@adhdev/daemon-core 0.9.82-rc.18 → 0.9.82-rc.181

package/dist/shared-types.d.ts

@@ -14,6 +14,7 @@ import type { ActiveChatData as _ActiveChatData, ProviderErrorReason as _Provide
 import type { WorkspaceEntry } from './config/workspaces.js';
 import type { ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
 import type { GitCompactSummary, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams } from './git/git-types.js';
+import type { InteractivePrompt } from './providers/types/interactive-prompt.js';
 export type { GitCommandName, GitCompactSummary, GitDiffSummary, GitFailureReason, GitFileChange, GitFileChangeStatus, GitRepoIdentity, GitRepoStatus, GitSnapshot, GitSnapshotCompareSummary, GitSnapshotReason, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams, } from './git/git-types.js';
 export interface SessionActiveChatData extends Omit<_ActiveChatData, 'messages'> {
     messages?: _ActiveChatData['messages'];
@@ -49,6 +50,14 @@ export interface ReadChatSyncResult {
         message: string;
         buttons: string[];
     } | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
+    /**
+     * Chat source provenance from ChatSourceMachine (A2). Carries the
+     * selected source, transition cause, lock state, and legacy
+     * fallbackReason — opaque to the daemon-core, consumed by web-core
+     * for the source debug badge and SourceTimeline (A3).
+     */
+    messageSource?: Record<string, unknown>;
 }
 export interface ProviderSummaryItem {
     id: string;
@@ -268,6 +277,7 @@ export interface SessionEntry {
     runtimeRecoveryState?: string | null;
     resume?: ProviderResumeCapability;
     activeChat: SessionActiveChatData | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
     capabilities?: SessionCapability[];
     /** Effective message input/media support for this session. Defaults fail-closed to text-only. */
     messageInput?: MessageInputSupport;
@@ -292,6 +302,11 @@ export interface SessionEntry {
     seenCompletionMarker?: string;
     surfaceHidden?: boolean;
     settings?: Record<string, any>;
+    /** Set when this session is acting as a mesh coordinator for the given mesh. */
+    coordinator?: {
+        meshId: string;
+        role: 'coordinator';
+    };
     meshQueueStats?: {
         total?: number;
         active?: number;
@@ -410,7 +425,33 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
-}
+    /**
+     * Provider trust classification — derived from the on-disk layer the
+     * manifest came from and the shape of the manifest. Dashboards use
+     * this to render a trust badge and gate activation of
+     * `external-untrusted` providers behind a confirm modal.
+     */
+    trust?: ProviderTrust;
+    /** Daemon-side human-readable description of the trust value. */
+    trustDescription?: string;
+    /** True when activation needs a user-side confirmation step. */
+    requiresConfirmation?: boolean;
+    /** Which on-disk layer the manifest lives in. */
+    sourceLayer?: 'user' | 'upstream' | 'external';
+    /** For external providers, the source-name namespace it came from. */
+    sourceName?: string | null;
+    /** Manifest-declared version, e.g. "1.2.1". */
+    providerVersion?: string;
+    /** Underlying executable name (CLI/binary providers). */
+    binary?: string;
+    /** Lifecycle label from the manifest: "Stable", "Beta", … */
+    status?: string;
+    /** One-line provider description from the manifest. */
+    details?: string;
+    /** Manifest-declared links: homepage, docs, repo, … */
+    links?: Record<string, string>;
+}
+export type ProviderTrust = 'user-custom' | 'trusted' | 'trusted-with-scripts' | 'external-safe' | 'external-untrusted';
 export interface MachineProviderCheckResult {
     ok: boolean;
     stage?: 'detection' | 'runnable' | 'verification';

package/dist/status/reporter.d.ts

@@ -46,6 +46,8 @@ export declare class DaemonStatusReporter {
     private lastStatusSentAt;
     private statusPendingThrottle;
     private lastP2PStatusHash;
+    private lastP2PStatusSentAt;
+    private p2pDebounceTimer;
     private lastServerStatusHash;
     private lastStatusSummary;
     private statusTimer;

package/dist/status/snapshot.d.ts

@@ -75,6 +75,7 @@ export declare function getSessionCompletionMarker(session: {
             receivedAt?: number | string;
             timestamp?: number | string;
             _turnKey?: string;
+            kind?: string;
         }> | null;
     } | null;
 }): string;

package/dist/types.d.ts

@@ -36,6 +36,11 @@ export interface ChatMessage {
     index?: number;
     timestamp?: number;
     receivedAt?: number;
+    /** (A2.3) Monotonic sequence number per (session, source). Producer-asserted
+     *  when emitted by v2-aware providers (transcript v2 schema); otherwise
+     *  derived by the daemon from receivedAt/timestamp/index. ChatSourceMachine
+     *  uses this as the native peak watermark for regression detection. */
+    sequence?: number;
     _turnKey?: string;
     /** Tool calls associated with this message */
     toolCalls?: ToolCallInfo[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.18",
+  "version": "0.9.82-rc.181",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,7 +27,7 @@
   "scripts": {
     "build": "tsup && npm run build:types",
     "build:types": "tsc -p tsconfig.json --emitDeclarationOnly --declaration --declarationMap false",
-    "dev": "tsup --watch",
+    "dev": "tsup --watch --no-clean",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json"
@@ -48,7 +48,11 @@
   "dependencies": {
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
+    "@xterm/headless": "^6.0.0",
     "@xterm/xterm": "^6.0.0",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "better-sqlite3": "^12.10.0",
     "chalk": "^5.3.0",
     "chokidar": "^4.0.3",
     "conf": "^13.0.0",
@@ -60,6 +64,7 @@
     "@adhdev/ghostty-vt-node": "*"
   },
   "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/ws": "^8.18.1",

package/src/agent-stream/poller.ts

@@ -19,7 +19,7 @@ import type { SessionRegistry } from '../sessions/registry.js';
 import { reconcileIdeRuntimeSessions } from '../sessions/reconcile.js';
 import { LOG } from '../logging/logger.js';
 import type { AgentStreamState } from './types.js';
-import { formatAutoApprovalMessage, pickApprovalButton } from '../providers/approval-utils.js';
+import { formatAutoApprovalMessage, pickAutoApprovalButton } from '../providers/approval-utils.js';
 import type { ProviderModule } from '../providers/contracts.js';
 import { buildRuntimeSystemChatMessage } from '../providers/chat-message-normalization.js';
 
@@ -210,8 +210,7 @@ export class AgentStreamPoller {
                 if (stream?.status === 'waiting_approval') {
                     const autoApprove = providerLoader.getSettings(stream.agentType).autoApprove !== false;
                     if (autoApprove && resolvedActiveSessionId) {
-                        const provider = providerLoader.getMeta(stream.agentType);
-                        const { label: buttonLabel } = pickApprovalButton(stream.activeModal?.buttons, provider);
+                        const { label: buttonLabel } = pickAutoApprovalButton(stream.activeModal?.buttons);
                         const approved = await agentStreamManager.resolveSessionAction(cdp, resolvedActiveSessionId, 'approve', buttonLabel);
                         if (approved) {
                             const effectId = [

package/src/boot/daemon-lifecycle.ts

@@ -37,6 +37,9 @@ import type { PtyTransportFactory } from '../cli-adapters/pty-transport.js';
 import type { IdeProviderInstance } from '../providers/ide-provider-instance.js';
 import { createDefaultGitCommandServices } from '../git/git-commands.js';
 import { setupMeshEventForwarding } from '../mesh/mesh-events.js';
+import { loadMeshCoordinatorRegistry } from '../mesh/coordinator-registry.js';
+import { applyProcessHardening } from './process-hardening.js';
+import { installProviderProcessShim } from '../providers/sdk/v1/sandbox/require-whitelist.js';
 
 // ─── Init Config ───
 
@@ -129,8 +132,16 @@ export interface DaemonDevSupportOptions {
  *   8. Start instance ticking
  */
 export async function initDaemonComponents(config: DaemonInitConfig): Promise<DaemonComponents> {
+    // 0. Process-level hardening (must run before any provider script is loaded).
+    //    Freezes built-in prototypes (Object/Array/Function/String/Number/Boolean/Promise)
+    //    and shadows process.exit/kill/abort/binding/dlopen so provider-script callers
+    //    throw instead of killing the daemon. See ./process-hardening.ts for details.
+    applyProcessHardening();
+    installProviderProcessShim();
+
     // 1. Global log interceptor
     installGlobalInterceptor();
+    loadMeshCoordinatorRegistry();
 
     // 2. ProviderLoader (provider source mode from config.json)
     const appConfig = loadConfig();
@@ -142,16 +153,11 @@ export async function initDaemonComponents(config: DaemonInitConfig): Promise<Da
         userDir: appConfig.providerDir,
     });
 
-    // If no upstream providers exist, fetch them first (blocking — critical for new users)
-    if (!disableUpstream && !providerLoader.hasUpstream()) {
-        LOG.info('Provider', 'No upstream providers found — downloading from GitHub...');
-        try {
-            await providerLoader.fetchLatest();
-        } catch (e: any) {
-            LOG.warn('Provider', `⚠ Failed to fetch providers: ${e?.message}`);
-        }
-    }
-
+    // Boot-time auto-sync is intentionally disabled. The user picks which
+    // providers to install via the dashboard onboarding / Providers tab; the
+    // daemon ships empty and only contains what the user explicitly installs.
+    // Manual sync is still available via the install / check_provider_updates
+    // commands (and the REST endpoint at /api/v1/providers/updates).
     providerLoader.loadAll();
     providerLoader.registerToDetector();
 
@@ -309,6 +315,7 @@ export async function initDaemonComponents(config: DaemonInitConfig): Promise<Da
         statusInstanceId: config.statusInstanceId,
         statusVersion: config.statusVersion,
         getMeshPeerConnectionStatus: config.getMeshPeerConnectionStatus,
+        dispatchMeshCommand: config.dispatchMeshCommand,
         getCdpLogFn: config.getCdpLogFn || ((ideType: string) => LOG.forComponent(`CDP:${ideType}`).asLogFn()),
     });
 

package/src/boot/process-hardening.ts

@@ -0,0 +1,89 @@
+/**
+ * Process-level hardening — boot-time mitigations against provider scripts.
+ *
+ * Provider scripts run in-process (see providers/sdk/v1/sandbox/README-design.ts).
+ * The require() whitelist (sandbox/require-whitelist.ts) blocks the obvious
+ * attack surfaces (no `child_process.exec`, no `fs.writeFile`, no `net`, etc.)
+ * but a malicious or buggy script can still:
+ *
+ *   1. Pollute Object.prototype to influence the daemon's downstream consumers
+ *      (e.g. `Object.prototype.toString = () => '...'` makes every untagged
+ *      object stringify to that value across the whole process).
+ *   2. Mutate Array/Function/String prototypes for similar effect.
+ *   3. Call `process.exit()` / `process.kill()` to kill the daemon.
+ *
+ * Sandbox isolation (isolated-vm) is the proper fix but has a real perf cost
+ * and a real marshalling-complexity cost. As a cheaper layer we just freeze
+ * the built-in prototypes at boot, which is irreversible and catches every
+ * prototype-pollution variant for the lifetime of the process.
+ *
+ * `applyProcessHardening()` is idempotent — calling it twice is a no-op the
+ * second time. The function intentionally swallows any "cannot redefine
+ * property" errors that would arise if some upstream code already froze
+ * the same prototype: the post-condition (prototype is frozen) is satisfied
+ * either way.
+ *
+ * Trade-offs:
+ *   - Read-only access to prototype methods (`Object.prototype.hasOwnProperty.call`,
+ *     `Array.prototype.slice.call`, etc.) is unaffected — only writes throw.
+ *   - Some older npm libraries patch Array.prototype or Function.prototype at
+ *     import time. If a daemon-core dep does this, the import will throw. The
+ *     daemon-core vitest suite is the canonical regression check for this.
+ *   - We deliberately do NOT freeze RegExp.prototype, Error.prototype, Map/Set
+ *     prototypes, or Date.prototype because at least one of those tends to be
+ *     mutated by mainstream test/runtime libs and the value of freezing them
+ *     is low (no useful prototype-pollution attack surface).
+ */
+
+let _hardened = false;
+
+/** Prototypes that get frozen at boot. */
+const HARDENED_PROTOS: Array<{ name: string; proto: object }> = [
+    { name: 'Object', proto: Object.prototype },
+    { name: 'Array', proto: Array.prototype },
+    { name: 'Function', proto: Function.prototype },
+    { name: 'String', proto: String.prototype },
+    { name: 'Number', proto: Number.prototype },
+    { name: 'Boolean', proto: Boolean.prototype },
+    { name: 'Promise', proto: Promise.prototype },
+];
+
+/**
+ * Freeze the canonical built-in prototypes so provider scripts (and anything
+ * else running in this process) cannot mutate them. Idempotent.
+ *
+ * Returns the list of prototype names that were newly frozen — primarily for
+ * tests / observability. Already-frozen prototypes are not re-reported.
+ */
+export function applyProcessHardening(): string[] {
+    if (_hardened) return [];
+    _hardened = true;
+
+    const newlyFrozen: string[] = [];
+    for (const entry of HARDENED_PROTOS) {
+        if (Object.isFrozen(entry.proto)) continue;
+        try {
+            Object.freeze(entry.proto);
+            newlyFrozen.push(entry.name);
+        } catch {
+            // Some host/runtime combinations refuse to freeze a built-in
+            // prototype (e.g. it has a non-configurable accessor). We treat
+            // this as best-effort — log nothing here (logger not guaranteed
+            // to be initialized this early) and move on. Subsequent reads
+            // of `Object.isFrozen(proto)` will reveal the gap.
+        }
+    }
+    return newlyFrozen;
+}
+
+/** For tests only — clears the internal "already hardened" flag. The
+ *  prototypes themselves cannot be un-frozen, so this is mostly useful for
+ *  testing the idempotency guard. */
+export function _resetProcessHardeningForTest(): void {
+    _hardened = false;
+}
+
+/** For tests only — peek at the hardened state. */
+export function _isProcessHardened(): boolean {
+    return _hardened;
+}