jeo-code 0.7.37 → 0.7.39

package/CHANGELOG.md

@@ -6,6 +6,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.39] - 2026-07-05
+_Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder._
+
+### Fixed
+- **Anthropic's new `Refusal (reasoning_extraction): …` refusal message (Claude Fable 5) was not recognized as a refusal.** `isRefusalError` (`src/util/retry.ts`) only matched older shapes (`stop_reason=refusal`, `finish_reason=content_filter`, `(SAFETY)`, `(PROHIBITED_CONTENT)`, `(BLOCKLIST)`); Anthropic's `stop_details.category` refusal wording falls outside all of them, so `defaultRetryable` and `engine.ts`'s refusal ladder (free resend → context-reset + strip replayed thinking → strip `<project_context>` → abortable backoff) never engaged, and `friendlyProviderError` fell through to a raw passthrough — the user saw the bare provider text and the turn died. The regex now also matches the general `Refusal (<category>):` structural prefix so any current or future `stop_details.category` value is covered, not just `reasoning_extraction`. `friendlyProviderError` additionally appends a clarifying note specifically for `reasoning_extraction`: this category's wording reads like an accusation of extracting the model's internal reasoning, which is a common false positive for jeo's own thinking-block replay across multi-step tool use, not an actual violation.
+
+### Verified
+- `bun run typecheck` clean; full suite green.
+- New coverage in `test/refusal-recovery.test.ts`: `isRefusalError` recognizes the new shape (plus a synthetic future category, proving the fix isn't overfit to one literal string) while still matching every pre-existing shape and never false-positiving on an unrelated error; `friendlyProviderError` category-aware messaging; an end-to-end refusal-ladder engagement test via `runAgentLoop` with a mocked provider throwing the new shape.
+
+## [0.7.38] - 2026-07-05
+_Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes._
+
+### Fixed
+- **Chat authorization on inbound Telegram commands (security).** `TelegramDaemon.handleUpdate` now drops any update whose `message.chat.id` does not match the configured `notifications.telegram.chatId` — previously `handleInboundText` ran for ANY update the bot received, so `/steer`/`/cancel`/`/subagents` were reachable by any Telegram user who found the bot (bot usernames are publicly enumerable), not just the account that ran `jeo notify setup`. Unauthorized updates are dropped silently (no reply), so probing the bot doesn't confirm it's live. `pollTelegramLoop` now delegates through `handleUpdate` instead of calling `handleInboundText` directly.
+- **`pollTelegramLoop` hot-loop on a Telegram API error response.** A `getUpdates` call that resolves with `{ ok: false }` (e.g. `409 Conflict` from a second long-poll owner, `401` from a revoked token) previously looped immediately with no delay; only a thrown/network error had the existing 2s backoff. Both paths now share the same `sleep(2_000)`.
+
+### Changed
+- `formatNotifyEvent`/`formatSubagentsList` shared status→icon logic deduplicated into one `STATUS_ICON: Record<SubagentRecord["status"], string>` lookup (was two separately-maintained icon mappings, one keyed by event kind, one by an inline ternary chain keyed by status).
+- `SessionNotifyEndpoint`'s `WsData` payload type (`{ authed: true }`) removed — the value was written into every upgraded socket's `data` but never read anywhere; the server/socket types are now `Server<undefined>`/`ServerWebSocket<undefined>`, and the `fetch` handler is a lexical-`this` arrow function instead of a `const self = this` capture.
+- `parseSteerCommand`/`parseCancelCommand` return inline object types instead of the one-call-site `ParsedSteerCommand`/`ParsedCancelCommand` exported interfaces (no external caller used either name).
+- `TelegramDaemon#sendRequest` and `daemon-control.ts`'s `waitFor` now use `Promise.withResolvers()` instead of the `new Promise((resolve) => …)` executor form (repo convention).
+
+### Verified
+- `bun run typecheck` clean; `bun test` 2371 pass / 0 fail (3 new `handleUpdate` cases: paired-chat command dispatches, other-chat command is silently dropped including a `/cancel` attempt, no-text update is ignored; all pre-existing notify-daemon/session-endpoint/daemon-control suites pass unchanged against the refactor).
+
 ## [0.7.37] - 2026-07-05
 _Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack)._
 

package/README.ja.md

@@ -207,11 +207,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
+- **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
 - **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 - **[0.7.36]** (2026-07-04) — Removes two specific guardrails per explicit user direction: `jeo approve`'s human-only identity gate (the agent can now approve its own reviewed `jeo ralplan` plan) and the disk-staleness write/edit clobber guard (a write/edit no longer refuses just because the file changed on disk since the last read). Both removals were scoped narrowly after enumerating every guardrail in the codebase — the catastrophic-command hard block (`rm -rf /`, fork bombs, raw-disk `dd`/`mkfs`), the read-only subagent role tool gating, the deep-interview mutation lock, and the blind-edit (never-read-this-session) guard are all UNCHANGED.
 - **[0.7.35]** (2026-07-04) — `jeo team` now runs every plan step through the SAME subagent execution core as the `task`/`subagent` tools, and gains gjc-style concurrent workers: a plan can mark a contiguous run of independent steps to execute in parallel, each isolated in its own git worktree, merged back in order.
-- **[0.7.34]** (2026-07-04) — gajae-code 0.8.0/0.8.1 parity audit: closes a real cross-provider lone-surrogate JSON bug and makes turn-boundary compaction Esc-cancellable; the rest of gjc's 0.8.x release (Telegram daemon, ACP, cmux, coordinator MCP, tool-discovery-mode, an internal paged transcript viewport) is gjc-specific architecture jeo intentionally does not replicate, or was already-equivalent (confirmed by a 4-way parallel audit: ast_grep formatting, session-picker empty-filter clamping, PageUp/PageDown).
-- **[0.7.33]** (2026-07-04) — Adds `browser` — headless Chromium automation (gjc `browser` parity) — completing the gjc tool-surface parity pass started in 0.7.32.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -207,11 +207,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
+- **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
 - **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 - **[0.7.36]** (2026-07-04) — Removes two specific guardrails per explicit user direction: `jeo approve`'s human-only identity gate (the agent can now approve its own reviewed `jeo ralplan` plan) and the disk-staleness write/edit clobber guard (a write/edit no longer refuses just because the file changed on disk since the last read). Both removals were scoped narrowly after enumerating every guardrail in the codebase — the catastrophic-command hard block (`rm -rf /`, fork bombs, raw-disk `dd`/`mkfs`), the read-only subagent role tool gating, the deep-interview mutation lock, and the blind-edit (never-read-this-session) guard are all UNCHANGED.
 - **[0.7.35]** (2026-07-04) — `jeo team` now runs every plan step through the SAME subagent execution core as the `task`/`subagent` tools, and gains gjc-style concurrent workers: a plan can mark a contiguous run of independent steps to execute in parallel, each isolated in its own git worktree, merged back in order.
-- **[0.7.34]** (2026-07-04) — gajae-code 0.8.0/0.8.1 parity audit: closes a real cross-provider lone-surrogate JSON bug and makes turn-boundary compaction Esc-cancellable; the rest of gjc's 0.8.x release (Telegram daemon, ACP, cmux, coordinator MCP, tool-discovery-mode, an internal paged transcript viewport) is gjc-specific architecture jeo intentionally does not replicate, or was already-equivalent (confirmed by a 4-way parallel audit: ast_grep formatting, session-picker empty-filter clamping, PageUp/PageDown).
-- **[0.7.33]** (2026-07-04) — Adds `browser` — headless Chromium automation (gjc `browser` parity) — completing the gjc tool-surface parity pass started in 0.7.32.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -234,11 +234,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
+- **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
 - **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 - **[0.7.36]** (2026-07-04) — Removes two specific guardrails per explicit user direction: `jeo approve`'s human-only identity gate (the agent can now approve its own reviewed `jeo ralplan` plan) and the disk-staleness write/edit clobber guard (a write/edit no longer refuses just because the file changed on disk since the last read). Both removals were scoped narrowly after enumerating every guardrail in the codebase — the catastrophic-command hard block (`rm -rf /`, fork bombs, raw-disk `dd`/`mkfs`), the read-only subagent role tool gating, the deep-interview mutation lock, and the blind-edit (never-read-this-session) guard are all UNCHANGED.
 - **[0.7.35]** (2026-07-04) — `jeo team` now runs every plan step through the SAME subagent execution core as the `task`/`subagent` tools, and gains gjc-style concurrent workers: a plan can mark a contiguous run of independent steps to execute in parallel, each isolated in its own git worktree, merged back in order.
-- **[0.7.34]** (2026-07-04) — gajae-code 0.8.0/0.8.1 parity audit: closes a real cross-provider lone-surrogate JSON bug and makes turn-boundary compaction Esc-cancellable; the rest of gjc's 0.8.x release (Telegram daemon, ACP, cmux, coordinator MCP, tool-discovery-mode, an internal paged transcript viewport) is gjc-specific architecture jeo intentionally does not replicate, or was already-equivalent (confirmed by a 4-way parallel audit: ast_grep formatting, session-picker empty-filter clamping, PageUp/PageDown).
-- **[0.7.33]** (2026-07-04) — Adds `browser` — headless Chromium automation (gjc `browser` parity) — completing the gjc tool-surface parity pass started in 0.7.32.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -207,11 +207,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.39]** (2026-07-05) — Fixes an unrecovered Anthropic refusal on Claude Fable 5: the new `stop_details.category: "reasoning_extraction"` refusal shape wasn't recognized, so the turn died with a raw, unfriendly error instead of engaging jeo's existing context-reset refusal-recovery ladder.
+- **[0.7.38]** (2026-07-05) — Ponytail review of 0.7.37's Telegram daemon: closes a real trust-boundary gap (any Telegram user could steer/cancel subagents, not just the paired chat) and a `getUpdates`-failure hot-loop, plus bloat/style cleanup — no new surface area, no config changes.
 - **[0.7.37]** (2026-07-05) — Remote subagent visibility/control over Telegram (gjc Telegram-daemon parity, scoped to jeo's subagent surface only — no forum topics, no inline keyboards, no image attachments; see CHANGELOG 0.7.34 for what jeo intentionally does not replicate from gjc's full notification stack).
 - **[0.7.36]** (2026-07-04) — Removes two specific guardrails per explicit user direction: `jeo approve`'s human-only identity gate (the agent can now approve its own reviewed `jeo ralplan` plan) and the disk-staleness write/edit clobber guard (a write/edit no longer refuses just because the file changed on disk since the last read). Both removals were scoped narrowly after enumerating every guardrail in the codebase — the catastrophic-command hard block (`rm -rf /`, fork bombs, raw-disk `dd`/`mkfs`), the read-only subagent role tool gating, the deep-interview mutation lock, and the blind-edit (never-read-this-session) guard are all UNCHANGED.
 - **[0.7.35]** (2026-07-04) — `jeo team` now runs every plan step through the SAME subagent execution core as the `task`/`subagent` tools, and gains gjc-style concurrent workers: a plan can mark a contiguous run of independent steps to execute in parallel, each isolated in its own git worktree, merged back in order.
-- **[0.7.34]** (2026-07-04) — gajae-code 0.8.0/0.8.1 parity audit: closes a real cross-provider lone-surrogate JSON bug and makes turn-boundary compaction Esc-cancellable; the rest of gjc's 0.8.x release (Telegram daemon, ACP, cmux, coordinator MCP, tool-discovery-mode, an internal paged transcript viewport) is gjc-specific architecture jeo intentionally does not replicate, or was already-equivalent (confirmed by a 4-way parallel audit: ast_grep formatting, session-picker empty-filter clamping, PageUp/PageDown).
-- **[0.7.33]** (2026-07-04) — Adds `browser` — headless Chromium automation (gjc `browser` parity) — completing the gjc tool-surface parity pass started in 0.7.32.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.37",
+  "version": "0.7.39",
 
 
   "description": "Clean, highly optimized AI coding agent using spec-first loop",

package/src/agent/notify/daemon-control.ts

@@ -106,7 +106,9 @@ async function waitFor(predicate: () => Promise<boolean>, timeoutMs: number, ste
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (await predicate()) return true;
-    await new Promise(r => setTimeout(r, stepMs));
+    const { promise, resolve } = Promise.withResolvers<void>();
+    setTimeout(resolve, stepMs);
+    await promise;
   }
   return false;
 }

package/src/agent/notify/session-endpoint.ts

@@ -28,14 +28,10 @@ import type { SubagentRecord, SubagentRegistry } from "../subagent-registry";
 
 const SNAPSHOT_POLL_MS = 1_200;
 
-interface WsData {
-  authed: true;
-}
-
 export class SessionNotifyEndpoint {
-  private server: Server<WsData> | undefined;
+  private server: Server<undefined> | undefined;
 
-  private readonly sockets = new Set<ServerWebSocket<WsData>>();
+  private readonly sockets = new Set<ServerWebSocket<undefined>>();
   private pollTimer: ReturnType<typeof setInterval> | undefined;
   private lastSnapshotJson = "";
   readonly sessionId: string;
@@ -66,7 +62,7 @@ export class SessionNotifyEndpoint {
     }
   }
 
-  private handleMessage(ws: ServerWebSocket<WsData>, raw: string | Buffer): void {
+  private handleMessage(ws: ServerWebSocket<undefined>, raw: string | Buffer): void {
     let msg: Record<string, unknown>;
     try {
       msg = JSON.parse(String(raw));
@@ -103,29 +99,27 @@ export class SessionNotifyEndpoint {
    *  Idempotent no-op if already started. */
   async start(): Promise<void> {
     if (this.server) return;
-    const self = this;
-    this.server = Bun.serve<WsData>({
-
+    this.server = Bun.serve<undefined>({
       hostname: "127.0.0.1",
       port: 0,
-      fetch(req, server) {
+      fetch: (req, server) => {
         const url = new URL(req.url);
-        if (url.searchParams.get("token") !== self.token) {
+        if (url.searchParams.get("token") !== this.token) {
           return new Response("unauthorized", { status: 401 });
         }
-        if (server.upgrade(req, { data: { authed: true } })) return undefined;
+        if (server.upgrade(req)) return undefined;
         return new Response("upgrade failed", { status: 500 });
       },
       websocket: {
         open: ws => {
-          self.sockets.add(ws);
+          this.sockets.add(ws);
           try {
-            ws.send(JSON.stringify(self.snapshot()));
+            ws.send(JSON.stringify(this.snapshot()));
           } catch {}
         },
-        message: (ws, raw) => self.handleMessage(ws, raw),
+        message: (ws, raw) => this.handleMessage(ws, raw),
         close: ws => {
-          self.sockets.delete(ws);
+          this.sockets.delete(ws);
         },
       },
     });

package/src/agent/notify/telegram-daemon.ts

@@ -22,9 +22,15 @@ import * as path from "node:path";
 import { readGlobalConfig } from "../state";
 import { notifySessionsDir } from "./paths";
 import { acquireDaemonLock, isPidAlive } from "./daemon-control";
-import { TelegramApi } from "./telegram-api";
+import { TelegramApi, type TelegramUpdate } from "./telegram-api";
 import type { SubagentRecord } from "../subagent-registry";
 
+function sleep(ms: number): Promise<void> {
+  const { promise, resolve } = Promise.withResolvers<void>();
+  setTimeout(resolve, ms);
+  return promise;
+}
+
 // ── Pure helpers (unit-testable without network/ws) ────────────────────────────
 
 export type NotifyEventKind = "started" | "completed" | "failed" | "cancelled";
@@ -53,7 +59,8 @@ export function diffSubagentTransitions(prev: SubagentRecord[], next: SubagentRe
   return events;
 }
 
-const NOTIFY_ICON: Record<NotifyEventKind, string> = { started: "▶", completed: "✅", failed: "❌", cancelled: "⏹" };
+/** One icon per subagent status; a "started" event renders as the running icon. */
+const STATUS_ICON: Record<SubagentRecord["status"], string> = { running: "▶", completed: "✅", failed: "❌", cancelled: "⏹" };
 
 function projectName(cwd: string): string {
   return cwd.split(/[\\/]/).filter(Boolean).pop() ?? cwd;
@@ -66,7 +73,7 @@ export function shortSessionId(sessionId: string): string {
 }
 
 export function formatNotifyEvent(shortId: string, cwd: string, ev: NotifyEvent): string {
-  const header = `${NOTIFY_ICON[ev.kind]} [${shortId}] ${projectName(cwd)} · ${ev.record.role} '${ev.record.id}' ${ev.kind}`;
+  const header = `${STATUS_ICON[ev.kind === "started" ? "running" : ev.kind]} [${shortId}] ${projectName(cwd)} · ${ev.record.role} '${ev.record.id}' ${ev.kind}`;
   if (ev.kind === "started") return `${header}\n${ev.record.task}`;
   const resultPreview = (ev.record.result ?? "").slice(0, 500);
   return resultPreview ? `${header}\n${resultPreview}` : header;
@@ -79,29 +86,19 @@ export function formatSubagentsList(sessions: Array<{ sessionId: string; cwd: st
   for (const s of withRecords) {
     lines.push(`— ${shortSessionId(s.sessionId)} (${projectName(s.cwd)})`);
     for (const r of s.records) {
-      const icon = r.status === "running" ? "▶" : r.status === "completed" ? "✅" : r.status === "failed" ? "❌" : "⏹";
-      lines.push(`  ${icon} ${r.role} '${r.id}': ${r.task}`);
+      lines.push(`  ${STATUS_ICON[r.status]} ${r.role} '${r.id}': ${r.task}`);
     }
   }
   return lines.join("\n");
 }
 
-export interface ParsedSteerCommand {
-  shortId: string;
-  subagentId: string;
-  message: string;
-}
-export function parseSteerCommand(text: string): ParsedSteerCommand | undefined {
+export function parseSteerCommand(text: string): { shortId: string; subagentId: string; message: string } | undefined {
   const m = /^\/steer\s+(\S+)\s+(\S+)\s+([\s\S]+)$/.exec(text.trim());
   if (!m) return undefined;
   return { shortId: m[1]!, subagentId: m[2]!, message: m[3]!.trim() };
 }
 
-export interface ParsedCancelCommand {
-  shortId: string;
-  subagentId: string;
-}
-export function parseCancelCommand(text: string): ParsedCancelCommand | undefined {
+export function parseCancelCommand(text: string): { shortId: string; subagentId: string } | undefined {
   const m = /^\/cancel\s+(\S+)\s+(\S+)\s*$/.exec(text.trim());
   if (!m) return undefined;
   return { shortId: m[1]!, subagentId: m[2]! };
@@ -232,23 +229,21 @@ export class TelegramDaemon {
 
   private sendRequest(conn: SessionConnection, frame: Record<string, unknown>): Promise<boolean> {
     const reqId = crypto.randomUUID();
-    const timeoutMs = this.opts.ackTimeoutMs ?? 3_000;
-    const p = new Promise<boolean>(resolve => {
-      this.pendingAcks.set(reqId, resolve);
-      setTimeout(() => {
-        if (this.pendingAcks.has(reqId)) {
-          this.pendingAcks.delete(reqId);
-          resolve(false);
-        }
-      }, timeoutMs);
-    });
+    const { promise, resolve } = Promise.withResolvers<boolean>();
+    this.pendingAcks.set(reqId, resolve);
+    setTimeout(() => {
+      if (this.pendingAcks.has(reqId)) {
+        this.pendingAcks.delete(reqId);
+        resolve(false);
+      }
+    }, this.opts.ackTimeoutMs ?? 3_000);
     try {
       conn.ws.send(JSON.stringify({ ...frame, reqId }));
     } catch {
       this.pendingAcks.delete(reqId);
-      return Promise.resolve(false);
+      resolve(false);
     }
-    return p;
+    return promise;
   }
 
   async handleInboundText(text: string): Promise<void> {
@@ -287,21 +282,35 @@ export class TelegramDaemon {
     if (trimmed.startsWith("/")) await this.notify(`Unrecognized command. ${HELP_TEXT}`);
   }
 
+  /** Trust boundary: a bot's username is publicly discoverable, so ANY Telegram
+   *  user can message it. Only the paired chat (the one that ran
+   *  `jeo notify setup`) may steer/cancel subagents; everything else is dropped
+   *  without a reply (replying would leak that the bot is live). */
+  async handleUpdate(update: TelegramUpdate): Promise<void> {
+    const msg = update.message;
+    if (!msg?.text) return;
+    if (String(msg.chat.id) !== this.opts.chatId) return;
+    await this.handleInboundText(msg.text);
+  }
+
   private async pollTelegramLoop(): Promise<void> {
     while (!this.stopped) {
       let res;
       try {
         res = await this.opts.telegram.getUpdates(this.updateOffset, 25);
       } catch {
-        await new Promise(r => setTimeout(r, 2_000));
+        await sleep(2_000);
         continue;
       }
-      if (res.ok) {
-        for (const update of res.result) {
-          this.updateOffset = update.update_id + 1;
-          const text = update.message?.text;
-          if (text) await this.handleInboundText(text);
-        }
+      if (!res.ok) {
+        // e.g. 409 Conflict (another getUpdates owner) or 401 (revoked token) —
+        // without a pause this would hot-loop against the API.
+        await sleep(2_000);
+        continue;
+      }
+      for (const update of res.result) {
+        this.updateOffset = update.update_id + 1;
+        await this.handleUpdate(update);
       }
     }
   }

package/src/util/provider-error.ts

@@ -61,7 +61,12 @@ export function friendlyProviderError(err: unknown): string {
     return `${provider} rejected the request: the conversation no longer fits the model's context window. Run /compact, drop large attachments, or start a fresh session.`;
   }
   if (isRefusalError(err)) {
-    return `${provider} declined to answer (safety refusal — no content returned). Usually a content classifier tripped on recently read file/search content: /retry, /compact or /new to drop the triggering context, or switch model with /model. If this persists on a Claude subscription (OAuth) login, Anthropic restricts third-party OAuth clients — set ANTHROPIC_API_KEY or use another provider.`;
+    const base = `${provider} declined to answer (safety refusal — no content returned). Usually a content classifier tripped on recently read file/search content: /retry, /compact or /new to drop the triggering context, or switch model with /model. If this persists on a Claude subscription (OAuth) login, Anthropic restricts third-party OAuth clients — set ANTHROPIC_API_KEY or use another provider.`;
+    const category = /Refusal \((\w+)\)/i.exec(msg)?.[1];
+    if (category === "reasoning_extraction") {
+      return `${base} (Category: reasoning_extraction — this classifier flags requests that look like probing the model's internal reasoning; jeo's own thinking-block replay across multi-step tool use is a common benign trigger, not an actual violation. /retry after a /compact usually clears it.)`;
+    }
+    return base;
   }
   if (status === 404) {
     return `${provider} does not recognize the requested model (HTTP 404). The id may be retired, gated, or mistyped — pick another with /model.`;

package/src/util/retry.ts

@@ -282,5 +282,5 @@ export function isUsageLimitError(err: unknown): boolean {
  *  capped backoff — gjc parity: a refusal is never terminal) is the correct recovery
  *  layer because it MUTATES the context between attempts. */
 export function isRefusalError(err: unknown): boolean {
-  return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)/i.test(errorMessageOf(err));
+  return /stop_reason=refusal|finish_reason=content_filter|\(content_filter\)|\(SAFETY\)|\(PROHIBITED_CONTENT\)|\(BLOCKLIST\)|Refusal \(\w+\)/i.test(errorMessageOf(err));
 }