jeopi-cli 16.2.22 → 16.2.24

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [16.2.24] - 2026-07-03
+
+### Breaking Changes
+
+- Installed plugins' tools/hooks/commands/extensions no longer load automatically. Each plugin now needs a one-time trust grant (interactive Yes/No prompt on first load, or `PI_TRUST_ALL_PLUGINS=1` for headless/CI runs) before its code executes — see the trust-on-first-use entry below. Plugin skills/rules and marketplace listing/install are unaffected.
+
+### Added
+
+- `jeopi update` (and `jeopi update --check`) now prints the GitHub release notes for every version between the installed and the latest published release, so the update contents are visible before installing.
+- Added a `subagent` tool: a dedicated control surface for `task`-spawned background subagents — `list`/`inspect`/`await`/`cancel` their async job state and `steer`/`pause`/`resume` the live agent session behind them, scoped to the calling agent's own spawns. Statuses include a genuine `paused` bucket (distinct from `completed`) for subagents that stopped because a `pause` was requested; a `resumable` flag on every snapshot independently marks subagents whose session is still resident and addressable, whether paused or simply finished on their own — `resume` treats both the same. `list` defaults to 10 results (max 50); `verbosity` (`receipt`/`preview`/`full`, matching the canonical gajae-code `subagent` tool's field names and 280/2000/12000-char preview widths) controls how much result/error text comes back, and `full` requires explicit `id`/`ids`. `cancel` can stop a subagent mid-turn even after it was `resume`d past its original `task` job (falls back to aborting the live session directly). Sits alongside `task`/`job`/`irc` without changing their existing behavior; jeopi's version composes existing `AsyncJobManager`/`AgentRegistry`/`IrcBus` primitives rather than the deeper native `SubagentRecord` state machine the canonical implementation uses internally.
+- The `goal` tool's `complete` op now requires an `evidence` argument describing what was verified and how; empty or generic status-word evidence ("done", "lgtm", "verified", …) is rejected with a `ToolError` before the goal is allowed to close. Closes the code-level gap where "call complete" was pure self-attestation — the prompt rule already said to complete only when verified, but nothing enforced it. The accepted evidence is stored on the goal (`Goal.completionEvidence`) and surfaced in the tool's result text.
+- Third-party plugin code (tools/hooks/commands/extensions resolved from installed plugins under `node_modules`) now requires an explicit trust-on-first-use grant before it loads — mirrors the existing `report_tool_issue` auto-QA consent gate. Interactive sessions prompt with a Yes/No popup on first load of each `<name>@<version>`; headless/CI runs default-deny unless `PI_TRUST_ALL_PLUGINS=1` is set. User-authored tools/hooks/commands/extensions (e.g. under `.jeopi/tools/`) are unaffected — they were already trusted by construction. Decisions persist to `~/.jeopi/plugin-trust.json` and re-prompt on a version bump.
+- The system prompt now always carries a small non-negotiable "safety kernel" (prompt-injection defense + destructive-action gate + redacted-secret handling) even when a caller supplies a fully custom system prompt, closing the gap where a custom prompt silently dropped every default harness guardrail.
+- The `/jeo` critic gate now pins the approved plan's content hash: when a `critic` subagent verdict resolves `okay`, the runtime hashes `local://jeo-plan.md` and refuses to spawn a non-read-only agent afterward if that file no longer hashes the same (edited or deleted after approval) — closing the TOCTOU window between critic approval and execution. Ported from gajae-code's `sha256(planContent) === consensus_hash` pin in `team.ts`/`approve.ts`, adapted to jeopi's in-session (no state file) model.
+- `ToolCallLoopGuard` (the cross-turn tool-call loop detector) now also catches alternating A,B,A,B,… tool-call cycles — not just an identical call repeated — via a 6-turn sliding window; steers the model off the pattern with a new hidden `tool-call-cycle-redirect` notice, alongside the existing `tool-call-loop-redirect`. Ported from gajae-code's `loop-guards.ts` cycle detector.
+- Memory injected into the system prompt is now hardened against a specific prompt-injection vector: a stored `memory_summary.md`/Mnemopi-recall fact containing a literal `</memory_context>` or `</memories>` closing tag can no longer prematurely close its containing block and splice in fake system content — the closing (and matching opening) tag is neutralized to a lookalike Unicode form before injection, mirroring gajae-code's `frameMemory` tag-breakout guard. `learned.md` already had equivalent (stronger) protection and is unaffected.
+
+### Fixed
+
+- `jeopi update` now detects when GitHub has a newer release than the npm registry serves (npm publish still running, failed, or silently skipped for missing credentials) and says so, instead of reporting only "Already up to date" after a visibly tagged release.
+- `bun run release` now refuses to cut a release when no package has content under `## [Unreleased]` (previously this shipped a GitHub Release with an empty body, e.g. v16.2.22); pass `--allow-empty` for an intentional no-notes rebuild.
+- Fixed the advisor dying permanently behind repeated `Refusal (reasoning_extraction)` errors when Anthropic's classifier flags transcripts that replay thinking as text: on a provider refusal the advisor now strips thinking from the render once, re-primes, and retries (latching thinking off for the session with a notice) instead of blind-retrying the identical refused payload into the 3-strike watchdog forever. A new `advisor.includeThinking` setting (default on) provides an explicit opt-out.
+- Fixed the "Update Available" banner never appearing in long-running interactive sessions started before a release shipped: the startup version check only ever queried the registry once at launch, so a release published hours into a session stayed invisible until the user restarted (even though a fresh `jeopi update` correctly saw it). Interactive sessions now periodically recheck the registry every 4 hours and notify at most once per newer version.
+- Fixed `/marketplace install`/`uninstall`/`upgrade` and `/plugins enable`/`disable` silently not taking effect in the interactive TUI: unlike their ACP counterparts, the TUI handlers mutated the plugin registry but never invalidated plugin-root caches or refreshed slash-command/SSH-tool state, so newly installed/removed/upgraded/toggled plugins required a manual `/reload-plugins` (or a restart) before they worked.
+
+## [16.2.23] - 2026-07-03
+
+### Changed
+
+- Added the animated jeopi character mascot (hooded doll + jeo-code crayfish) to the README, then removed the older static `hero.gif` wordmark banner above it so the animated mascot is the sole header image.
+
 ## [16.2.21] - 2026-07-02
 
 ### Fixed