jeopi-cli 16.2.13 → 16.2.15

package/src/task/critic-gate.test.ts

@@ -0,0 +1,181 @@
+import { afterEach, describe, expect, it, vi } from "bun:test";
+import { Settings } from "../config/settings";
+import type { ToolSession } from "../tools";
+import { enforceCriticGateWrite } from "../tools/plan-mode-guard";
+import {
+	CRITIC_GATE_MAX_STRIKES,
+	type CriticGateState,
+	evaluateCriticGateSpawn,
+	parseCriticVerdict,
+	updateCriticGateState,
+} from "./critic-gate";
+import * as taskDiscovery from "./discovery";
+import * as executor from "./executor";
+import { TaskTool } from "./index";
+import type { AgentDefinition, SingleResult } from "./types";
+
+const criticAgent = {
+	name: "critic",
+	description: "Plan gate.",
+	systemPrompt: "Gate plans.",
+	source: "bundled",
+	tools: ["read", "grep", "glob", "web_search", "ast_grep"],
+} satisfies AgentDefinition;
+
+const workerAgent = {
+	name: "task",
+	description: "General worker.",
+	systemPrompt: "Do work.",
+	source: "bundled",
+} satisfies AgentDefinition;
+
+const planAgent = {
+	name: "plan",
+	description: "Read-only planner.",
+	systemPrompt: "Plan.",
+	source: "bundled",
+	tools: ["read", "grep", "glob"],
+} satisfies AgentDefinition;
+
+function engagedGate(overrides: Partial<CriticGateState> = {}): CriticGateState {
+	return {
+		verdict: "reject",
+		agentId: "Critic1",
+		at: Date.now(),
+		requiredFixes: ["name the target file"],
+		strikes: 1,
+		...overrides,
+	};
+}
+
+function makeSession(gate: { state?: CriticGateState }): ToolSession {
+	const settings = Settings.isolated({
+		"async.enabled": false,
+		"task.batch": true,
+		"task.isolation.mode": "none",
+	});
+	return {
+		cwd: process.cwd(),
+		hasUI: false,
+		settings,
+		getSessionFile: () => null,
+		getSessionSpawns: () => "*",
+		getCriticGateState: () => gate.state,
+		setCriticGateState: state => {
+			gate.state = state;
+		},
+	};
+}
+
+function criticResult(output: string): SingleResult {
+	return {
+		index: 0,
+		id: "Critic1",
+		agent: "critic",
+		agentSource: "bundled",
+		task: "gate the plan",
+		exitCode: 0,
+		output,
+		stderr: "",
+		truncated: false,
+		durationMs: 5,
+		tokens: 1,
+		requests: 1,
+	};
+}
+
+describe("critic gate verdict lifecycle", () => {
+	it("parses schema-shaped verdicts and ignores non-critic payloads", () => {
+		expect(parseCriticVerdict(JSON.stringify({ verdict: "iterate", required_fixes: ["fix a", 3] }))).toEqual({
+			verdict: "iterate",
+			requiredFixes: ["fix a"],
+			summary: undefined,
+		});
+		expect(parseCriticVerdict("not json")).toBeUndefined();
+		expect(parseCriticVerdict(JSON.stringify({ verdict: "maybe" }))).toBeUndefined();
+		expect(parseCriticVerdict(JSON.stringify({ findings: [] }))).toBeUndefined();
+	});
+
+	it("engages on non-okay, counts consecutive strikes, and clears on okay", () => {
+		const first = updateCriticGateState(undefined, { verdict: "iterate", requiredFixes: ["x"] }, "Critic1");
+		expect(first).toMatchObject({ verdict: "iterate", strikes: 1, requiredFixes: ["x"] });
+
+		const second = updateCriticGateState(first, { verdict: "reject", requiredFixes: [] }, "Critic2");
+		expect(second).toMatchObject({ verdict: "reject", strikes: 2, agentId: "Critic2" });
+
+		expect(updateCriticGateState(second, { verdict: "okay", requiredFixes: [] }, "Critic3")).toBeUndefined();
+	});
+
+	it("blocks non-read-only spawns while engaged, keeps read-only lanes open", () => {
+		const state = engagedGate();
+		expect(evaluateCriticGateSpawn(undefined, "task", false)).toBeUndefined();
+		expect(evaluateCriticGateSpawn(state, "plan", true)).toBeUndefined();
+		expect(evaluateCriticGateSpawn(state, "critic", true)).toBeUndefined();
+
+		const blocked = evaluateCriticGateSpawn(state, "task", false);
+		expect(blocked).toContain("`reject`");
+		expect(blocked).toContain("name the target file");
+	});
+
+	it("closes the iterate loop after the strike budget is exhausted", () => {
+		const state = engagedGate({ verdict: "iterate", strikes: CRITIC_GATE_MAX_STRIKES });
+		const blocked = evaluateCriticGateSpawn(state, "critic", true);
+		expect(blocked).toContain("Do NOT re-submit to critic");
+		// Other read-only lanes stay open so the agent can still gather what it
+		// needs to write the report.
+		expect(evaluateCriticGateSpawn(state, "plan", true)).toBeUndefined();
+	});
+});
+
+describe("critic gate write guard", () => {
+	it("rejects working-tree writes while engaged and allows them once cleared", () => {
+		const gate: { state?: CriticGateState } = { state: engagedGate() };
+		const session = makeSession(gate);
+		expect(() => enforceCriticGateWrite(session, "src/index.ts")).toThrow(/Critic gate engaged/);
+
+		gate.state = undefined;
+		expect(() => enforceCriticGateWrite(session, "src/index.ts")).not.toThrow();
+	});
+});
+
+describe("critic gate task-tool enforcement", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("refuses to spawn a non-read-only agent while the gate is engaged", async () => {
+		vi.spyOn(taskDiscovery, "discoverAgents").mockResolvedValue({
+			agents: [criticAgent, workerAgent, planAgent],
+			projectAgentsDir: null,
+		});
+		const runSpy = vi.spyOn(executor, "runSubprocess").mockResolvedValue(criticResult("{}"));
+
+		const tool = await TaskTool.create(makeSession({ state: engagedGate() }));
+		const result = await tool.execute("call-1", { agent: "task", assignment: "implement the fix" });
+
+		const text = result.content.find(part => part.type === "text")?.text ?? "";
+		expect(text).toContain("Critic gate engaged");
+		expect(runSpy).not.toHaveBeenCalled();
+	});
+
+	it("records a reject verdict from a critic run and clears it on okay", async () => {
+		vi.spyOn(taskDiscovery, "discoverAgents").mockResolvedValue({
+			agents: [criticAgent, workerAgent],
+			projectAgentsDir: null,
+		});
+		const runSpy = vi
+			.spyOn(executor, "runSubprocess")
+			.mockResolvedValue(criticResult(JSON.stringify({ verdict: "reject", required_fixes: ["broken step 2"] })));
+
+		const gate: { state?: CriticGateState } = {};
+		const tool = await TaskTool.create(makeSession(gate));
+		await tool.execute("call-1", { agent: "critic", assignment: "gate the plan" });
+
+		expect(gate.state).toMatchObject({ verdict: "reject", strikes: 1, requiredFixes: ["broken step 2"] });
+
+		runSpy.mockResolvedValue(criticResult(JSON.stringify({ verdict: "okay" })));
+		await tool.execute("call-2", { agent: "critic", assignment: "gate the revised plan" });
+
+		expect(gate.state).toBeUndefined();
+	});
+});

package/src/task/critic-gate.ts

@@ -0,0 +1,148 @@
+/**
+ * Critic gate — the hard, code-enforced counterpart of the prompt rule
+ * "You NEVER execute a plan whose latest critic verdict is not `okay`".
+ *
+ * When a `critic` subagent completes with a schema-validated verdict, the
+ * parent session records it here. While the latest verdict is `iterate` or
+ * `reject` the runtime — not the prompt — blocks execution:
+ *
+ * - `task` refuses to spawn non-read-only agents (read-only lanes such as
+ *   `plan`, `explore`, and `critic` itself stay open so the plan can be
+ *   revised and re-gated).
+ * - Working-tree mutations through `write`/`edit`/patch are rejected; the
+ *   `local://` artifact sandbox stays writable for seeds, plans, and notes.
+ *
+ * The gate clears in exactly two ways: a subsequent critic verdict of `okay`,
+ * or the next user-authored prompt (the user regaining control is the only
+ * override — mirroring jeo-code's `approve` hard gate, scoped to a turn-chain
+ * instead of a state file).
+ *
+ * A strike counter bounds the iterate loop: after
+ * {@link CRITIC_GATE_MAX_STRIKES} consecutive non-okay verdicts without user
+ * input, even re-submitting to `critic` is refused — the agent must stop and
+ * report the surviving gaps instead of burning tokens on convergence-free
+ * re-planning.
+ */
+
+/** Agent name whose structured verdicts drive the gate. */
+export const CRITIC_AGENT_NAME = "critic";
+
+/** Consecutive non-okay verdicts allowed before the gate forces a stop-and-report. */
+export const CRITIC_GATE_MAX_STRIKES = 3;
+
+/** Non-okay verdicts that engage the gate. */
+export type CriticGateVerdict = "iterate" | "reject";
+
+/** Gate state held by the parent session while the latest verdict is not `okay`. */
+export interface CriticGateState {
+	/** Latest non-okay verdict. */
+	verdict: CriticGateVerdict;
+	/** Agent id of the critic run that produced the verdict. */
+	agentId: string;
+	/** Epoch ms when the verdict was recorded. */
+	at: number;
+	/** `required_fixes` from the critic's structured output (empty for reject without fixes). */
+	requiredFixes: string[];
+	/** Consecutive non-okay verdicts since the last okay/user prompt. */
+	strikes: number;
+}
+
+/** Verdict parsed from a critic subagent's validated structured output. */
+export interface ParsedCriticVerdict {
+	verdict: "okay" | CriticGateVerdict;
+	requiredFixes: string[];
+	summary?: string;
+}
+
+/**
+ * Parse a critic verdict from the subagent's final output payload (the
+ * JSON-serialized, schema-validated yield data). Returns undefined when the
+ * payload is not a critic-shaped verdict — the gate then stays untouched.
+ */
+export function parseCriticVerdict(output: string): ParsedCriticVerdict | undefined {
+	let data: unknown;
+	try {
+		data = JSON.parse(output);
+	} catch {
+		return undefined;
+	}
+	if (data === null || typeof data !== "object") return undefined;
+	const record = data as Record<string, unknown>;
+	const verdict = record.verdict;
+	if (verdict !== "okay" && verdict !== "iterate" && verdict !== "reject") return undefined;
+	const rawFixes = record.required_fixes;
+	const requiredFixes = Array.isArray(rawFixes)
+		? rawFixes.filter((fix): fix is string => typeof fix === "string")
+		: [];
+	const summary = typeof record.summary === "string" ? record.summary : undefined;
+	return { verdict, requiredFixes, summary };
+}
+
+/**
+ * Fold a new verdict into the gate state. `okay` clears the gate; a non-okay
+ * verdict engages it and increments the consecutive-strike counter.
+ */
+export function updateCriticGateState(
+	previous: CriticGateState | undefined,
+	parsed: ParsedCriticVerdict,
+	agentId: string,
+	now: number = Date.now(),
+): CriticGateState | undefined {
+	if (parsed.verdict === "okay") return undefined;
+	return {
+		verdict: parsed.verdict,
+		agentId,
+		at: now,
+		requiredFixes: parsed.requiredFixes,
+		strikes: (previous?.strikes ?? 0) + 1,
+	};
+}
+
+function formatRequiredFixes(state: CriticGateState): string {
+	if (state.requiredFixes.length === 0) return "";
+	const bullets = state.requiredFixes.map(fix => `- ${fix}`).join("\n");
+	return `\nUnresolved required fixes:\n${bullets}`;
+}
+
+function gateSummaryLine(state: CriticGateState): string {
+	return `Critic gate engaged: the latest critic verdict (from \`${state.agentId}\`) was \`${state.verdict}\`, not \`okay\`.`;
+}
+
+/**
+ * Decide whether a spawn is allowed under the current gate state. Returns the
+ * rejection message when blocked, undefined when allowed.
+ *
+ * Read-only agents (plan revision, exploration, re-gating via critic) stay
+ * allowed — except that once the strike budget is exhausted, even a fresh
+ * critic run is refused so the loop terminates at the user instead of cycling.
+ */
+export function evaluateCriticGateSpawn(
+	state: CriticGateState | undefined,
+	agentName: string,
+	agentIsReadOnly: boolean,
+): string | undefined {
+	if (!state) return undefined;
+	if (agentName === CRITIC_AGENT_NAME && state.strikes >= CRITIC_GATE_MAX_STRIKES) {
+		return (
+			`Critic gate: ${state.strikes} consecutive non-okay critic verdicts without user input — the iterate loop is closed. ` +
+			`Do NOT re-submit to critic. Stop and report the surviving gaps to the user; the gate clears on the next user message.${formatRequiredFixes(state)}`
+		);
+	}
+	if (agentIsReadOnly) return undefined;
+	return (
+		`${gateSummaryLine(state)} Spawning non-read-only agent "${agentName}" is blocked by the runtime, not just the prompt. ` +
+		`To proceed: revise the plan (read-only \`plan\` agent), re-submit to a fresh \`critic\`, and execute only after an \`okay\` verdict — or stop and report to the user (the gate clears on the next user message).${formatRequiredFixes(state)}`
+	);
+}
+
+/**
+ * Error text for a working-tree mutation attempted while the gate is engaged.
+ * The `local://` sandbox is exempt (seeds/plans/notes live there); callers
+ * check that before invoking this.
+ */
+export function criticGateWriteMessage(state: CriticGateState): string {
+	return (
+		`${gateSummaryLine(state)} The working tree is locked until a critic returns \`okay\` for the revised plan ` +
+		`(or the user sends a new message). Write plans and notes to local:// files instead.${formatRequiredFixes(state)}`
+	);
+}

package/src/task/discovery.ts

@@ -2,8 +2,8 @@
  * Agent discovery from filesystem.
  *
  * Discovers agent definitions from OMP-native task-agent roots:
- *   - ~/.omp/agent/agents/*.md (user-level)
- *   - .omp/agents/*.md (project-level)
+ *   - ~/.jeopi/agent/agents/*.md (user-level)
+ *   - .jeopi/agents/*.md (project-level)
  *
  * Claude Code marketplace plugin agents are discovered separately via the
  * claude-plugins provider. Direct cross-harness roots such as .claude/agents
@@ -15,14 +15,14 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { logger } from "jeopi-utils";
+import { CONFIG_DIR_NAME, logger } from "jeopi-utils";
 import { isProviderEnabled } from "../capability";
 import { findAllNearestProjectConfigDirs, getConfigDirs } from "../config";
 import { listClaudePluginRoots } from "../discovery/helpers";
 import { loadBundledAgents, parseAgent } from "./agents";
 import type { AgentDefinition, AgentSource } from "./types";
 
-const TASK_AGENT_CONFIG_SOURCE = ".omp";
+const TASK_AGENT_CONFIG_SOURCE = CONFIG_DIR_NAME;
 
 /** Result of agent discovery */
 export interface DiscoveryResult {
@@ -55,7 +55,7 @@ async function loadAgentsFromDir(dir: string, source: AgentSource): Promise<Agen
 /**
  * Discover agents from filesystem and merge with bundled agents.
  *
- * Precedence (highest wins): project .omp, user .omp, Claude plugin agents, then bundled
+ * Precedence (highest wins): project .jeopi, user .jeopi, Claude plugin agents, then bundled
  * @param cwd - Current working directory for project agent discovery
  */
 export async function discoverAgents(cwd: string, home: string = os.homedir()): Promise<DiscoveryResult> {

package/src/task/executor.ts

@@ -342,7 +342,7 @@ export interface ExecutorOptions {
 	preloadedExtensionPaths?: string[];
 	/**
 	 * Parent's discovered custom-tool source paths. Forwarded to skip the
-	 * `.omp/tools/` FS scan in the subagent; the subagent then re-binds each
+	 * `.jeopi/tools/` FS scan in the subagent; the subagent then re-binds each
 	 * tool against its own `CustomToolAPI` (cwd, exec, pushPendingAction, UI).
 	 */
 	preloadedCustomToolPaths?: ToolPathWithSource[];

package/src/task/index.ts

@@ -3,8 +3,8 @@
  *
  * Discovers agent definitions from:
  *   - Bundled agents (shipped with omp-coding-agent)
- *   - ~/.omp/agent/agents/*.md (user-level)
- *   - .omp/agents/*.md (project-level)
+ *   - ~/.jeopi/agent/agents/*.md (user-level)
+ *   - .jeopi/agents/*.md (project-level)
  *
  * Supports:
  *   - Single agent spawn per call (parallelism = parallel task calls)
@@ -48,6 +48,7 @@ import type { AsyncJobManager } from "../async";
 import type { LocalProtocolOptions } from "../internal-urls";
 import { loadOverallPlanReference } from "../plan-mode/plan-handoff";
 import { AgentRegistry, MAIN_AGENT_ID } from "../registry/agent-registry";
+import { CRITIC_AGENT_NAME, evaluateCriticGateSpawn, parseCriticVerdict, updateCriticGateState } from "./critic-gate";
 import { type DiscoveryResult, discoverAgents, getAgent } from "./discovery";
 import { runSubprocess } from "./executor";
 import {
@@ -1118,6 +1119,21 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			};
 		}
 
+		// Critic gate: while the latest critic verdict is non-okay, only
+		// read-only agents may spawn (plan revision / re-gating); execution
+		// lanes are blocked by the runtime, not just the prompt.
+		const criticGateRejection = evaluateCriticGateSpawn(
+			this.session.getCriticGateState?.(),
+			agentName,
+			isReadOnlyAgent(agent),
+		);
+		if (criticGateRejection) {
+			return {
+				content: [{ type: "text", text: criticGateRejection }],
+				details: { projectAgentsDir, results: [], totalDurationMs: 0 },
+			};
+		}
+
 		const planModeState = this.session.getPlanModeState?.();
 		const planModeBaseTools = ["read", "grep", "glob", "lsp", "web_search"];
 		const planModeTools = [
@@ -1388,6 +1404,23 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 
 			const result = await runTask();
 
+			// Record critic verdicts into the session's hard execution gate. Only
+			// clean, schema-validated completions move the gate — a failed or
+			// aborted critic run leaves the previous state untouched.
+			if (
+				agent.name === CRITIC_AGENT_NAME &&
+				this.session.setCriticGateState &&
+				result.exitCode === 0 &&
+				!result.aborted
+			) {
+				const parsed = parseCriticVerdict(result.output);
+				if (parsed) {
+					this.session.setCriticGateState(
+						updateCriticGateState(this.session.getCriticGateState?.(), parsed, result.id),
+					);
+				}
+			}
+
 			let mergeSummary = "";
 			let changesApplied: boolean | null = null;
 			let mergedBranchForNestedPatches = false;

package/src/tools/acp-bridge.ts

@@ -3,7 +3,7 @@
  *
  * When an ACP client (e.g. Zed) advertises the `fs.writeTextFile` capability,
  * all write-mode tools must route through it so the editor's open buffer is
- * updated immediately. Internal artifacts ('/Users/theo/.omp/agent/sessions/-Projects-oh-my-pi/2026-06-10T09-11-41-506Z_019eb0cd-3ec2-7000-92aa-1b82aa4d78f0/local' plan files, other scheme
+ * updated immediately. Internal artifacts ('/Users/theo/.jeopi/agent/sessions/-Projects-oh-my-pi/2026-06-10T09-11-41-506Z_019eb0cd-3ec2-7000-92aa-1b82aa4d78f0/local' plan files, other scheme
  * URLs) are always written directly to disk — those are OMP-owned and should
  * never be pushed into the editor.
  */
@@ -16,7 +16,7 @@ import { ToolError } from "./tool-errors";
 /**
  * Return `true` when an ACP client bridge write is appropriate for this path.
  *
- * Returns `false` for internal-URL paths (e.g. `'/Users/theo/.omp/agent/sessions/-Projects-oh-my-pi/2026-06-10T09-11-41-506Z_019eb0cd-3ec2-7000-92aa-1b82aa4d78f0/local/PLAN.md'`) and for the
+ * Returns `false` for internal-URL paths (e.g. `'/Users/theo/.jeopi/agent/sessions/-Projects-oh-my-pi/2026-06-10T09-11-41-506Z_019eb0cd-3ec2-7000-92aa-1b82aa4d78f0/local/PLAN.md'`) and for the
  * active plan file while plan mode is enabled — both are OMP-internal artifacts
  * that must stay off the editor's buffer.
  */

package/src/tools/browser/launch.ts

@@ -101,7 +101,7 @@ async function loadBrowsers(): Promise<typeof BrowsersNs> {
 /**
  * Lazily download Chromium on first browser launch via @puppeteer/browsers.
  * Skipped when a system Chromium (NixOS) or PUPPETEER_EXECUTABLE_PATH is set.
- * The browser is cached under ~/.omp/puppeteer (getPuppeteerDir).
+ * The browser is cached under ~/.jeopi/puppeteer (getPuppeteerDir).
  */
 let chromiumExecutablePromise: Promise<string | undefined> | undefined;
 async function ensureChromiumExecutable(): Promise<string | undefined> {

package/src/tools/browser/tab-protocol.ts

@@ -38,7 +38,7 @@ export interface ScreenshotResult {
 export interface SessionSnapshot {
 	cwd: string;
 	browserScreenshotDir?: string;
-	/** Force non-WebP screenshot encoding (e.g. for Ollama). Unset honors `OMP_NO_WEBP`. */
+	/** Force non-WebP screenshot encoding (e.g. for Ollama). Unset honors `JEOPI_NO_WEBP`. */
 	excludeWebP?: boolean;
 }
 

package/src/tools/grep.ts

@@ -342,7 +342,7 @@ interface IndexedContentLines {
 	starts: number[];
 }
 
-const OMP_ROOT_URL_RE = /^omp:\/\/(?:\/?|docs\/?)$/i;
+const INTERNAL_ROOT_URL_RE = /^omp:\/\/(?:\/?|docs\/?)$/i;
 
 function normalizeSearchLine(line: string): string {
 	return line.endsWith("\r") ? line.slice(0, -1) : line;
@@ -721,7 +721,7 @@ async function expandVirtualInternalResource(
 	context: ResolveContext,
 	ranges: readonly LineRange[] | undefined,
 ): Promise<VirtualSearchResource[]> {
-	if (OMP_ROOT_URL_RE.test(rawPath)) {
+	if (INTERNAL_ROOT_URL_RE.test(rawPath)) {
 		const completions = await internalRouter.complete("omp", "");
 		if (completions && completions.length > 0) {
 			const resources: VirtualSearchResource[] = [];

package/src/tools/index.ts

@@ -27,6 +27,7 @@ import type { CustomMessage } from "../session/messages";
 import type { UsageStatistics } from "../session/session-entries";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import { TaskTool } from "../task";
+import type { CriticGateState } from "../task/critic-gate";
 import type { AgentOutputManager } from "../task/output-manager";
 import { canSpawnAtDepth } from "../task/types";
 import { countToolsForAutoDiscovery, resolveEffectiveToolDiscoveryMode } from "../tool-discovery/mode";
@@ -187,7 +188,7 @@ export interface ToolSession {
 	 */
 	extensionPaths?: string[];
 	/**
-	 * Pre-discovered custom-tool source paths from `.omp/tools/`, `.claude/tools/`,
+	 * Pre-discovered custom-tool source paths from `.jeopi/tools/`, `.claude/tools/`,
 	 * plugins, etc. Forwarded to subagents so they skip the FS scan but still
 	 * re-bind tools to their own session-scoped `CustomToolAPI`.
 	 */
@@ -273,6 +274,10 @@ export interface ToolSession {
 	getPlanModeState?: () => PlanModeState | undefined;
 	/** Path of the session's active plan reference (e.g. `local://<title>.md`); defaults to `local://PLAN.md`. */
 	getPlanReferencePath?: () => string;
+	/** Critic gate state — engaged after a non-okay `critic` verdict; cleared by an okay verdict or the next user prompt. */
+	getCriticGateState?: () => CriticGateState | undefined;
+	/** Replace the critic gate state (undefined clears the gate). */
+	setCriticGateState?: (state: CriticGateState | undefined) => void;
 	/** Goal mode state (if active or paused) */
 	getGoalModeState?: () => GoalModeState | undefined;
 	/** Goal runtime for the active agent session. */

package/src/tools/plan-mode-guard.ts

@@ -7,6 +7,7 @@ import {
 	resolveLocalUrlToPath,
 	resolveVaultUrlToPath,
 } from "../internal-urls";
+import { criticGateWriteMessage } from "../task/critic-gate";
 import type { ToolSession } from ".";
 import { normalizeLocalScheme, resolveToCwd } from "./path-utils";
 import { ToolError } from "./tool-errors";
@@ -136,6 +137,7 @@ export function enforcePlanModeWrite(
 	targetPath: string,
 	options?: { move?: string; op?: "create" | "update" | "delete" },
 ): void {
+	enforceCriticGateWrite(session, targetPath);
 	const state = session.getPlanModeState?.();
 	if (!state?.enabled) return;
 
@@ -153,3 +155,17 @@ export function enforcePlanModeWrite(
 		"Plan mode: the working tree is read-only. Write your plan to a local://<slug>-plan.md file instead.",
 	);
 }
+
+/**
+ * Critic gate — while the session's latest critic verdict is not `okay`,
+ * working-tree mutations are rejected at the runtime level. The `local://`
+ * artifact sandbox stays writable (seeds, plans, and scratch notes live
+ * there). Runs inside {@link enforcePlanModeWrite} so every mutating tool
+ * (`write`, `edit` replace/patch/hashline) hits one choke point.
+ */
+export function enforceCriticGateWrite(session: ToolSession, targetPath: string): void {
+	const gate = session.getCriticGateState?.();
+	if (!gate) return;
+	if (targetsLocalSandbox(session, targetPath)) return;
+	throw new ToolError(criticGateWriteMessage(gate));
+}

package/src/tools/read.ts

@@ -1053,7 +1053,7 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 			const sessionFile = this.session.getSessionFile();
 			root = sessionFile?.endsWith(".jsonl")
 				? sessionFile.slice(0, -6)
-				: path.join(os.tmpdir(), "omp-read-pdf-images");
+				: path.join(os.tmpdir(), "jeopi-read-pdf-images");
 		}
 		const basename = path.basename(absolutePdfPath).replace(/[^A-Za-z0-9._-]/g, "_");
 		return path.join(root, "read-pdf-images", `${basename}-${Bun.hash(absolutePdfPath).toString(36)}`);

package/src/tools/report-tool-issue.ts

@@ -187,7 +187,7 @@ let cachedDb: Database | null = null;
 
 /**
  * Open (or return the cached handle for) the auto-QA SQLite database at
- * `~/.omp/agent/autoqa.db`. Idempotently runs schema creation, the
+ * `~/.jeopi/agent/autoqa.db`. Idempotently runs schema creation, the
  * `pushed`-column migration, and index setup so every consumer — tool
  * execute path, manual `jeopi grievances push`, future debug scripts —
  * sees the same prepared schema. Returns `null` only on a hard open
@@ -474,7 +474,7 @@ export function createReportToolIssueTool(session: ToolSession, activeBuiltinNam
 		intent: "omit",
 		async execute(_toolCallId, rawParams) {
 			// Save is unconditional: the row lives in the user's own SQLite
-			// at ~/.omp/agent/autoqa.db regardless of consent — they always
+			// at ~/.jeopi/agent/autoqa.db regardless of consent — they always
 			// own their local data and can inspect or wipe it via `jeopi grievances`.
 			// Consent only gates whether the row is *shipped* to the shared
 			// backend; that decision rides on `dev.autoqa.consent` and is

package/src/utils/changelog.ts

@@ -106,8 +106,8 @@ export function getNewEntries(entries: ChangelogEntry[], lastVersion: string): C
 export { getChangelogPath } from "../config";
 
 /**
- * Last omp version whose changelog the user has seen. Stored as a plain-text
- * marker file (`~/.omp/agent/last-changelog-version`) rather than in
+ * Last jeopi version whose changelog the user has seen. Stored as a plain-text
+ * marker file (`~/.jeopi/agent/last-changelog-version`) rather than in
  * `config.yml`, so version bumps never dirty user-tracked config files.
  */
 export async function readLastChangelogVersion(agentDir?: string): Promise<string | undefined> {

package/src/utils/image-loading.ts

@@ -11,7 +11,7 @@ export const SUPPORTED_INPUT_IMAGE_MIME_TYPES = SUPPORTED_IMAGE_MIME_TYPES;
  * Ollama and its local-backend family decode image input through llama.cpp /
  * `stb_image`, which is compiled without WebP support, so a WebP upload fails
  * with an opaque HTTP 400. Detect those models so the resize pipeline encodes
- * to PNG/JPEG instead — the automatic equivalent of `OMP_NO_WEBP=1`.
+ * to PNG/JPEG instead — the automatic equivalent of `JEOPI_NO_WEBP=1`.
  */
 export function modelLacksWebpSupport(
 	model: Pick<Model, "provider" | "api" | "imageInputDecoder"> | undefined,
@@ -30,7 +30,7 @@ export function modelLacksWebpSupport(
 
 /**
  * `true` when `model` cannot decode WebP, otherwise `undefined` so the
- * `OMP_NO_WEBP` env fallback in {@link resizeImage} still applies. Feed straight
+ * `JEOPI_NO_WEBP` env fallback in {@link resizeImage} still applies. Feed straight
  * into {@link ImageResizeOptions.excludeWebP}.
  */
 export function webpExclusionForModel(model: Pick<Model, "provider" | "api"> | undefined): true | undefined {
@@ -44,7 +44,7 @@ export interface LoadImageInputOptions {
 	maxBytes?: number;
 	resolvedPath?: string;
 	detectedMimeType?: string;
-	/** Force non-WebP output (e.g. for Ollama). Leave unset to honor `OMP_NO_WEBP`. */
+	/** Force non-WebP output (e.g. for Ollama). Leave unset to honor `JEOPI_NO_WEBP`. */
 	excludeWebP?: boolean;
 }
 
@@ -55,7 +55,7 @@ export interface LoadImageAttachmentInputOptions {
 	uri: string;
 	autoResize: boolean;
 	maxBytes?: number;
-	/** Force non-WebP output (e.g. for Ollama). Leave unset to honor `OMP_NO_WEBP`. */
+	/** Force non-WebP output (e.g. for Ollama). Leave unset to honor `JEOPI_NO_WEBP`. */
 	excludeWebP?: boolean;
 }