === "delete") fileMutations++;
-            else if (tool === "bash") bashRuns++;
-          }
-          const label = lastTarget || tool;
-          const summary = firstUsefulLine(output);
-          const suffix = summary ? ` — ${summary}` : "";
-          trace.push(`  ${success ? "✓" : "✗"} ${label}${suffix}`);
-          emit({ role: role.id, kind: "tool", detail: label, success, summary, step: currentStep, maxSteps, model });
-          lastTarget = "";
-        },
-        // Retry notices (rate-limit backoff etc.) surface as live "step" beats so the
-        // parent's monitor shows WHY a subagent is pausing instead of going silent.
-        onNotice: msg => emit({ role: role.id, kind: "step", detail: msg, step: currentStep, maxSteps, model }),
-        // Mid-turn steering reached this subagent: surface it as a live beat so the
-        // parent's monitor shows the redirect instead of an unexplained behavior change.
-        onSteer: text => emit({ role: role.id, kind: "step", detail: `↳ steer: ${text}`, step: currentStep, maxSteps, model }),
-      },
+  ): Promise<ToolResult> =>
+    runSubagentOnce(role, taskText, context, cwd, {
+      config: opts.config,
+      signal: extra.signal ?? opts.signal,
+      onEvent: opts.onEvent,
+      steer: extra.steer,
+      slot: extra.slot,
+      projectContext: extra.projectContext,
     });
-    const reason = result.doneReason?.trim() || `(subagent reached the ${result.steps}-step limit without signaling done)`;
-    const validation = validateSubagentDoneReason(role, reason);
-    const complete = result.done && validation.ok;
-    const detail = validation.ok ? reason : `${reason}\n\n[contract incomplete: missing ${validation.missing?.join(", ")}]`;
-    emit({ role: role.id, kind: "done", detail, success: complete, step: result.steps, maxSteps, model, tokens: result.usage ? { input: result.usage.inputTokens, output: result.usage.outputTokens } : undefined });
-    const tokNote = result.usage ? `, ${result.usage.inputTokens + result.usage.outputTokens} tok` : "";
-    const header = `[${role.title} subagent] ${complete ? "completed" : "stopped"} in ${result.steps} step(s) on ${model}${tokNote}.`;
-    const body = trace.length ? `\nSteps:\n${trace.join("\n")}` : "";
-    // Parent-side audit: a mutating role that "completed" without a successful file
-    // mutation (write/edit/mkdir/delete) likely changed nothing — flag the claim.
-    // bash is tracked separately: it CAN mutate, so an only-bash run downgrades to
-    // "verify independently" instead of the stronger UNVERIFIED.
-    const audit = complete && !role.readOnly && fileMutations === 0
-      ? bashRuns === 0
-        ? `\n[parent audit] No successful write/edit/bash was observed in this run — treat any "Changed Files:" claims above as UNVERIFIED.`
-        : `\n[parent audit] No successful write/edit was observed (only bash ran); bash may or may not have mutated files — verify any "Changed Files:" claims above independently.`
-      : "";
-    return { success: complete, output: `${header}${body}\n\nResult:\n${fenceSubagentReport(detail)}${audit}` };
-  };
 
   return async (args: Record<string, any>, cwd: string): Promise<ToolResult> => {
     const roleArg = typeof args.role === "string" ? args.role.trim() : "";
@@ -398,6 +475,10 @@ export function createTaskTool(opts: TaskToolOptions): ToolHandler {
       const rec = opts.registry.launch(role.id, taskText, (signal, id) =>
         runOne(role, taskText, ctx(args.context), cwd, { signal, steer: opts.registry!.steerDrainFor(id) }),
       );
+      // Remote subagent visibility/control over Telegram (gjc daemon parity, see
+      // `src/agent/notify/`): best-effort, no-op unless `notifications.enabled`.
+      ensureSessionNotifyEndpoint(opts.registry, cwd);
+
       return {
         success: true,
         output:

package/src/agent/tools.ts

@@ -189,22 +189,23 @@ function stripAnchorPrefixes(block: string): string | null {
   if (!lines.every(l => l.trim() === "" || ANCHOR_PREFIX_RE.test(l))) return null;
   return lines.map(l => l.replace(ANCHOR_PREFIX_RE, "")).join("\n");
 }
-// ── File-freshness guard (plan/gjc-inheritance.md B7, gjc edit/file-read-cache 계승) ──
-// `read` records each file's stat fingerprint; `edit`/`write` verify it before
-// mutating. A file changed by someone else (concurrent agent, user, formatter)
-// between the read and the edit is REJECTED once — with the CURRENT content
-// re-presented so the model can retry immediately (recovery, not just a guard).
-const lastReadSnapshots = new Map<string, { mtimeMs: number; size: number }>();
+// ── Blind-edit guard (plan/gjc-inheritance.md B7, gjc edit/file-read-cache 계승) ──
+// `read` records that this session has SEEN a path; a line-range `edit` with
+// no hash anchors on either bound refuses to run against a path never read
+// this session (see the narrow guard below in editTool). NOTE: this module
+// does NOT reject a write/edit just because the file changed on disk since
+// the last read — the agent's write always wins (2026-07: guardrail removed
+// per explicit user direction to stop blocking on external/concurrent edits).
+const readThisSession = new Set<string>();
 const MAX_SNAPSHOT_ENTRIES = 64;
 
-function recordReadSnapshot(absPath: string, st: { mtimeMs: number; size: number } | null): void {
-  if (!st) return;
-  if (lastReadSnapshots.size >= MAX_SNAPSHOT_ENTRIES && !lastReadSnapshots.has(absPath)) {
-    const oldest = lastReadSnapshots.keys().next().value;
-    if (oldest !== undefined) lastReadSnapshots.delete(oldest);
+function markRead(absPath: string): void {
+  if (readThisSession.size >= MAX_SNAPSHOT_ENTRIES && !readThisSession.has(absPath)) {
+    const oldest = readThisSession.values().next().value;
+    if (oldest !== undefined) readThisSession.delete(oldest);
   }
-  lastReadSnapshots.delete(absPath); // re-insert to refresh LRU order
-  lastReadSnapshots.set(absPath, { mtimeMs: st.mtimeMs, size: st.size });
+  readThisSession.delete(absPath); // re-insert to refresh LRU order
+  readThisSession.add(absPath);
 }
 
 /** Annotated excerpt of the file's CURRENT content for recovery errors (read-format `N|`). */
@@ -221,26 +222,6 @@ function excerptForRecovery(content: string, centerLine?: number): string {
   const note = lines.length > end - start + 1 ? `\n…(showing lines ${start}-${end} of ${lines.length})` : "";
   return body + note;
 }
-
-/** Returns a recovery error when `absPath` changed since the agent last read it; null when fresh.
- *  Refreshes the snapshot to CURRENT so the immediate retry (model just saw fresh content) passes. */
-async function staleReadError(absPath: string, filePath: string, verb: string): Promise<ToolResult | null> {
-  const snap = lastReadSnapshots.get(absPath);
-  if (!snap) return null; // never read → no guard here (see the narrow blind-replace guard in editTool)
-  const st = await fs.stat(absPath).catch(() => null);
-  if (!st || !st.isFile()) return null; // deleted/replaced-by-dir: let the op surface its own error
-  if (st.mtimeMs === snap.mtimeMs && st.size === snap.size) return null;
-  const content = await fs.readFile(absPath, "utf-8").catch(() => null);
-  recordReadSnapshot(absPath, st); // the model sees the fresh content below → retry passes
-  const excerpt = content !== null ? `\nCurrent content:\n${excerptForRecovery(content)}` : "";
-  return {
-    success: false,
-    output: "",
-    error:
-      `${verb} rejected: ${filePath} changed on disk since you last read it (another agent, the user, or a formatter touched it). ` +
-      `Re-target your ${verb.toLowerCase()} against the CURRENT content below, then retry.${excerpt}`,
-  };
-}
 export async function readTool(
   filePath: string,
   lineRange?: string | number,
@@ -261,7 +242,7 @@ export async function readTool(
       return lsTool(filePath, cwd);
     }
     const content = await fs.readFile(absPath, "utf-8");
-    if (st?.isFile()) recordReadSnapshot(absPath, st); // arm the edit/write freshness guard
+    if (st?.isFile()) markRead(absPath); // arm the blind-edit read-first guard
 
     if (raw) {
       // Verbatim bytes, no "N|" line prefixes (gjc `:raw`), char-capped for context safety.
@@ -339,11 +320,9 @@ export async function writeTool(
     }
     await assertMutationAllowed(filePath, cwd);
     const absPath = path.resolve(cwd, filePath);
-    const stale = await staleReadError(absPath, filePath, "Write");
-    if (stale) return stale;
     await fs.mkdir(path.dirname(absPath), { recursive: true });
     await fs.writeFile(absPath, content, "utf-8");
-    recordReadSnapshot(absPath, await fs.stat(absPath).catch(() => null)); // own change ≠ stale
+    markRead(absPath); // own change counts as having seen the file
     return { success: true, output: `Successfully wrote ${content.length} characters to ${filePath}` };
   } catch (err: any) {
     return { success: false, output: "", error: err.message };
@@ -392,8 +371,6 @@ export async function editTool(
     }
     await assertMutationAllowed(filePath, cwd);
     const absPath = path.resolve(cwd, filePath);
-    const stale = await staleReadError(absPath, filePath, "Edit");
-    if (stale) return stale;
     let content = await fs.readFile(absPath, "utf-8");
 
     // Line-anchored edit parser. Modes (payload follows the directive's newline):
@@ -517,7 +494,7 @@ export async function editTool(
         // (Insert/append directives above are unaffected: they don't destroy content.
         // Checked AFTER the bounds check so an out-of-range request still reports as
         // out-of-range rather than being masked by this guard.)
-        if (!aStart && !aEnd && !lastReadSnapshots.has(absPath)) {
+        if (!aStart && !aEnd && !readThisSession.has(absPath)) {
           return {
             success: false,
             output: "",
@@ -605,7 +582,7 @@ export async function editTool(
     }
 
     await fs.writeFile(absPath, content, "utf-8");
-    recordReadSnapshot(absPath, await fs.stat(absPath).catch(() => null)); // own change ≠ stale
+    markRead(absPath); // own change counts as having seen the file
     return { success: true, output: `Successfully updated ${filePath}` };
   } catch (err: any) {
     return { success: false, output: "", error: err.message };
@@ -1147,7 +1124,7 @@ export async function deleteTool(
       return { success: false, output: "", error: `${targetPath} is a directory — pass recursive:true to remove it and its contents.` };
     }
     await fs.rm(abs, { recursive, force: false });
-    lastReadSnapshots.delete(abs); // a future write to this path must not be flagged stale
+    readThisSession.delete(abs); // a future edit against this path must read it again first
     return { success: true, output: `Deleted ${st.isDirectory() ? "directory" : "file"}: ${targetPath}` };
   } catch (err: any) {
     return { success: false, output: "", error: err.message };

package/src/ai/providers/anthropic.ts

@@ -4,6 +4,7 @@ import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readSse } from "../sse";
 import { ProviderHttpError, parseRetryAfter, parseRetryFromBody, providerHttpError } from "./errors";
 import { serializeToolCalls, serializeAccumulatedToolCalls } from "../../agent/tool-schemas";
+import { sanitizeJsonStrings } from "../../util/sanitize-json";
 
 const ANTHROPIC_URL = "https://api.anthropic.com/v1/messages";
 
@@ -306,7 +307,7 @@ export function anthropicPayload(
   if (stream) payload.stream = true;
   const system = anthropicSystemBlocks(systemPrompt, model, credential, payload, options.baseUrl);
   if (system) payload.system = system;
-  return JSON.stringify(payload);
+  return JSON.stringify(sanitizeJsonStrings(payload));
 }
 
 export function anthropicRequest(

package/src/ai/providers/antigravity.ts

@@ -4,6 +4,7 @@ import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readSse } from "../sse";
 import { providerHttpError } from "./errors";
 import { serializeToolCalls } from "../../agent/tool-schemas";
+import { sanitizeJsonStrings } from "../../util/sanitize-json";
 import { geminiThinkingConfig, getGeminiCliHeaders, type GeminiThinkingConfig } from "./gemini";
 
 const ANTIGRAVITY_DAILY_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
@@ -204,14 +205,14 @@ export function antigravityRequest(messages: Message[], options: CallOptions, cr
     request.toolConfig = { functionCallingConfig: { mode: "AUTO" } };
   }
 
-  const body = JSON.stringify({
+  const body = JSON.stringify(sanitizeJsonStrings({
     project,
     model,
     request,
     requestType: "agent",
     userAgent: "antigravity",
     requestId: `agent-${randomUUID()}`,
-  });
+  }));
   return {
     url: `${endpoint}/v1internal:streamGenerateContent?alt=sse`,
     headers: {

package/src/ai/providers/gemini.ts

@@ -4,6 +4,7 @@ import { readSse } from "../sse";
 import { providerHttpError, fetchWithArtifactFailSafe } from "./errors";
 import { jeoEnv } from "../../util/env";
 import { serializeToolCalls } from "../../agent/tool-schemas";
+import { sanitizeJsonStrings } from "../../util/sanitize-json";
 
 /** Gemini 2.5+/latest models think by default and BILL thought tokens against
  *  `maxOutputTokens` — a small-budget call can burn its entire budget on thoughts
@@ -205,7 +206,7 @@ export function geminiRequest(messages: Message[], options: CallOptions, credent
   const headers: Record<string, string> = oauth
     ? { "content-type": "application/json", authorization: `Bearer ${oauth}` }
     : { "content-type": "application/json" };
-  return { url, headers, body: JSON.stringify(payload) };
+  return { url, headers, body: JSON.stringify(sanitizeJsonStrings(payload)) };
 }
 
 const CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
@@ -236,7 +237,7 @@ export function geminiCliRequest(messages: Message[], options: CallOptions, acce
       accept: "text/event-stream",
       ...getGeminiCliHeaders(geminiModel),
     },
-    body: JSON.stringify({ project: projectId, model: geminiModel, request: payload }),
+    body: JSON.stringify(sanitizeJsonStrings({ project: projectId, model: geminiModel, request: payload })),
   };
 }
 

package/src/ai/providers/ollama.ts

@@ -2,6 +2,7 @@ import type { CallOptions, Message, ProviderAdapter } from "../types";
 import { readLines } from "../sse";
 import { providerHttpError } from "./errors";
 import { createThinkSplitter } from "../think-tags";
+import { sanitizeJsonStrings } from "../../util/sanitize-json";
 
 /**
  * Resolve the Ollama base URL. `OLLAMA_HOST` is documented as a bare host:port
@@ -52,7 +53,7 @@ function ollamaRequest(messages: Message[], options: CallOptions, stream: boolea
   };
   if (options.jsonMode) payload.format = "json";
   const base = normalizeOllamaBaseUrl(options.baseUrl);
-  return { url: `${base}/api/chat`, body: JSON.stringify(payload) };
+  return { url: `${base}/api/chat`, body: JSON.stringify(sanitizeJsonStrings(payload)) };
 }
 
 /** Round-5 #1: surface done_reason when a 200 carries no text (uniform contract). */

package/src/ai/providers/openai-responses.ts

@@ -15,6 +15,7 @@ import type { CallOptions, Message } from "../types";
 import { readSse } from "../sse";
 import { providerHttpError, fetchWithArtifactFailSafe } from "./errors";
 import { serializeAccumulatedToolCalls } from "../../agent/tool-schemas";
+import { sanitizeJsonStrings } from "../../util/sanitize-json";
 import os from "node:os";
 import pkg from "../../../package.json";
 
@@ -141,7 +142,7 @@ export function codexResponsesRequest(
     return {
       url: `${base}/responses`,
       headers: { "content-type": "application/json", authorization: `Bearer ${token}`, accept: "text/event-stream", "user-agent": codexUserAgent() },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(sanitizeJsonStrings(payload)),
     };
   }
   const accountId = extractChatgptAccountId(token);
@@ -161,7 +162,7 @@ export function codexResponsesRequest(
     headers.conversation_id = promptCacheKey;
     headers["x-client-request-id"] = promptCacheKey;
   }
-  return { url: CODEX_RESPONSES_URL, headers, body: JSON.stringify(payload) };
+  return { url: CODEX_RESPONSES_URL, headers, body: JSON.stringify(sanitizeJsonStrings(payload)) };
 }
 
 /** gjc parity (normalizeOpenAIResponsesPromptCacheKey): well-formed unicode, ≤64 chars

package/src/ai/providers/openai.ts

@@ -4,6 +4,7 @@ import { readSse } from "../sse";
 import { providerHttpError } from "./errors";
 import { codexResponsesCall, codexResponsesStream } from "./openai-responses";
 import { serializeToolCalls, serializeAccumulatedToolCalls } from "../../agent/tool-schemas";
+import { sanitizeJsonStrings } from "../../util/sanitize-json";
 import { createThinkSplitter, stripLeakedReasoningTags } from "../think-tags";
 
 /** True for OpenAI reasoning models (o-series + gpt-5+ family). Digit-count agnostic
@@ -96,7 +97,7 @@ export function openaiRequest(messages: Message[], options: CallOptions, credent
   return {
     url: `${base}/chat/completions`,
     headers: { "content-type": "application/json", Authorization: `Bearer ${bearerFor(credential)}` },
-    body: JSON.stringify(payload),
+    body: JSON.stringify(sanitizeJsonStrings(payload)),
   };
 }
 

package/src/cli/runner.ts

@@ -101,6 +101,25 @@ export const COMMANDS: readonly CommandSpec[] = [
       return args => m.runMcpCommand(args);
     },
   },
+  {
+    name: "notify",
+    summary: "Configure/inspect remote subagent notifications over Telegram (gjc notify parity).",
+    usage: "notify [setup [--token <t> --chat-id <id>]|status]",
+    loader: async () => {
+      const m = await import("../commands/notify");
+      return args => m.runNotifyCommand(args);
+    },
+  },
+  {
+    name: "daemon",
+    summary: "Manage the background Telegram notification/subagent-control daemon.",
+    usage: "daemon [status|start|stop|reload]",
+    loader: async () => {
+      const m = await import("../commands/daemon");
+      return args => m.runDaemonCommand(args);
+    },
+  },
+
   {
     name: "skills",
     summary: "List bundled workflow skills, or sync them into ~/.jeo/skills (jeo skills <name> for details).",
@@ -155,6 +174,16 @@ export const COMMANDS: readonly CommandSpec[] = [
       return args => m.runMemoryMigrateCommand(args);
     },
   },
+  {
+    name: "notify-daemon-run",
+    summary: "(internal) Foreground worker for the Telegram notification daemon, spawned by 'jeo daemon start'.",
+    usage: "notify-daemon-run",
+    loader: async () => {
+      const m = await import("../agent/notify/telegram-daemon");
+      return async () => m.runNotifyDaemonForeground();
+    },
+  },
+
   {
     name: "state",
     summary: "Read or update workflow state receipts under .jeo/state (gjc-state parity).",

package/src/commands/AGENTS.md

@@ -9,16 +9,20 @@ Concrete implementations of `jeo` subcommands (e.g., launch, setup, team, ultrag
 ## Key Files
 | File | Description |
 |------|-------------|
-| `approve.ts` | Brief description of purpose |
+| `approve.ts` | `jeo approve <plan-path>` CLI + exported `approvePlan()` core (schema shape, known roles, persisted [OKAY] consensus, hash-vs-consensus match) — shared with the agent-facing `approve` tool (`src/agent/approve-tool.ts`) so the agent can flip a plan's `approved` flag itself; the identity restriction (human-only) was removed 2026-07 per explicit user direction, the content gate was not |
 | `auth.ts` | Brief description of purpose |
 | `chat.ts` | Brief description of purpose |
 | `deep-interview.ts` | Brief description of purpose |
+| `daemon.ts` | `jeo daemon status\|start\|stop\|reload` — manages the background Telegram notification/subagent-control daemon (`src/agent/notify/daemon-control.ts`) |
 | `doctor.ts` | Brief description of purpose |
+
 | `evolve-core.ts` | Brief description of purpose |
 | `evolve.ts` | Brief description of purpose |
 | `export.ts` | Brief description of purpose |
 | `launch.ts` | The primary interactive/one-shot execution command |
 | `mcp.ts` | Brief description of purpose |
+| `notify.ts` | `jeo notify setup\|status` — pairs a Telegram bot (BotFather token + `getMe` verification, private-chat pairing via `getUpdates`) and reports masked settings + daemon state |
+
 | `ooo-seed.ts` | Brief description of purpose |
 | `ralplan.ts` | Brief description of purpose |
 | `resume.ts` | Brief description of purpose |
@@ -28,7 +32,7 @@ Concrete implementations of `jeo` subcommands (e.g., launch, setup, team, ultrag
 | `skills.ts` | Brief description of purpose |
 | `state.ts` | Brief description of purpose |
 | `status.ts` | Brief description of purpose |
-| `team.ts` | Multi-agent coordination command |
+| `team.ts` | `jeo team` — executes an approved ralplan plan step-by-step via the SAME `runSubagentOnce` core the `task`/`subagent` tools use; a contiguous run of steps sharing a plan `parallel_group` runs concurrently in isolated git worktrees (`runParallelGroup`), merged back in order (gjc `team` concurrency parity) |
 | `ultragoal.ts` | Brief description of purpose |
 | `update.ts` | Brief description of purpose |