@adhdev/daemon-core 0.9.77-rc.8 → 0.9.77

package/src/commands/router.ts

@@ -43,6 +43,7 @@ import { execNpmCommandSync, resolveCurrentGlobalInstallSurface, spawnDetachedDa
 import type { RepoMeshSessionCleanupMode } from '../repo-mesh-types.js';
 import { homedir } from 'os';
 import { join as pathJoin, resolve as pathResolve } from 'path';
+import * as fs from 'fs';
 
 type ReleaseChannel = 'stable' | 'preview';
 const CHANNEL_NPM_TAG: Record<ReleaseChannel, 'latest' | 'next'> = { stable: 'latest', preview: 'next' };
@@ -114,9 +115,271 @@ async function resolveProviderTypeFromPriority(args: {
 
     return { error: `No usable provider detected for node '${args.nodeId}' from providerPriority: ${failed.join('; ')}` };
 }
-import * as fs from 'fs';
-
 type MeshCoordinatorConfigFormat = 'claude_mcp_json' | 'hermes_config_yaml';
+type MeshRefineValidationStatus = 'passed' | 'failed' | 'skipped';
+type MeshRefineValidationCommand = {
+    command: string;
+    args: string[];
+    displayCommand: string;
+    category: string;
+    source: string;
+};
+
+type MeshRefineValidationSummary = {
+    status: MeshRefineValidationStatus;
+    required: true;
+    commandsRun: Array<Record<string, unknown>>;
+    rejectedCommands: Array<Record<string, unknown>>;
+    skippedReason?: string;
+    timeoutMs: number;
+    outputLimitBytes: number;
+};
+
+const REFINE_VALIDATION_CATEGORIES = ['typecheck', 'test', 'lint', 'build'] as const;
+const REFINE_VALIDATION_TIMEOUT_MS = 120_000;
+const REFINE_VALIDATION_OUTPUT_LIMIT_BYTES = 128 * 1024;
+const REFINE_VALIDATION_SUMMARY_CHARS = 2_000;
+const REFINE_VALIDATION_MAX_COMMANDS = 4;
+
+function truncateValidationOutput(value: unknown): string {
+    const text = typeof value === 'string' ? value : value == null ? '' : String(value);
+    if (text.length <= REFINE_VALIDATION_SUMMARY_CHARS) return text;
+    return `${text.slice(0, REFINE_VALIDATION_SUMMARY_CHARS)}\n[truncated ${text.length - REFINE_VALIDATION_SUMMARY_CHARS} chars]`;
+}
+
+function readPackageScripts(workspace: string): Record<string, string> {
+    try {
+        const packageJsonPath = pathJoin(workspace, 'package.json');
+        const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+        return parsed?.scripts && typeof parsed.scripts === 'object' && !Array.isArray(parsed.scripts)
+            ? parsed.scripts as Record<string, string>
+            : {};
+    } catch {
+        return {};
+    }
+}
+
+function tokenizeValidationCommand(command: string): string[] | null {
+    const trimmed = command.trim();
+    if (!trimmed) return null;
+    // Fail closed: the gate never hands shell syntax to a shell. Package-manager
+    // scripts are invoked via execFile(binary, args), and metacharacters/quotes are
+    // rejected before tokenization so `npm run test && rm -rf` cannot be smuggled in.
+    if (/[;&|<>`$\\\n\r'\"]/.test(trimmed)) return null;
+    const tokens = trimmed.split(/\s+/).filter(Boolean);
+    if (!tokens.length) return null;
+    if (tokens.some(token => !/^[A-Za-z0-9_@./:=+-]+$/.test(token))) return null;
+    return tokens;
+}
+
+function scriptMatchesValidationCategory(scriptName: string, category: string): boolean {
+    return scriptName === category || scriptName.startsWith(`${category}:`);
+}
+
+function parsePackageManagerValidationCommand(
+    rawCommand: string,
+    category: string,
+    scripts: Record<string, string>,
+    source: string,
+): { command?: MeshRefineValidationCommand; rejected?: Record<string, unknown> } {
+    const tokens = tokenizeValidationCommand(rawCommand);
+    if (!tokens) {
+        return { rejected: { command: rawCommand, category, source, reason: 'unsafe command string is not allowlisted' } };
+    }
+
+    const [binary, second, third, ...rest] = tokens;
+    let scriptName = '';
+    let command = binary;
+    let args: string[] = [];
+
+    if ((binary === 'npm' || binary === 'pnpm' || binary === 'bun') && second === 'run' && third) {
+        scriptName = third;
+        args = ['run', scriptName, ...rest];
+    } else if (binary === 'npm' && second === 'test' && !third) {
+        scriptName = 'test';
+        args = ['test'];
+    } else if (binary === 'yarn' && second === 'run' && third) {
+        scriptName = third;
+        args = ['run', scriptName, ...rest];
+    } else if (binary === 'yarn' && second && !third) {
+        scriptName = second;
+        args = [scriptName];
+    } else {
+        return { rejected: { command: rawCommand, category, source, reason: 'command is not a supported package-manager script invocation' } };
+    }
+
+    if (!scriptName || !Object.prototype.hasOwnProperty.call(scripts, scriptName)) {
+        return { rejected: { command: rawCommand, category, source, script: scriptName, reason: 'script is not declared in package.json' } };
+    }
+    if (!scriptMatchesValidationCategory(scriptName, category)) {
+        return { rejected: { command: rawCommand, category, source, script: scriptName, reason: 'script name is outside the validation category allowlist' } };
+    }
+
+    return {
+        command: {
+            command,
+            args,
+            displayCommand: [command, ...args].join(' '),
+            category,
+            source,
+        },
+    };
+}
+
+function collectProjectContextValidationCandidates(mesh: any): Array<{ command: string; category: string; source: string; confidence?: string }> {
+    const commands = mesh?.projectContext?.commands;
+    if (!commands || typeof commands !== 'object' || Array.isArray(commands)) return [];
+    const candidates: Array<{ command: string; category: string; source: string; confidence?: string }> = [];
+    for (const category of REFINE_VALIDATION_CATEGORIES) {
+        const entries = Array.isArray(commands[category]) ? commands[category] : [];
+        for (const entry of entries) {
+            if (typeof entry?.command !== 'string') continue;
+            candidates.push({
+                command: entry.command,
+                category,
+                source: typeof entry.sourcePath === 'string' ? entry.sourcePath : 'projectContext.commands',
+                confidence: typeof entry.confidence === 'string' ? entry.confidence : undefined,
+            });
+        }
+    }
+    return candidates.sort((a, b) => {
+        const rank = (value?: string) => value === 'high' ? 0 : value === 'medium' ? 1 : 2;
+        return rank(a.confidence) - rank(b.confidence);
+    });
+}
+
+function collectPolicyValidationCandidates(mesh: any): Array<{ command: string; category: string; source: string }> {
+    const policy = mesh?.policy && typeof mesh.policy === 'object' && !Array.isArray(mesh.policy) ? mesh.policy : {};
+    const configured = Array.isArray(policy.validationCommands)
+        ? policy.validationCommands
+        : Array.isArray(policy.validationGate?.commands)
+            ? policy.validationGate.commands
+            : [];
+    return configured
+        .map((entry: any) => typeof entry === 'string' ? { command: entry, category: '', source: 'mesh.policy.validationCommands' } : entry)
+        .filter((entry: any) => entry && typeof entry.command === 'string')
+        .map((entry: any) => {
+            const commandText = entry.command.trim();
+            const category = REFINE_VALIDATION_CATEGORIES.find(cat => commandText.includes(` ${cat}`)) ?? '';
+            return { command: commandText, category, source: 'mesh.policy.validationCommands' };
+        })
+        .filter((entry: any) => !!entry.category);
+}
+
+function selectMeshRefineValidationCommands(mesh: any, workspace: string): { commands: MeshRefineValidationCommand[]; rejectedCommands: Array<Record<string, unknown>>; source: string } {
+    const scripts = readPackageScripts(workspace);
+    const rejectedCommands: Array<Record<string, unknown>> = [];
+    const selected: MeshRefineValidationCommand[] = [];
+    const seen = new Set<string>();
+    const candidates = [
+        ...collectPolicyValidationCandidates(mesh),
+        ...collectProjectContextValidationCandidates(mesh),
+    ];
+
+    for (const candidate of candidates) {
+        const parsed = parsePackageManagerValidationCommand(candidate.command, candidate.category, scripts, candidate.source);
+        if (parsed.rejected) {
+            rejectedCommands.push(parsed.rejected);
+            continue;
+        }
+        if (!parsed.command || seen.has(parsed.command.displayCommand)) continue;
+        selected.push(parsed.command);
+        seen.add(parsed.command.displayCommand);
+        if (selected.length >= REFINE_VALIDATION_MAX_COMMANDS) break;
+    }
+
+    if (!selected.length && candidates.length === 0) {
+        for (const category of REFINE_VALIDATION_CATEGORIES) {
+            if (!Object.prototype.hasOwnProperty.call(scripts, category)) continue;
+            const fallback = parsePackageManagerValidationCommand(`npm run ${category}`, category, scripts, 'package.json:scripts');
+            if (fallback.command && !seen.has(fallback.command.displayCommand)) {
+                selected.push(fallback.command);
+                seen.add(fallback.command.displayCommand);
+            } else if (fallback.rejected) {
+                rejectedCommands.push(fallback.rejected);
+            }
+            if (selected.length >= 2) break;
+        }
+    }
+
+    return {
+        commands: selected,
+        rejectedCommands,
+        source: selected.some(command => command.source === 'mesh.policy.validationCommands')
+            ? 'mesh_policy'
+            : selected.some(command => command.source !== 'package.json:scripts')
+                ? 'project_context'
+                : selected.length
+                    ? 'package_json_scripts'
+                    : 'unavailable',
+    };
+}
+
+async function runMeshRefineValidationGate(mesh: any, workspace: string): Promise<MeshRefineValidationSummary> {
+    const { execFile } = await import('node:child_process');
+    const { promisify } = await import('node:util');
+    const execFileAsync = promisify(execFile);
+    const selection = selectMeshRefineValidationCommands(mesh, workspace);
+    const summary: MeshRefineValidationSummary = {
+        status: 'skipped',
+        required: true,
+        commandsRun: [],
+        rejectedCommands: selection.rejectedCommands,
+        skippedReason: undefined,
+        timeoutMs: REFINE_VALIDATION_TIMEOUT_MS,
+        outputLimitBytes: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES,
+    };
+
+    if (!selection.commands.length) {
+        summary.skippedReason = 'validation_unavailable: no allowlisted projectContext, mesh policy, or package.json build/test/typecheck/lint command was available';
+        return summary;
+    }
+
+    for (const candidate of selection.commands) {
+        const startedAt = Date.now();
+        try {
+            const result = await execFileAsync(candidate.command, candidate.args, {
+                cwd: workspace,
+                encoding: 'utf8',
+                timeout: REFINE_VALIDATION_TIMEOUT_MS,
+                maxBuffer: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES,
+                env: { ...process.env, CI: process.env.CI || '1' },
+            });
+            summary.commandsRun.push({
+                command: candidate.command,
+                args: candidate.args,
+                displayCommand: candidate.displayCommand,
+                category: candidate.category,
+                source: candidate.source,
+                passed: true,
+                exitCode: 0,
+                durationMs: Date.now() - startedAt,
+                stdout: truncateValidationOutput(result.stdout),
+                stderr: truncateValidationOutput(result.stderr),
+            });
+        } catch (error: any) {
+            summary.commandsRun.push({
+                command: candidate.command,
+                args: candidate.args,
+                displayCommand: candidate.displayCommand,
+                category: candidate.category,
+                source: candidate.source,
+                passed: false,
+                exitCode: typeof error?.code === 'number' ? error.code : null,
+                signal: typeof error?.signal === 'string' ? error.signal : null,
+                timedOut: error?.killed === true || /timed out/i.test(String(error?.message || '')),
+                durationMs: Date.now() - startedAt,
+                stdout: truncateValidationOutput(error?.stdout),
+                stderr: truncateValidationOutput(error?.stderr || error?.message),
+            });
+            summary.status = 'failed';
+            return summary;
+        }
+    }
+
+    summary.status = 'passed';
+    return summary;
+}
 
 function loadYamlModule(): { load: (input: string) => any; dump: (input: any, options?: Record<string, any>) => string } {
     return yaml as { load: (input: string) => any; dump: (input: any, options?: Record<string, any>) => string };
@@ -154,6 +417,35 @@ function loadHermesCoordinatorBaseConfig(targetConfigPath: string): { config: Re
     return { config: baseConfig, sourceHome, sourceConfigPath };
 }
 
+function stripHermesCoordinatorTempModelProviderOverrides(config: Record<string, any>): Record<string, any> {
+    const {
+        model: _model,
+        provider: _provider,
+        default_model: _defaultModel,
+        defaultProvider: _defaultProvider,
+        default_provider: _defaultProviderSnake,
+        modelProvider: _modelProvider,
+        model_provider: _modelProviderSnake,
+        ...sanitized
+    } = config;
+    const delegation = sanitized.delegation;
+    if (delegation && typeof delegation === 'object' && !Array.isArray(delegation)) {
+        const {
+            model: _delegationModel,
+            provider: _delegationProvider,
+            modelProvider: _delegationModelProvider,
+            model_provider: _delegationModelProviderSnake,
+            ...delegationRest
+        } = delegation;
+        if (Object.keys(delegationRest).length > 0) {
+            sanitized.delegation = delegationRest;
+        } else {
+            delete sanitized.delegation;
+        }
+    }
+    return sanitized;
+}
+
 function copyHermesCoordinatorCredentialFiles(sourceHome: string, targetHome: string) {
     if (pathResolve(sourceHome) === pathResolve(targetHome)) return;
     for (const fileName of ['.env', 'auth.json']) {
@@ -332,7 +624,7 @@ export class DaemonCommandRouter {
         this.deps = deps;
     }
 
-    private getCachedInlineMesh(meshId: string, inlineMesh?: unknown): any | undefined {
+    public getCachedInlineMesh(meshId: string, inlineMesh?: unknown): any | undefined {
         if (inlineMesh && typeof inlineMesh === 'object') {
             this.inlineMeshCache.set(meshId, inlineMesh as any);
             return inlineMesh as any;
@@ -388,10 +680,238 @@ export class DaemonCommandRouter {
         return false;
     }
 
+    private async cleanupLocalWorktreeNode(args: {
+        mesh: any;
+        node: any;
+        nodeId: string;
+    }): Promise<{ success: true; skipped?: boolean; removedPath?: string; repoRoot?: string; reason?: string; fallback?: string; forced?: boolean; convergence?: Record<string, unknown> } | { success: false; code: string; error: string; recoveryHint: string; convergence?: Record<string, unknown> }> {
+        const workspace = typeof args.node?.workspace === 'string' ? args.node.workspace.trim() : '';
+        if (!workspace) {
+            return {
+                success: false,
+                code: 'mesh_worktree_cleanup_missing_workspace',
+                error: `Worktree node '${args.nodeId}' is missing workspace metadata`,
+                recoveryHint: 'Inspect the mesh node record before removing it, or remove stale metadata manually only after confirming no managed worktree remains.',
+            };
+        }
+
+        const worktreeExists = fs.existsSync(workspace);
+        const sourceNode = args.node?.clonedFromNodeId
+            ? args.mesh?.nodes?.find((n: any) => n.id === args.node.clonedFromNodeId || n.nodeId === args.node.clonedFromNodeId)
+            : args.mesh?.nodes?.find((n: any) => !n.isLocalWorktree);
+        const repoRoot = typeof sourceNode?.repoRoot === 'string' && sourceNode.repoRoot.trim()
+            ? sourceNode.repoRoot.trim()
+            : typeof sourceNode?.workspace === 'string' && sourceNode.workspace.trim()
+                ? sourceNode.workspace.trim()
+                : '';
+
+        if (!worktreeExists) {
+            return { success: true, skipped: true, removedPath: workspace, repoRoot: repoRoot || undefined, reason: 'worktree_path_missing' };
+        }
+        if (!repoRoot || !fs.existsSync(repoRoot)) {
+            return {
+                success: false,
+                code: 'mesh_worktree_cleanup_missing_source_repo',
+                error: `Refusing to remove worktree '${workspace}' because the source repo root is unavailable`,
+                recoveryHint: 'Run mesh_remove_node from the machine that owns the source repo, or verify the source node metadata before retrying.',
+            };
+        }
+        if (typeof args.node?.worktreeBranch !== 'string' || !args.node.worktreeBranch.trim()) {
+            return {
+                success: false,
+                code: 'mesh_worktree_cleanup_missing_branch',
+                error: `Refusing to remove worktree '${workspace}' because worktreeBranch metadata is missing`,
+                recoveryHint: 'Confirm this is an ADHDev-managed worktree before removing it manually; managed worktree nodes include worktreeBranch metadata.',
+            };
+        }
+
+        const { resolveWorktreePath, listWorktrees, removeWorktree } = await import('../git/git-worktree.js');
+        const normalizePath = (value: string) => {
+            const resolved = pathResolve(value);
+            try { return fs.realpathSync(resolved); } catch { return resolved; }
+        };
+        const expectedPath = normalizePath(resolveWorktreePath(repoRoot, String(args.mesh?.name || args.mesh?.id || 'mesh'), args.node.worktreeBranch));
+        const actualPath = normalizePath(workspace);
+        if (actualPath !== expectedPath) {
+            return {
+                success: false,
+                code: 'mesh_worktree_cleanup_unexpected_path',
+                error: `Refusing to remove worktree '${workspace}' because it is not at the expected managed path '${expectedPath}'`,
+                recoveryHint: 'Use git worktree list/status to inspect the path. Retry only after confirming the mesh node metadata points to an ADHDev-managed worktree.',
+            };
+        }
+
+        const entries = await listWorktrees(repoRoot);
+        const managedEntry = entries.find(entry => normalizePath(entry.path) === actualPath);
+        if (!managedEntry) {
+            return {
+                success: false,
+                code: 'mesh_worktree_cleanup_not_registered',
+                error: `Refusing to remove '${workspace}' because it is not registered in git worktree list for '${repoRoot}'`,
+                recoveryHint: 'Inspect git worktree list --porcelain from the source repo. If the path was already removed, prune git worktrees before retrying.',
+            };
+        }
+        if (managedEntry.branch && managedEntry.branch !== args.node.worktreeBranch) {
+            return {
+                success: false,
+                code: 'mesh_worktree_cleanup_branch_mismatch',
+                error: `Refusing to remove '${workspace}' because git reports branch '${managedEntry.branch}', expected '${args.node.worktreeBranch}'`,
+                recoveryHint: 'Inspect the worktree branch and mesh metadata before retrying cleanup.',
+            };
+        }
+
+        const forceFallbackConvergence = await this.getWorktreeForceCleanupConvergence({
+            repoRoot,
+            workspace,
+            node: args.node,
+        });
+
+        try {
+            const result = await removeWorktree(repoRoot, workspace, {
+                requireClean: true,
+                allowSubmoduleForceFallback: forceFallbackConvergence.allow,
+            });
+            return {
+                success: true,
+                removedPath: result.removedPath,
+                repoRoot,
+                ...(result.fallback ? {
+                    fallback: result.fallback,
+                    forced: result.forced,
+                    reason: result.reason,
+                    convergence: forceFallbackConvergence,
+                } : {}),
+            };
+        } catch (e: any) {
+            const message = String(e?.message || e || 'worktree cleanup failed');
+            const dirty = message.includes('dirty worktree') || message.includes('local changes');
+            const submoduleForceBlocked = /working trees containing submodules cannot be moved or removed/i.test(message) && !forceFallbackConvergence.allow;
+            return {
+                success: false,
+                code: dirty
+                    ? 'mesh_worktree_cleanup_dirty'
+                    : submoduleForceBlocked
+                        ? 'mesh_worktree_cleanup_force_fallback_blocked'
+                        : 'mesh_worktree_cleanup_failed',
+                error: submoduleForceBlocked
+                    ? `${message}; refusing --force fallback because convergence could not be verified: ${forceFallbackConvergence.error || 'unknown convergence state'}`
+                    : message,
+                recoveryHint: dirty
+                    ? 'Commit, stash, or intentionally discard the worktree changes before retrying mesh_remove_node. The mesh registry entry is preserved until cleanup is safe.'
+                    : submoduleForceBlocked
+                        ? 'Verify the worktree branch is merged/contained in the source default branch (for example origin/main) or mark the node with a safe branchConvergence final state before retrying. The mesh registry entry is preserved.'
+                        : 'Inspect git worktree status/list from the source repo and retry after resolving the reported cleanup failure.',
+                ...(submoduleForceBlocked ? { convergence: forceFallbackConvergence } : {}),
+            };
+        }
+    }
+
+    private async getWorktreeForceCleanupConvergence(args: {
+        repoRoot: string;
+        workspace: string;
+        node: any;
+    }): Promise<{ allow: boolean; status?: string; source?: string; ref?: string; error?: string }> {
+        const metadataStatus = typeof args.node?.branchConvergence?.status === 'string'
+            ? args.node.branchConvergence.status
+            : '';
+        if (metadataStatus === 'merged_to_main' || metadataStatus === 'cleanup_candidate') {
+            return { allow: true, status: metadataStatus, source: 'node_branch_convergence' };
+        }
+
+        const { execFile } = await import('node:child_process');
+        const { promisify } = await import('node:util');
+        const execFileAsync = promisify(execFile);
+        const runGit = async (gitArgs: string[], cwd: string): Promise<string> => {
+            const { stdout } = await execFileAsync('git', gitArgs, {
+                cwd,
+                encoding: 'utf8',
+                timeout: 30_000,
+                maxBuffer: 4 * 1024 * 1024,
+                windowsHide: true,
+            });
+            return String(stdout || '').trim();
+        };
+
+        let head = '';
+        try {
+            head = await runGit(['rev-parse', 'HEAD'], args.workspace);
+        } catch (e: any) {
+            return { allow: false, error: `could not resolve worktree HEAD: ${e?.message || e}` };
+        }
+        if (!head) return { allow: false, error: 'worktree HEAD is empty' };
+
+        const candidateRefs: string[] = [];
+        try {
+            const defaultBranch = await runGit(['branch', '--show-current'], args.repoRoot);
+            if (defaultBranch) {
+                candidateRefs.push(defaultBranch, `origin/${defaultBranch}`);
+            }
+        } catch { /* fall through to common refs */ }
+        candidateRefs.push('origin/main', 'origin/master', 'main', 'master');
+
+        const seen = new Set<string>();
+        const checkedRefs: string[] = [];
+        for (const ref of candidateRefs) {
+            if (!ref || seen.has(ref)) continue;
+            seen.add(ref);
+            let commit = '';
+            try {
+                commit = await runGit(['rev-parse', '--verify', `${ref}^{commit}`], args.repoRoot);
+            } catch {
+                continue;
+            }
+            checkedRefs.push(ref);
+            try {
+                await runGit(['merge-base', '--is-ancestor', head, commit], args.repoRoot);
+                return { allow: true, status: 'merged_to_default_ref', source: 'git_merge_base', ref };
+            } catch {
+                // Not contained in this candidate ref; keep checking other safe refs.
+            }
+        }
+
+        return {
+            allow: false,
+            status: metadataStatus || undefined,
+            error: checkedRefs.length
+                ? `worktree HEAD is not contained in checked refs: ${checkedRefs.join(', ')}`
+                : 'no default/main refs were available for convergence verification',
+        };
+    }
+
     private isCompletedHostedSession(record: any): boolean {
         return record?.lifecycle === 'stopped' || record?.lifecycle === 'failed' || record?.lifecycle === 'interrupted';
     }
 
+    private async recordIntentionalMeshSessionStop(args: {
+        meshId: string;
+        nodeId: string;
+        node: any;
+        sessionId: string;
+        mode: RepoMeshSessionCleanupMode;
+        source: 'mesh_cleanup_sessions' | 'mesh_remove_node';
+        action: 'stop_session' | 'delete_session_force';
+    }): Promise<void> {
+        try {
+            const { appendLedgerEntry } = await import('../mesh/mesh-ledger.js');
+            appendLedgerEntry(args.meshId, {
+                kind: 'session_stopped',
+                nodeId: args.nodeId,
+                sessionId: args.sessionId,
+                payload: {
+                    intentional: true,
+                    reason: 'operator_cleanup',
+                    intentionalStopReason: 'operator_cleanup',
+                    source: args.source,
+                    cleanupMode: args.mode,
+                    action: args.action,
+                    workspace: typeof args.node?.workspace === 'string' ? args.node.workspace : undefined,
+                },
+            });
+        } catch (e: any) {
+            LOG.warn('MeshCleanup', `Failed to record intentional cleanup stop for ${args.sessionId}: ${e?.message || e}`);
+        }
+    }
+
     private async cleanupMeshSessions(args: {
         meshId: string;
         nodeId: string;
@@ -399,6 +919,7 @@ export class DaemonCommandRouter {
         mode: RepoMeshSessionCleanupMode;
         sessionIds?: string[];
         dryRun?: boolean;
+        source?: 'mesh_cleanup_sessions' | 'mesh_remove_node';
     }): Promise<{ success: boolean; [key: string]: unknown }> {
         if (args.mode === 'preserve') {
             return { success: true, mode: 'preserve', matchedCount: 0, stoppedSessionIds: [], deletedSessionIds: [], skippedSessionIds: [] };
@@ -418,6 +939,21 @@ export class DaemonCommandRouter {
         const deleteUnsupportedSessionIds: string[] = [];
         const recordsRemainSessionIds: string[] = [];
         const errors: Array<{ sessionId: string; error: string }> = [];
+        const cleanupSource = args.source || 'mesh_cleanup_sessions';
+        const markedIntentionalStopSessionIds = new Set<string>();
+        const markIntentionalStop = async (sessionId: string, action: 'stop_session' | 'delete_session_force') => {
+            if (args.dryRun || markedIntentionalStopSessionIds.has(sessionId)) return;
+            markedIntentionalStopSessionIds.add(sessionId);
+            await this.recordIntentionalMeshSessionStop({
+                meshId: args.meshId,
+                nodeId: args.nodeId,
+                node: args.node,
+                sessionId,
+                mode: args.mode,
+                source: cleanupSource,
+                action,
+            });
+        };
         const matchedBySurfaceKind = {
             live_runtime: 0,
             recovery_snapshot: 0,
@@ -442,7 +978,10 @@ export class DaemonCommandRouter {
             try {
                 if (args.mode === 'stop') {
                     if (!completed) {
-                        if (!args.dryRun) await this.deps.sessionHostControl.stopSession(sessionId);
+                        if (!args.dryRun) {
+                            await markIntentionalStop(sessionId, 'stop_session');
+                            await this.deps.sessionHostControl.stopSession(sessionId);
+                        }
                         stoppedSessionIds.push(sessionId);
                     } else {
                         skippedSessionIds.push(sessionId);
@@ -461,6 +1000,7 @@ export class DaemonCommandRouter {
                 }
 
                 if (args.mode === 'stop_and_delete') {
+                    if (!completed) await markIntentionalStop(sessionId, 'delete_session_force');
                     if (!args.dryRun) await this.deps.sessionHostControl.deleteSession(sessionId, { force: true });
                     deletedSessionIds.push(sessionId);
                     continue;
@@ -473,6 +1013,7 @@ export class DaemonCommandRouter {
                     recordsRemainSessionIds.push(sessionId);
                     if (args.mode === 'stop_and_delete' && !completed) {
                         try {
+                            await markIntentionalStop(sessionId, 'stop_session');
                             await this.deps.sessionHostControl.stopSession(sessionId);
                             stoppedSessionIds.push(sessionId);
                         } catch (stopError: any) {
@@ -1331,6 +1872,102 @@ export class DaemonCommandRouter {
                 }
             }
 
+            case 'get_mesh_ledger_slice': {
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                if (!meshId) return { success: false, error: 'meshId required' };
+                try {
+                    const { readLedgerSlice } = await import('../mesh/mesh-ledger.js');
+                    const kind = Array.isArray(args?.kind) ? args.kind.filter((k: any) => typeof k === 'string') : undefined;
+                    const slice = readLedgerSlice(meshId, {
+                        afterId: typeof args?.afterId === 'string' ? args.afterId : undefined,
+                        since: typeof args?.since === 'string' ? args.since : undefined,
+                        kind,
+                        limit: typeof args?.limit === 'number' ? args.limit : undefined,
+                    });
+                    return { success: true, slice };
+                } catch (e: any) {
+                    return { success: false, error: e.message };
+                }
+            }
+
+            case 'import_mesh_ledger_slice': {
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                if (!meshId) return { success: false, error: 'meshId required' };
+                try {
+                    const { appendRemoteLedgerEntries, getLedgerSummary } = await import('../mesh/mesh-ledger.js');
+                    const entries = Array.isArray(args?.entries)
+                        ? args.entries as any[]
+                        : Array.isArray(args?.slice?.entries)
+                            ? args.slice.entries as any[]
+                            : [];
+                    const result = appendRemoteLedgerEntries(meshId, entries as any);
+                    return { success: true, result, summary: getLedgerSummary(meshId) };
+                } catch (e: any) {
+                    return { success: false, error: e.message };
+                }
+            }
+
+            case 'get_mesh_queue': {
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                if (!meshId) return { success: false, error: 'meshId required' };
+                try {
+                    const { getMeshQueueStats, getQueue } = await import('../mesh/mesh-work-queue.js');
+                    const status = Array.isArray(args?.status)
+                        ? args.status.map((s: any) => typeof s === 'string' ? s.trim() : '').filter(Boolean)
+                        : undefined;
+                    const queue = getQueue(meshId, { status: status as any });
+                    const summary = getMeshQueueStats(meshId);
+                    return {
+                        success: true,
+                        queue,
+                        summary,
+                        sourceOfTruth: {
+                            kind: 'mesh_work_queue_file',
+                            activeStatuses: ['pending', 'assigned'],
+                            historicalStatuses: ['completed', 'failed', 'cancelled'],
+                            notes: 'pending/assigned are active work; completed/failed/cancelled are historical records.',
+                        },
+                    };
+                } catch (e: any) {
+                    return { success: false, error: e.message };
+                }
+            }
+
+            case 'cancel_mesh_queue_task': {
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                const taskId = typeof args?.taskId === 'string' ? args.taskId.trim() : '';
+                if (!meshId || !taskId) return { success: false, error: 'meshId and taskId required' };
+                try {
+                    const { cancelTask } = await import('../mesh/mesh-work-queue.js');
+                    const reason = typeof args?.reason === 'string' ? args.reason : undefined;
+                    const task = cancelTask(meshId, taskId, { reason });
+                    if (!task) return { success: false, error: `Queue task '${taskId}' not found` };
+                    return { success: true, task };
+                } catch (e: any) {
+                    return { success: false, error: e.message };
+                }
+            }
+
+            case 'requeue_mesh_queue_task': {
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                const taskId = typeof args?.taskId === 'string' ? args.taskId.trim() : '';
+                if (!meshId || !taskId) return { success: false, error: 'meshId and taskId required' };
+                try {
+                    const { requeueTask } = await import('../mesh/mesh-work-queue.js');
+                    const task = requeueTask(meshId, taskId, {
+                        reason: typeof args?.reason === 'string' ? args.reason : undefined,
+                        targetNodeId: typeof args?.targetNodeId === 'string' ? args.targetNodeId.trim() : undefined,
+                        targetSessionId: typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : undefined,
+                        clearTargetNode: args?.clearTargetNode === true,
+                        clearTargetSession: args?.clearTargetSession !== false,
+                    });
+                    if (!task) return { success: false, error: `Queue task '${taskId}' not found` };
+                    return { success: true, task };
+                } catch (e: any) {
+                    return { success: false, error: e.message };
+                }
+            }
+
             case 'add_mesh_node': {
                 const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
                 const workspace = typeof args?.workspace === 'string' ? args.workspace.trim() : '';
@@ -1403,6 +2040,7 @@ export class DaemonCommandRouter {
                         mode,
                         sessionIds,
                         dryRun: args?.dryRun === true,
+                        source: 'mesh_cleanup_sessions',
                     });
                     return result;
                 } catch (e: any) {
@@ -1441,10 +2079,62 @@ export class DaemonCommandRouter {
                     const { stdout: baseBranchStdout } = await execFileAsync('git', ['branch', '--show-current'], { cwd: repoRoot, encoding: 'utf8' });
                     const baseBranch = baseBranchStdout.trim();
 
+                    const validationSummary = await runMeshRefineValidationGate(mesh, node.workspace);
+                    if (validationSummary.status === 'failed') {
+                        return {
+                            success: false,
+                            code: 'validation_failed',
+                            convergenceStatus: 'blocked_review',
+                            error: 'Refinery validation gate failed; merge/refine was not attempted.',
+                            branch,
+                            into: baseBranch,
+                            validationSummary,
+                            finalBranchConvergenceState: {
+                                branch,
+                                baseBranch,
+                                merged: false,
+                                removed: false,
+                                validation: 'failed',
+                                status: 'blocked_review',
+                            },
+                        };
+                    }
+                    if (validationSummary.status === 'skipped') {
+                        return {
+                            success: false,
+                            code: 'validation_unavailable',
+                            convergenceStatus: 'blocked_review',
+                            error: 'Refinery validation gate is required but no allowlisted validation command was available; merge/refine was not attempted.',
+                            branch,
+                            into: baseBranch,
+                            validationSummary,
+                            finalBranchConvergenceState: {
+                                branch,
+                                baseBranch,
+                                merged: false,
+                                removed: false,
+                                validation: 'unavailable',
+                                status: 'blocked_review',
+                            },
+                        };
+                    }
+
                     try {
                         await execFileAsync('git', ['merge', '--no-ff', branch, '-m', `Auto-merge branch '${branch}' via Refinery`], { cwd: repoRoot, encoding: 'utf8' });
                     } catch (e: any) {
-                        return { success: false, error: `Merge failed (conflicts?): ${e.message}` };
+                        return {
+                            success: false,
+                            error: `Merge failed (conflicts?): ${e.message}`,
+                            validationSummary,
+                            finalBranchConvergenceState: {
+                                branch,
+                                baseBranch,
+                                merged: false,
+                                removed: false,
+                                validation: 'passed',
+                                status: 'not_mergeable',
+                            },
+                        };
                     }
 
                     const removeResult = await this.execute('remove_mesh_node', {
@@ -1459,11 +2149,27 @@ export class DaemonCommandRouter {
                         appendLedgerEntry(meshId, {
                             kind: 'node_removed',
                             nodeId,
-                            payload: { refined: true, mergedBranch: branch, into: baseBranch },
+                            payload: { refined: true, mergedBranch: branch, into: baseBranch, validationSummary },
                         });
                     } catch {}
 
-                    return { success: true, merged: true, branch, into: baseBranch, removeResult };
+                    return {
+                        success: true,
+                        merged: true,
+                        branch,
+                        into: baseBranch,
+                        removeResult,
+                        validationSummary,
+                        finalBranchConvergenceState: {
+                            branch: baseBranch,
+                            mergedBranch: branch,
+                            baseBranch,
+                            merged: true,
+                            removed: removeResult?.success !== false,
+                            validation: 'passed',
+                            status: removeResult?.success === false ? 'merged_cleanup_failed' : 'merged',
+                        },
+                    };
                 } catch (e: any) {
                     return { success: false, error: e.message };
                 }
@@ -1483,25 +2189,25 @@ export class DaemonCommandRouter {
                     );
                     let sessionCleanup: Record<string, unknown> | undefined;
                     if (node && sessionCleanupMode !== 'preserve') {
-                        sessionCleanup = await this.cleanupMeshSessions({ meshId, nodeId, node, mode: sessionCleanupMode });
+                        sessionCleanup = await this.cleanupMeshSessions({ meshId, nodeId, node, mode: sessionCleanupMode, source: 'mesh_remove_node' });
                         if (sessionCleanup.success === false) return { success: false, removed: false, sessionCleanup };
                     }
 
-                    // If this is a worktree node, clean up the git worktree first
-                    if (node?.isLocalWorktree && node.workspace) {
-                        try {
-                            const sourceNode = node.clonedFromNodeId
-                                ? mesh?.nodes.find((n: any) => n.id === node.clonedFromNodeId || n.nodeId === node.clonedFromNodeId)
-                                : mesh?.nodes.find((n: any) => !n.isLocalWorktree);
-                            const repoRoot = sourceNode?.repoRoot || sourceNode?.workspace;
-                            if (repoRoot) {
-                                const { removeWorktree } = await import('../git/git-worktree.js');
-                                await removeWorktree(repoRoot, node.workspace);
-                            }
-                        } catch (e: any) {
-                            LOG.warn('MeshNode', `Worktree cleanup failed for ${nodeId}: ${e.message}`);
-                            // Continue with node removal even if worktree cleanup fails
+                    let worktreeCleanup: Record<string, unknown> | undefined;
+                    if (node?.isLocalWorktree) {
+                        const cleanupResult = await this.cleanupLocalWorktreeNode({ mesh, node, nodeId });
+                        if (cleanupResult.success === false) {
+                            return {
+                                success: false,
+                                removed: false,
+                                code: cleanupResult.code,
+                                error: cleanupResult.error,
+                                recoveryHint: cleanupResult.recoveryHint,
+                                ...(sessionCleanup ? { sessionCleanup } : {}),
+                                worktreeCleanup: cleanupResult,
+                            };
                         }
+                        worktreeCleanup = cleanupResult;
                     }
 
                     let removed = false;
@@ -1519,12 +2225,21 @@ export class DaemonCommandRouter {
                             appendLedgerEntry(meshId, {
                                 kind: 'node_removed',
                                 nodeId,
-                                payload: { worktree: !!node?.isLocalWorktree, sessionCleanupMode },
+                                payload: {
+                                    worktree: !!node?.isLocalWorktree,
+                                    sessionCleanupMode,
+                                    workspace: typeof node?.workspace === 'string' ? node.workspace : undefined,
+                                    daemonId: typeof node?.daemonId === 'string' ? node.daemonId : undefined,
+                                    worktreeBranch: typeof node?.worktreeBranch === 'string' ? node.worktreeBranch : undefined,
+                                    worktreeCleanupFallback: typeof worktreeCleanup?.fallback === 'string' ? worktreeCleanup.fallback : undefined,
+                                    forced: worktreeCleanup?.forced === true ? true : undefined,
+                                    forceFallbackReason: typeof worktreeCleanup?.reason === 'string' ? worktreeCleanup.reason : undefined,
+                                },
                             });
                         } catch { /* ledger append is best-effort */ }
                     }
 
-                    return { success: true, removed, ...(sessionCleanup ? { sessionCleanup } : {}) };
+                    return { success: true, removed, ...(sessionCleanup ? { sessionCleanup } : {}), ...(worktreeCleanup ? { worktreeCleanup } : {}) };
                 } catch (e: any) {
                     return { success: false, error: e.message };
                 }
@@ -1564,6 +2279,7 @@ export class DaemonCommandRouter {
                             workspace: result.worktreePath,
                             repoRoot: result.worktreePath,
                             daemonId: sourceNode.daemonId,
+                            machineId: sourceNode.machineId ?? (sourceNode as any).machine_id,
                             userOverrides: { ...(sourceNode.userOverrides || {}) },
                             policy: { ...(sourceNode.policy || {}) },
                             isLocalWorktree: true,
@@ -1577,6 +2293,7 @@ export class DaemonCommandRouter {
                             workspace: result.worktreePath,
                             repoRoot: result.worktreePath,
                             daemonId: sourceNode.daemonId,
+                            machineId: sourceNode.machineId ?? (sourceNode as any).machine_id,
                             userOverrides: { ...(sourceNode.userOverrides || {}) },
                             isLocalWorktree: true,
                             worktreeBranch: result.branch,
@@ -1711,6 +2428,105 @@ export class DaemonCommandRouter {
                         };
                     }
 
+                    // ─── CLI-command MCP registration (Codex, Gemini CLI) ───────────
+                    if (coordinatorSetup.kind === 'cli_command') {
+                        // Build coordinator prompt first — fail closed on errors.
+                        let cliCmdSystemPrompt = '';
+                        try {
+                            cliCmdSystemPrompt = buildCoordinatorSystemPrompt({ mesh, coordinatorCliType: cliType });
+                        } catch (error: any) {
+                            const message = error?.message || String(error);
+                            LOG.error('MeshCoordinator', `Failed to build coordinator prompt: ${message}`);
+                            return {
+                                success: false,
+                                code: 'mesh_coordinator_prompt_failed',
+                                error: `Failed to build Repo Mesh coordinator prompt: ${message}`,
+                                meshId, cliType, workspace,
+                            };
+                        }
+
+                        // Run the provider's MCP registration command.
+                        try {
+                            const { execFileSync: execCmdSync } = await import('node:child_process');
+                            const cmdParts = coordinatorSetup.command.trim().split(/\s+/);
+                            const [regCmd, ...regArgs] = cmdParts;
+                            LOG.info('MeshCoordinator', `Running MCP registration: ${coordinatorSetup.command}`);
+                            execCmdSync(regCmd, regArgs, { stdio: 'pipe', timeout: 15_000 });
+                        } catch (error: any) {
+                            // Non-fatal — server may already be registered (providers return exit 1 on duplicate).
+                            LOG.warn('MeshCoordinator', `MCP registration command failed (may be pre-registered): ${error?.message || error}`);
+                        }
+
+                        // Inject system prompt using provider-native methods.
+                        // Codex: -c 'instructions="..."' CLI config override
+                        // Gemini: write GEMINI.md to workspace (auto-loaded as context)
+                        const cliCmdArgs: string[] = [];
+                        const cliCmdEnv: Record<string, string> = {};
+                        if (cliCmdSystemPrompt) {
+                            if (cliType === 'codex-cli') {
+                                // Codex reads `developer_instructions` from config.toml as system instructions.
+                                // The -c flag overrides a config key for this session only.
+                                cliCmdArgs.push('-c', `developer_instructions=${JSON.stringify(cliCmdSystemPrompt)}`);
+                            } else if (cliType === 'gemini-cli') {
+                                // Gemini CLI auto-loads GEMINI.md from CWD as project context.
+                                // Write a temporary GEMINI.md to the workspace before launch.
+                                try {
+                                    const { writeFileSync: wfs, existsSync: efs, readFileSync: rfs } = await import('node:fs');
+                                    const geminiMdPath = `${workspace}/GEMINI.md`;
+                                    const marker = '<!-- adhdev-mesh-coordinator-prompt -->';
+                                    const markerEnd = '<!-- /adhdev-mesh-coordinator-prompt -->';
+                                    const block = `${marker}\n${cliCmdSystemPrompt}\n${markerEnd}`;
+                                    if (efs(geminiMdPath)) {
+                                        const existing = rfs(geminiMdPath, 'utf-8');
+                                        // Replace existing block or append
+                                        const replaced = existing.replace(
+                                            new RegExp(`${marker}[\\s\\S]*?${markerEnd}`, 'g'),
+                                            block,
+                                        );
+                                        wfs(geminiMdPath, replaced.includes(marker) ? replaced : `${existing}\n\n${block}`);
+                                    } else {
+                                        wfs(geminiMdPath, block);
+                                    }
+                                    LOG.info('MeshCoordinator', `Wrote coordinator prompt to ${workspace}/GEMINI.md`);
+                                } catch (e: any) {
+                                    LOG.warn('MeshCoordinator', `Could not write GEMINI.md: ${e?.message || e}`);
+                                }
+                            }
+                        }
+
+                        const cliCmdLaunch: any = await this.deps.cliManager.handleCliCommand('launch_cli', {
+                            cliType,
+                            dir: workspace,
+                            cliArgs: cliCmdArgs.length > 0 ? cliCmdArgs : undefined,
+                            env: Object.keys(cliCmdEnv).length > 0 ? cliCmdEnv : undefined,
+                            settings: { meshCoordinatorFor: meshId },
+                        });
+
+                        if (!cliCmdLaunch?.success) {
+                            return { success: false, error: cliCmdLaunch?.error || 'Failed to launch CLI session' };
+                        }
+
+                        LOG.info('MeshCoordinator', `Launched ${cliType} coordinator (cli_command) for mesh ${meshId}`);
+                        try {
+                            const { appendLedgerEntry } = await import('../mesh/mesh-ledger.js');
+                            appendLedgerEntry(meshId, {
+                                kind: 'coordinator_started',
+                                sessionId: cliCmdLaunch.sessionId || cliCmdLaunch.id,
+                                providerType: cliType,
+                                payload: { workspace },
+                            });
+                        } catch { /* best-effort */ }
+
+                        return {
+                            success: true,
+                            meshId,
+                            cliType,
+                            workspace,
+                            sessionId: cliCmdLaunch.sessionId || cliCmdLaunch.id,
+                            mcpRegistered: true,
+                        };
+                    }
+
                     const configFormat = coordinatorSetup.configFormat as MeshCoordinatorConfigFormat;
                     if (configFormat !== 'claude_mcp_json' && configFormat !== 'hermes_config_yaml') {
                         return {
@@ -1777,9 +2593,11 @@ export class DaemonCommandRouter {
                         args: coordinatorSetup.mcpServer.args,
                     };
                     if (args?.inlineMesh) {
+                        const modeArgIndex = coordinatorSetup.mcpServer.args.findIndex((value: string) => value === '--mode');
+                        const mcpTransport = modeArgIndex >= 0 ? coordinatorSetup.mcpServer.args[modeArgIndex + 1] : 'ipc';
                         mcpServerEntry.env = {
                             ADHDEV_INLINE_MESH: JSON.stringify(mesh),
-                            ADHDEV_MCP_TRANSPORT: 'ipc',
+                            ADHDEV_MCP_TRANSPORT: mcpTransport === 'local' ? 'local' : 'ipc',
                         };
                     }
 
@@ -1801,7 +2619,10 @@ export class DaemonCommandRouter {
                     if (hadExistingMcpConfig) {
                         try {
                             const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync(mcpConfigPath, 'utf-8'), configFormat);
-                            existingMcpConfig = { ...existingMcpConfig, ...parsedExistingMcpConfig };
+                            const existingCoordinatorConfig = hermesManualFallback
+                                ? stripHermesCoordinatorTempModelProviderOverrides(parsedExistingMcpConfig)
+                                : parsedExistingMcpConfig;
+                            existingMcpConfig = { ...existingMcpConfig, ...existingCoordinatorConfig };
                             copyFileSync(mcpConfigPath, mcpConfigPath + '.backup');
                         } catch (error: any) {
                             LOG.error('MeshCoordinator', `Failed to parse existing MCP config ${mcpConfigPath}: ${error?.message || error}`);
@@ -1893,6 +2714,123 @@ export class DaemonCommandRouter {
                 }
             }
 
+            case 'mesh_status': {
+                const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+                if (!meshId) return { success: false, error: 'meshId required' };
+                try {
+                    const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
+                    const mesh = meshRecord?.mesh;
+                    if (!mesh) return { success: false, error: 'Mesh not found' };
+
+                    const { getMeshQueueStats, getQueue } = await import('../mesh/mesh-work-queue.js');
+                    const queue = getQueue(meshId);
+                    const queueSummary = getMeshQueueStats(meshId);
+
+                    const { readLedgerEntries, getLedgerSummary } = await import('../mesh/mesh-ledger.js');
+                    const ledgerEntries = readLedgerEntries(meshId, { tail: 20 });
+                    const ledgerSummary = getLedgerSummary(meshId);
+
+                    const nodeStatuses = [];
+                    for (const node of mesh.nodes || []) {
+                        const status: Record<string, unknown> = {
+                            nodeId: node.id || node.nodeId,
+                            machineLabel: node.machineLabel || node.id || node.nodeId,
+                            workspace: node.workspace,
+                            repoRoot: node.repoRoot,
+                            isLocalWorktree: node.isLocalWorktree,
+                            worktreeBranch: node.worktreeBranch,
+                            daemonId: node.daemonId,
+                            machineId: node.machineId,
+                            health: 'unknown',
+                            providers: node.providers || [],
+                            activeSessions: [],
+                        };
+                        if (node.workspace && typeof node.workspace === 'string') {
+                            try {
+                                const { execFile } = await import('node:child_process');
+                                const { promisify } = await import('node:util');
+                                const execFileAsync = promisify(execFile);
+
+                                const runGit = async (args: string[]): Promise<string> => {
+                                    const result = await execFileAsync('git', ['-C', node.workspace as string, ...args], {
+                                        encoding: 'utf8',
+                                        timeout: 10_000,
+                                    });
+                                    return result.stdout.trim();
+                                };
+
+                                const branch = await runGit(['branch', '--show-current']).catch(() => '');
+                                const porc = await runGit(['status', '--porcelain']).catch(() => '');
+                                const headCommit = await runGit(['rev-parse', '--short', 'HEAD']).catch(() => null);
+                                const headMessage = await runGit(['log', '-1', '--format=%s']).catch(() => null);
+                                const upstream = await runGit(['rev-parse', '--abbrev-ref', '@{upstream}']).catch(() => null);
+                                const aheadBehind = await runGit(['rev-list', '--left-right', '--count', '@{upstream}...HEAD']).catch(() => '');
+                                const stashCount = await runGit(['stash', 'list']).catch(() => '');
+
+                                let ahead = 0, behind = 0;
+                                if (aheadBehind) {
+                                    const parts = aheadBehind.split(/\s+/);
+                                    if (parts.length >= 2) {
+                                        behind = parseInt(parts[0], 10) || 0;
+                                        ahead = parseInt(parts[1], 10) || 0;
+                                    }
+                                }
+
+                                const dirty = porc.length > 0;
+                                const lines = porc ? porc.split('\n').filter(Boolean) : [];
+                                let staged = 0, modified = 0, untracked = 0, deleted = 0, renamed = 0;
+                                for (const line of lines) {
+                                    const xy = line.slice(0, 2);
+                                    if (xy[0] !== ' ' && xy[0] !== '?') staged++;
+                                    if (xy[1] === 'M') modified++;
+                                    if (xy[1] === 'D') deleted++;
+                                    if (xy[0] === 'R' || xy[1] === 'R') renamed++;
+                                    if (xy === '??') untracked++;
+                                }
+
+                                status.git = {
+                                    workspace: node.workspace,
+                                    repoRoot: node.workspace,
+                                    isGitRepo: true,
+                                    branch: branch || null,
+                                    headCommit,
+                                    headMessage,
+                                    upstream,
+                                    ahead,
+                                    behind,
+                                    staged,
+                                    modified,
+                                    untracked,
+                                    deleted,
+                                    renamed,
+                                    hasConflicts: false,
+                                    conflictFiles: [],
+                                    stashCount: stashCount ? stashCount.split('\n').filter(Boolean).length : 0,
+                                    lastCheckedAt: Date.now(),
+                                };
+                                status.health = branch ? (dirty ? 'dirty' : 'online') : 'degraded';
+                            } catch {
+                                status.health = 'degraded';
+                            }
+                        }
+                        nodeStatuses.push(status);
+                    }
+
+                    return {
+                        success: true,
+                        meshId: mesh.id,
+                        meshName: mesh.name,
+                        repoIdentity: mesh.repoIdentity,
+                        defaultBranch: mesh.defaultBranch,
+                        nodes: nodeStatuses,
+                        queue: { tasks: queue, summary: queueSummary },
+                        ledger: { entries: ledgerEntries, summary: ledgerSummary },
+                    };
+                } catch (e: any) {
+                    return { success: false, error: e.message };
+                }
+            }
+
             default:
                 break;
         }