@adhdev/daemon-core 0.9.82-rc.15 → 0.9.82-rc.151

package/dist/providers/sdk/v1/validators/taint.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Static taint analyzer for extended-tier override JS.
+ *
+ * Goal: classify the override JS shipped with an extended-tier provider into
+ * one of three risk tiers, so the marketplace + daemon trust prompt can
+ * surface accurate language to the operator instead of a single generic
+ * "this provider contains JS" warning.
+ *
+ *   - clean    : no flagged APIs at all. The override looks like pure string
+ *                manipulation. Still extended-tier, but the warning copy is
+ *                "this provider contains JS; nothing dangerous was detected".
+ *   - elevated : touches process / dynamic codegen / dynamic require / eval
+ *                / Function constructor / child_process. The warning copy is
+ *                explicit ("this provider can run shell commands / dynamically
+ *                load code").
+ *   - hostile  : combines elevated APIs with network egress, AND uses obvious
+ *                obfuscation (base64-decoded strings fed into Function / eval).
+ *                The publish endpoint should reject these.
+ *
+ * Implementation note: this is a *static* analyzer — string + light AST scan
+ * via Node's built-in parser. It is intentionally fail-loud: anything that
+ * looks suspicious is flagged. False positives are fine; this exists to gate
+ * the trust prompt, not to be a real sandbox. The real sandbox lives in
+ * Phase 5 (isolated-vm).
+ *
+ * Used by:
+ *   - `adhdev provider validate` (CLI tier classification)
+ *   - registry publish endpoint static-check
+ *   - daemon at provider-load time, to size the warning
+ */
+export type TaintLevel = 'clean' | 'elevated' | 'hostile';
+export interface TaintFinding {
+    /** What was found, e.g. "child_process.exec". */
+    api: string;
+    /** Coarse category. */
+    category: TaintCategory;
+    /** File the finding came from. */
+    file: string;
+    /** Line number (1-indexed) of the first character of the matched token. */
+    line: number;
+    /** The surrounding source excerpt, trimmed. */
+    excerpt: string;
+}
+export type TaintCategory = 'process-control' | 'shell-exec' | 'fs-write' | 'fs-read' | 'network' | 'dynamic-codegen' | 'dynamic-require' | 'obfuscation' | 'global-mutation';
+export interface TaintResult {
+    level: TaintLevel;
+    findings: TaintFinding[];
+    files: string[];
+}
+export declare function analyzeOverrideTaint(manifestPath: string): TaintResult;
+/** Format a result as a single CLI-friendly block. */
+export declare function formatTaintResult(result: TaintResult): string;

package/dist/providers/transcript-v2.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Chat Transcript Contract v2
+ *
+ * First-class message identity, monotonic sequence, strict enums. Designed to
+ * replace the v1 contract (contracts.ts ReadChatResult + types.ts ChatMessage)
+ * during the A2 big-bang. This module defines the contract; it does not yet
+ * change runtime behaviour. v1 keeps working until A2 flips the switch.
+ *
+ * Invariants v2 enforces (and v1 does not):
+ *   1. Every ChatMessageV2 has providerUnitKey, bubbleId, sequence — none optional.
+ *   2. sequence is a monotonic integer per (sessionId, source) tuple. Producers
+ *      never reuse it; consumers MAY assume strict ordering.
+ *   3. providerUnitKey is stable across re-reads: the same logical message
+ *      always yields the same key even if its index shifts or content is
+ *      edited mid-stream. Producers derive it from provider-owned identifiers
+ *      (turn id, native message id), not from content hashes or array index.
+ *   4. timestamp is producer-asserted wall-clock; orderingTimestamp is monotonic
+ *      and used for snapshot diffs. 1ms fallback increments are forbidden — if
+ *      a producer cannot supply a stable monotonic value, the daemon assigns
+ *      sequence at ingest and orderingTimestamp = ingestedAt.
+ *   5. visibility / source / role / kind are strict unions. No `(string & {})`
+ *      escape hatches.
+ *   6. Coverage is exactly one of full/tail/current-turn. Mixing it with
+ *      partialReason or unavailableReason is a contract violation.
+ *   7. workspace / sessionId are explicit on every ReadChatResultV2; the daemon
+ *      no longer infers them from message bodies.
+ */
+import type { MessagePart, ToolCallInfo } from './contracts.js';
+export declare const CHAT_CONTRACT_VERSION_V1: "1.0";
+export declare const CHAT_CONTRACT_VERSION_V2: "2.0";
+export type ChatContractVersion = typeof CHAT_CONTRACT_VERSION_V1 | typeof CHAT_CONTRACT_VERSION_V2;
+export declare const SUPPORTED_CHAT_CONTRACT_VERSIONS: readonly ChatContractVersion[];
+export declare const CHAT_ROLES_V2: readonly ["user", "assistant", "system"];
+export type ChatRoleV2 = typeof CHAT_ROLES_V2[number];
+export declare const CHAT_MESSAGE_KINDS_V2: readonly ["standard", "thought", "tool", "terminal", "system"];
+export type ChatMessageKindV2 = typeof CHAT_MESSAGE_KINDS_V2[number];
+export declare const CHAT_VISIBILITIES_V2: readonly ["user", "debug", "internal", "hidden"];
+export type ChatVisibilityV2 = typeof CHAT_VISIBILITIES_V2[number];
+export declare const CHAT_AUDIENCES_V2: readonly ["chat", "debug", "trace", "internal"];
+export type ChatAudienceV2 = typeof CHAT_AUDIENCES_V2[number];
+export declare const CHAT_SOURCES_V2: readonly ["assistant_text", "tool_call", "terminal_command", "runtime_activity", "runtime_status", "provider_chrome", "control"];
+export type ChatSourceV2 = typeof CHAT_SOURCES_V2[number];
+export declare const CHAT_BUBBLE_STATES_V2: readonly ["draft", "streaming", "final", "removed"];
+export type ChatBubbleStateV2 = typeof CHAT_BUBBLE_STATES_V2[number];
+/**
+ * Stable identity of a single chat message. All fields are required in v2.
+ *
+ * - providerUnitKey: provider-owned canonical id. Must be derivable from
+ *   provider primitives (native message id, turn id, bubble id), NOT from
+ *   array index or content hash. Stable across re-reads of the same logical
+ *   message even if neighbours change.
+ * - bubbleId: dashboard-owned bubble identity. May equal providerUnitKey when
+ *   the provider already exposes a bubble-grained id; otherwise daemon
+ *   derives it deterministically from providerUnitKey (e.g. `bubble:${key}`).
+ * - sequence: monotonic integer per (sessionId, source). Strictly increasing
+ *   over the lifetime of the session. Used for snapshot diffs and dedup.
+ * - turnKey: stable identifier for the conversation turn this message belongs
+ *   to. Required so consumers can group messages without re-deriving turns.
+ */
+export interface MessageIdentityV2 {
+    providerUnitKey: string;
+    bubbleId: string;
+    sequence: number;
+    turnKey: string;
+}
+/**
+ * Producer-asserted wall-clock time (ms since epoch). Forward jumps are
+ * permitted; consumers MUST NOT rely on this for ordering.
+ */
+export type ChatTimestampMs = number;
+/**
+ * Monotonic ordering value (ms since epoch, but assigned by the daemon at
+ * ingest to guarantee monotonicity even if the producer's wall clock skews).
+ * Used by snapshot diffs in place of timestamp.
+ */
+export type ChatOrderingTimestampMs = number;
+export interface ChatMessageV2 extends MessageIdentityV2 {
+    role: ChatRoleV2;
+    kind: ChatMessageKindV2;
+    content: string | MessagePart[];
+    bubbleState: ChatBubbleStateV2;
+    timestamp: ChatTimestampMs;
+    orderingTimestamp: ChatOrderingTimestampMs;
+    visibility: ChatVisibilityV2;
+    audience: ChatAudienceV2;
+    source: ChatSourceV2;
+    /** Sender display name (for shared sessions). Empty string when unused. */
+    senderName: string;
+    /** Tool calls associated with this message. Empty array when none. */
+    toolCalls: ToolCallInfo[];
+    /** Producer-defined metadata. Daemon never inspects this except for passthrough. */
+    meta: Readonly<Record<string, unknown>>;
+}
+export interface WorkspaceContextV2 {
+    /** Absolute realpath of the workspace the session is reading from. */
+    workspacePath: string;
+    /** Workspace the session was intended to operate on (may differ during cross-workspace ops). */
+    intendedWorkspacePath: string;
+}
+export interface SessionContextV2 {
+    /** Provider-owned session id (e.g. claude.jsonl uuid, codex session_meta.id). */
+    providerSessionId: string;
+    /** Optional daemon-side history alias used to disambiguate within a workspace. */
+    historySessionId?: string;
+}
+/**
+ * v1 allowed `coverage='full'` to coexist with `partialReason`/`unavailableReason`,
+ * which is a contract lie. v2 makes the three states mutually exclusive.
+ */
+export type CoverageHintV2 = {
+    kind: 'full';
+} | {
+    kind: 'tail';
+    tailMessageCount: number;
+} | {
+    kind: 'current-turn';
+    turnKey: string;
+} | {
+    kind: 'partial';
+    partialReason: string;
+} | {
+    kind: 'unavailable';
+    unavailableReason: string;
+};
+export type CanonicalHistoryModeV2 = 'native-source' | 'disabled' | 'materialized-mirror';
+export interface CanonicalHistoryDeclarationV2 {
+    contractVersion: ChatContractVersion;
+    format: string;
+    mode: CanonicalHistoryModeV2;
+    watchPath?: string;
+    scripts: {
+        readSession: string;
+        listSessions: string;
+    };
+}
+export type ReadChatStatusV2 = 'idle' | 'generating' | 'waiting_approval' | 'error' | 'panel_hidden' | 'streaming';
+export type ReadChatTurnStatusV2 = 'open' | 'waiting_approval' | 'complete' | 'error';
+export interface ReadChatResultV2 {
+    contractVersion: typeof CHAT_CONTRACT_VERSION_V2;
+    workspace: WorkspaceContextV2;
+    session: SessionContextV2;
+    coverage: CoverageHintV2;
+    status: ReadChatStatusV2;
+    messages: ChatMessageV2[];
+    currentTurnId: string;
+    turnStatus: ReadChatTurnStatusV2;
+    transcriptAuthority: 'provider' | 'daemon';
+}
+export declare class ChatContractViolationError extends Error {
+    readonly violationPath: string;
+    readonly contractVersion: ChatContractVersion;
+    constructor(contractVersion: ChatContractVersion, violationPath: string, detail: string);
+}
+/**
+ * Validate a v2 read_chat payload. Throws ChatContractViolationError on the
+ * first violation. v2 invariants beyond per-field checks:
+ *   - messages[*].sequence strictly increasing
+ *   - messages[*].orderingTimestamp monotonic non-decreasing
+ *   - coverage union is well-formed
+ */
+export declare function assertReadChatResultV2Payload(raw: unknown): ReadChatResultV2;
+export declare function isSupportedChatContractVersion(value: unknown): value is ChatContractVersion;
+/**
+ * Read a provider's declared chat contract version from its parsed
+ * provider.json `canonicalHistory.contractVersion` field.
+ *
+ * - Absent or unrecognized → treated as v1 (legacy behaviour preserved during
+ *   the A1 transition). A2 will tighten this to reject unsupported versions
+ *   at provider load time.
+ * - Present and supported → returned as-is.
+ *
+ * The returned version drives which validator (assertReadChatResultV2Payload
+ * vs the legacy validateReadChatResultPayload) processes the provider's
+ * read_chat output.
+ */
+export declare function readDeclaredChatContractVersion(canonicalHistory: unknown): ChatContractVersion;

package/dist/repo-mesh-types.d.ts

@@ -19,10 +19,37 @@ export interface RepoMesh {
     defaultBranch?: string;
     policy: RepoMeshPolicy;
     coordinator: RepoMeshCoordinatorConfig;
+    meshHost?: RepoMeshHostMetadata;
     projectContext: ProjectContextSnapshot;
     nodes: RepoMeshNode[];
     status: 'active' | 'archived' | 'deleted';
 }
+export type RepoMeshDaemonRole = 'host' | 'member';
+export interface RepoMeshHostPairingMetadata {
+    status: 'not_configured' | 'pairing' | 'paired' | 'rejected' | 'revoked';
+    tokenId?: string;
+    joinedAt?: string;
+    lastPairedAt?: string;
+    lastRejectedAt?: string;
+    expiresAt?: string;
+}
+export interface RepoMeshHostMetadata {
+    /** Local daemon role for this mesh. Missing metadata defaults to host for standalone compatibility. */
+    role: RepoMeshDaemonRole;
+    /** Daemon that owns mesh truth/status/git/queue/session/ledger/coordinator ownership. */
+    hostDaemonId?: string;
+    /** Mesh node that represents the host daemon, when known. */
+    hostNodeId?: string;
+    /** Future standalone manual pairing endpoint entered by member daemons. */
+    hostAddress?: string;
+    /** Redacted pairing state only; raw join tokens must not be persisted here. */
+    pairing?: RepoMeshHostPairingMetadata;
+}
+export interface RepoMeshHostStatus extends RepoMeshHostMetadata {
+    canOwnCoordinator: boolean;
+    canOwnQueue: boolean;
+    defaulted: boolean;
+}
 export interface RepoMeshNode {
     id: string;
     daemonId: string;
@@ -37,6 +64,7 @@ export interface RepoMeshNode {
     effectiveCapabilities: RepoMeshNodeCapabilities;
     policy: RepoMeshNodePolicy;
     health: RepoMeshNodeHealth;
+    role?: RepoMeshDaemonRole;
     status: 'enabled' | 'disabled' | 'removed';
 }
 export type RepoMeshNodeHealth = 'online' | 'offline' | 'degraded' | 'dirty' | 'wrong_branch' | 'unknown';
@@ -46,6 +74,13 @@ export interface RepoMeshPolicy {
     requirePreTaskCheckpoint: boolean;
     requirePostTaskCheckpoint: boolean;
     requireApprovalForPush: boolean;
+    /**
+     * Narrow Refinery opt-in: when validation and patch-equivalence have passed,
+     * allow Refinery to publish submodule gitlink commits to each submodule's
+     * configured remote main branch with a non-force push, then verify reachability.
+     * Defaults to false; root branch pushes/merges are not affected.
+     */
+    allowAutoPublishSubmoduleMainCommits?: boolean;
     requireApprovalForDestructiveGit: boolean;
     dirtyWorkspaceBehavior: 'block' | 'warn' | 'checkpoint_then_continue';
     maxParallelTasks: number;
@@ -185,6 +220,7 @@ export interface LocalMeshEntry {
     defaultBranch?: string;
     policy: RepoMeshPolicy;
     coordinator: RepoMeshCoordinatorConfig;
+    meshHost?: RepoMeshHostMetadata;
     nodes: LocalMeshNodeEntry[];
     createdAt: string;
     updatedAt: string;
@@ -204,8 +240,23 @@ export interface LocalMeshNodeEntry {
     worktreeBranch?: string;
     /** Node ID this worktree was cloned from */
     clonedFromNodeId?: string;
+    /** Repo-local preparation result for ADHDev-created worktree nodes. */
+    worktreeBootstrap?: {
+        status: 'ready' | 'running' | 'failed' | 'not_configured' | 'disabled' | 'stale';
+        required?: boolean;
+        configSource?: string;
+        configSourceType?: string;
+        startedAt?: string;
+        completedAt?: string;
+        lastCommand?: string;
+        exitCode?: number | null;
+        error?: string;
+        commandsRun?: Array<Record<string, unknown>>;
+        staleInputs?: string[];
+    };
     /** Optional associated/external repos configured as node metadata. */
     relatedRepos?: RepoMeshRelatedRepo[];
+    role?: RepoMeshDaemonRole;
 }
 export interface RepoMeshStatus {
     meshId: string;
@@ -213,6 +264,7 @@ export interface RepoMeshStatus {
     repoIdentity: string;
     defaultBranch?: string;
     refreshedAt: string;
+    meshHost?: RepoMeshHostStatus;
     nodes: RepoMeshNodeStatus[];
     queue?: RepoMeshQueueStatus;
     ledger?: RepoMeshLedgerStatus;
@@ -249,16 +301,26 @@ export interface RepoMeshNodeStatus {
     repoRoot?: string;
     daemonId?: string;
     machineId?: string;
+    role?: RepoMeshDaemonRole;
     machineStatus?: string;
     isLocalWorktree?: boolean;
     worktreeBranch?: string;
     health: RepoMeshNodeHealth;
     git?: GitRepoStatus;
+    /**
+     * True when the selected coordinator has evidence that a peer git probe is still
+     * in flight or just timed out during initial mesh handshake, so callers should
+     * treat missing git data as pending instead of authoritative absence.
+     */
+    gitProbePending?: boolean;
     providers: string[];
     activeSessions: string[];
     activeSessionDetails?: RepoMeshSessionStatus[];
     providerPriority?: string[];
     launchReady?: boolean;
+    worktreeBootstrap?: LocalMeshNodeEntry['worktreeBootstrap'];
+    launchBlockedReason?: string;
+    launchBlockedMessage?: string;
     lastSeenAt?: string;
     updatedAt?: string;
     connection?: RepoMeshPeerConnectionStatus;
@@ -346,3 +408,8 @@ export interface RepoMeshLedgerStatus {
     entries: RepoMeshLedgerEntryStatus[];
     summary: RepoMeshLedgerSummaryStatus;
 }
+export interface MeshAsyncJobLifecycle {
+    startedAt?: string;
+    completedAt?: string;
+    error?: string;
+}

package/dist/shared-types.d.ts

@@ -49,6 +49,13 @@ export interface ReadChatSyncResult {
         message: string;
         buttons: string[];
     } | null;
+    /**
+     * Chat source provenance from ChatSourceMachine (A2). Carries the
+     * selected source, transition cause, lock state, and legacy
+     * fallbackReason — opaque to the daemon-core, consumed by web-core
+     * for the source debug badge and SourceTimeline (A3).
+     */
+    messageSource?: Record<string, unknown>;
 }
 export interface ProviderSummaryItem {
     id: string;
@@ -292,6 +299,11 @@ export interface SessionEntry {
     seenCompletionMarker?: string;
     surfaceHidden?: boolean;
     settings?: Record<string, any>;
+    /** Set when this session is acting as a mesh coordinator for the given mesh. */
+    coordinator?: {
+        meshId: string;
+        role: 'coordinator';
+    };
     meshQueueStats?: {
         total?: number;
         active?: number;

package/dist/status/reporter.d.ts

@@ -46,6 +46,8 @@ export declare class DaemonStatusReporter {
     private lastStatusSentAt;
     private statusPendingThrottle;
     private lastP2PStatusHash;
+    private lastP2PStatusSentAt;
+    private p2pDebounceTimer;
     private lastServerStatusHash;
     private lastStatusSummary;
     private statusTimer;

package/dist/status/snapshot.d.ts

@@ -75,6 +75,7 @@ export declare function getSessionCompletionMarker(session: {
             receivedAt?: number | string;
             timestamp?: number | string;
             _turnKey?: string;
+            kind?: string;
         }> | null;
     } | null;
 }): string;

package/dist/types.d.ts

@@ -36,6 +36,11 @@ export interface ChatMessage {
     index?: number;
     timestamp?: number;
     receivedAt?: number;
+    /** (A2.3) Monotonic sequence number per (session, source). Producer-asserted
+     *  when emitted by v2-aware providers (transcript v2 schema); otherwise
+     *  derived by the daemon from receivedAt/timestamp/index. ChatSourceMachine
+     *  uses this as the native peak watermark for regression detection. */
+    sequence?: number;
     _turnKey?: string;
     /** Tool calls associated with this message */
     toolCalls?: ToolCallInfo[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.15",
+  "version": "0.9.82-rc.151",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,7 +27,7 @@
   "scripts": {
     "build": "tsup && npm run build:types",
     "build:types": "tsc -p tsconfig.json --emitDeclarationOnly --declaration --declarationMap false",
-    "dev": "tsup --watch",
+    "dev": "tsup --watch --no-clean",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json"
@@ -49,6 +49,9 @@
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "@xterm/xterm": "^6.0.0",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "better-sqlite3": "^12.10.0",
     "chalk": "^5.3.0",
     "chokidar": "^4.0.3",
     "conf": "^13.0.0",
@@ -60,6 +63,7 @@
     "@adhdev/ghostty-vt-node": "*"
   },
   "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/ws": "^8.18.1",

package/src/boot/daemon-lifecycle.ts

@@ -37,6 +37,9 @@ import type { PtyTransportFactory } from '../cli-adapters/pty-transport.js';
 import type { IdeProviderInstance } from '../providers/ide-provider-instance.js';
 import { createDefaultGitCommandServices } from '../git/git-commands.js';
 import { setupMeshEventForwarding } from '../mesh/mesh-events.js';
+import { loadMeshCoordinatorRegistry } from '../mesh/coordinator-registry.js';
+import { applyProcessHardening } from './process-hardening.js';
+import { installProviderProcessShim } from '../providers/sdk/v1/sandbox/require-whitelist.js';
 
 // ─── Init Config ───
 
@@ -129,8 +132,16 @@ export interface DaemonDevSupportOptions {
  *   8. Start instance ticking
  */
 export async function initDaemonComponents(config: DaemonInitConfig): Promise<DaemonComponents> {
+    // 0. Process-level hardening (must run before any provider script is loaded).
+    //    Freezes built-in prototypes (Object/Array/Function/String/Number/Boolean/Promise)
+    //    and shadows process.exit/kill/abort/binding/dlopen so provider-script callers
+    //    throw instead of killing the daemon. See ./process-hardening.ts for details.
+    applyProcessHardening();
+    installProviderProcessShim();
+
     // 1. Global log interceptor
     installGlobalInterceptor();
+    loadMeshCoordinatorRegistry();
 
     // 2. ProviderLoader (provider source mode from config.json)
     const appConfig = loadConfig();
@@ -142,16 +153,11 @@ export async function initDaemonComponents(config: DaemonInitConfig): Promise<Da
         userDir: appConfig.providerDir,
     });
 
-    // If no upstream providers exist, fetch them first (blocking — critical for new users)
-    if (!disableUpstream && !providerLoader.hasUpstream()) {
-        LOG.info('Provider', 'No upstream providers found — downloading from GitHub...');
-        try {
-            await providerLoader.fetchLatest();
-        } catch (e: any) {
-            LOG.warn('Provider', `⚠ Failed to fetch providers: ${e?.message}`);
-        }
-    }
-
+    // Boot-time auto-sync is intentionally disabled. The user picks which
+    // providers to install via the dashboard onboarding / Providers tab; the
+    // daemon ships empty and only contains what the user explicitly installs.
+    // Manual sync is still available via the install / check_provider_updates
+    // commands (and the REST endpoint at /api/v1/providers/updates).
     providerLoader.loadAll();
     providerLoader.registerToDetector();
 
@@ -309,6 +315,7 @@ export async function initDaemonComponents(config: DaemonInitConfig): Promise<Da
         statusInstanceId: config.statusInstanceId,
         statusVersion: config.statusVersion,
         getMeshPeerConnectionStatus: config.getMeshPeerConnectionStatus,
+        dispatchMeshCommand: config.dispatchMeshCommand,
         getCdpLogFn: config.getCdpLogFn || ((ideType: string) => LOG.forComponent(`CDP:${ideType}`).asLogFn()),
     });
 

package/src/boot/process-hardening.ts

@@ -0,0 +1,89 @@
+/**
+ * Process-level hardening — boot-time mitigations against provider scripts.
+ *
+ * Provider scripts run in-process (see providers/sdk/v1/sandbox/README-design.ts).
+ * The require() whitelist (sandbox/require-whitelist.ts) blocks the obvious
+ * attack surfaces (no `child_process.exec`, no `fs.writeFile`, no `net`, etc.)
+ * but a malicious or buggy script can still:
+ *
+ *   1. Pollute Object.prototype to influence the daemon's downstream consumers
+ *      (e.g. `Object.prototype.toString = () => '...'` makes every untagged
+ *      object stringify to that value across the whole process).
+ *   2. Mutate Array/Function/String prototypes for similar effect.
+ *   3. Call `process.exit()` / `process.kill()` to kill the daemon.
+ *
+ * Sandbox isolation (isolated-vm) is the proper fix but has a real perf cost
+ * and a real marshalling-complexity cost. As a cheaper layer we just freeze
+ * the built-in prototypes at boot, which is irreversible and catches every
+ * prototype-pollution variant for the lifetime of the process.
+ *
+ * `applyProcessHardening()` is idempotent — calling it twice is a no-op the
+ * second time. The function intentionally swallows any "cannot redefine
+ * property" errors that would arise if some upstream code already froze
+ * the same prototype: the post-condition (prototype is frozen) is satisfied
+ * either way.
+ *
+ * Trade-offs:
+ *   - Read-only access to prototype methods (`Object.prototype.hasOwnProperty.call`,
+ *     `Array.prototype.slice.call`, etc.) is unaffected — only writes throw.
+ *   - Some older npm libraries patch Array.prototype or Function.prototype at
+ *     import time. If a daemon-core dep does this, the import will throw. The
+ *     daemon-core vitest suite is the canonical regression check for this.
+ *   - We deliberately do NOT freeze RegExp.prototype, Error.prototype, Map/Set
+ *     prototypes, or Date.prototype because at least one of those tends to be
+ *     mutated by mainstream test/runtime libs and the value of freezing them
+ *     is low (no useful prototype-pollution attack surface).
+ */
+
+let _hardened = false;
+
+/** Prototypes that get frozen at boot. */
+const HARDENED_PROTOS: Array<{ name: string; proto: object }> = [
+    { name: 'Object', proto: Object.prototype },
+    { name: 'Array', proto: Array.prototype },
+    { name: 'Function', proto: Function.prototype },
+    { name: 'String', proto: String.prototype },
+    { name: 'Number', proto: Number.prototype },
+    { name: 'Boolean', proto: Boolean.prototype },
+    { name: 'Promise', proto: Promise.prototype },
+];
+
+/**
+ * Freeze the canonical built-in prototypes so provider scripts (and anything
+ * else running in this process) cannot mutate them. Idempotent.
+ *
+ * Returns the list of prototype names that were newly frozen — primarily for
+ * tests / observability. Already-frozen prototypes are not re-reported.
+ */
+export function applyProcessHardening(): string[] {
+    if (_hardened) return [];
+    _hardened = true;
+
+    const newlyFrozen: string[] = [];
+    for (const entry of HARDENED_PROTOS) {
+        if (Object.isFrozen(entry.proto)) continue;
+        try {
+            Object.freeze(entry.proto);
+            newlyFrozen.push(entry.name);
+        } catch {
+            // Some host/runtime combinations refuse to freeze a built-in
+            // prototype (e.g. it has a non-configurable accessor). We treat
+            // this as best-effort — log nothing here (logger not guaranteed
+            // to be initialized this early) and move on. Subsequent reads
+            // of `Object.isFrozen(proto)` will reveal the gap.
+        }
+    }
+    return newlyFrozen;
+}
+
+/** For tests only — clears the internal "already hardened" flag. The
+ *  prototypes themselves cannot be un-frozen, so this is mostly useful for
+ *  testing the idempotency guard. */
+export function _resetProcessHardeningForTest(): void {
+    _hardened = false;
+}
+
+/** For tests only — peek at the hardened state. */
+export function _isProcessHardened(): boolean {
+    return _hardened;
+}