@adhdev/daemon-core 0.9.82-rc.32 → 0.9.82-rc.321

package/src/config/mesh-config.ts

@@ -8,7 +8,7 @@
 
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { randomUUID } from 'crypto';
+import { createHash, randomBytes, randomUUID } from 'crypto';
 import { getConfigDir } from './config.js';
 import type {
     LocalMeshConfig,
@@ -18,8 +18,11 @@ import type {
     RepoMeshNodePolicy,
     RepoMeshNodeCapabilities,
     RepoMeshCoordinatorConfig,
+    RepoMeshHostMetadata,
+    RepoMeshDaemonRole,
 } from '../repo-mesh-types.js';
-import { DEFAULT_MESH_POLICY } from '../repo-mesh-types.js';
+import { DEFAULT_MESH_POLICY, normalizeMeshSchedulingStrategy } from '../repo-mesh-types.js';
+import { createDefaultMeshHostMetadata } from '../mesh/mesh-host-ownership.js';
 
 // ─── Persistence ────────────────────────────────
 
@@ -39,6 +42,20 @@ function loadMeshConfig(): LocalMeshConfig {
     }
 }
 
+function normalizeCapabilityTags(value: unknown): string[] | undefined {
+    if (!Array.isArray(value)) return undefined;
+    const seen = new Set<string>();
+    const tags = value
+        .map(tag => typeof tag === 'string' ? tag.trim() : '')
+        .filter(Boolean)
+        .filter(tag => {
+            if (seen.has(tag)) return false;
+            seen.add(tag);
+            return true;
+        });
+    return tags.length ? tags : undefined;
+}
+
 function saveMeshConfig(config: LocalMeshConfig): void {
     const path = getMeshConfigPath();
     writeFileSync(path, JSON.stringify(config, null, 2), { encoding: 'utf-8', mode: 0o600 });
@@ -78,21 +95,60 @@ const SESSION_CLEANUP_MODES = new Set(['preserve', 'stop', 'delete_stopped', 'st
 const SPAWNED_SESSION_VISIBILITY_MODES = new Set(['visible', 'hidden']);
 
 function mergeMeshPolicy(base: RepoMeshPolicy | undefined, patch: Partial<RepoMeshPolicy> | undefined): RepoMeshPolicy {
-    const policy: RepoMeshPolicy = { ...DEFAULT_MESH_POLICY, ...(base || {}), ...(patch || {}) };
+    const autoFastForward = normalizeAutoFastForwardPolicy({
+        ...DEFAULT_MESH_POLICY.autoFastForward,
+        ...((base?.autoFastForward && typeof base.autoFastForward === 'object') ? base.autoFastForward : {}),
+        ...((patch?.autoFastForward && typeof patch.autoFastForward === 'object') ? patch.autoFastForward : {}),
+    });
+    const policy: RepoMeshPolicy = {
+        ...DEFAULT_MESH_POLICY,
+        ...(base || {}),
+        ...(patch || {}),
+        autoFastForward,
+    };
     if (!['block', 'warn', 'checkpoint_then_continue'].includes(policy.dirtyWorkspaceBehavior)) {
         policy.dirtyWorkspaceBehavior = 'warn';
     }
     const maxParallelTasks = Number(policy.maxParallelTasks);
     policy.maxParallelTasks = Number.isFinite(maxParallelTasks) ? Math.max(1, Math.min(8, Math.floor(maxParallelTasks))) : 2;
+    policy.allowAutoPublishSubmoduleMainCommits = policy.allowAutoPublishSubmoduleMainCommits === true;
     if (!SESSION_CLEANUP_MODES.has(String(policy.sessionCleanupOnNodeRemove))) {
         policy.sessionCleanupOnNodeRemove = 'preserve';
     }
     if (!SPAWNED_SESSION_VISIBILITY_MODES.has(String(policy.spawnedSessionVisibility))) {
         policy.spawnedSessionVisibility = 'visible';
     }
+    // Load-balancing: normalize the scheduling strategy so an invalid/blank value
+    // falls back to 'first_eligible' (strict no-change). Only persist the field when
+    // it is explicitly a non-default value to keep existing meshes.json untouched.
+    const normalizedStrategy = normalizeMeshSchedulingStrategy(policy.schedulingStrategy);
+    if (normalizedStrategy === 'first_eligible') {
+        delete policy.schedulingStrategy;
+    } else {
+        policy.schedulingStrategy = normalizedStrategy;
+    }
+    // Convergence routing: strict opt-in (default false). Only persist when explicitly
+    // enabled so existing meshes.json stays byte-for-byte untouched.
+    if (policy.autoConvergeCodeChange === true) {
+        policy.autoConvergeCodeChange = true;
+    } else {
+        delete policy.autoConvergeCodeChange;
+    }
     return policy;
 }
 
+function normalizeAutoFastForwardPolicy(value: unknown): NonNullable<RepoMeshPolicy['autoFastForward']> {
+    const record = value && typeof value === 'object' && !Array.isArray(value)
+        ? value as Record<string, unknown>
+        : {};
+    const maxBehind = Number(record.maxBehind);
+    return {
+        enabled: record.enabled !== false,
+        ...(Number.isFinite(maxBehind) && maxBehind >= 0 ? { maxBehind: Math.floor(maxBehind) } : {}),
+        requireCleanSubmodules: record.requireCleanSubmodules !== false,
+    };
+}
+
 export function listMeshes(): LocalMeshEntry[] {
     return loadMeshConfig().meshes;
 }
@@ -112,6 +168,7 @@ export interface CreateMeshOptions {
     defaultBranch?: string;
     policy?: Partial<RepoMeshPolicy>;
     coordinator?: RepoMeshCoordinatorConfig;
+    meshHost?: RepoMeshHostMetadata;
 }
 
 export function createMesh(opts: CreateMeshOptions): LocalMeshEntry {
@@ -133,6 +190,7 @@ export function createMesh(opts: CreateMeshOptions): LocalMeshEntry {
         defaultBranch: opts.defaultBranch,
         policy: mergeMeshPolicy(undefined, opts.policy),
         coordinator: opts.coordinator || {},
+        meshHost: opts.meshHost || createDefaultMeshHostMetadata(),
         nodes: [],
         createdAt: now,
         updatedAt: now,
@@ -148,6 +206,7 @@ export interface UpdateMeshOptions {
     defaultBranch?: string;
     policy?: Partial<RepoMeshPolicy>;
     coordinator?: RepoMeshCoordinatorConfig;
+    meshHost?: RepoMeshHostMetadata;
 }
 
 export function updateMesh(meshId: string, opts: UpdateMeshOptions): LocalMeshEntry | undefined {
@@ -159,6 +218,7 @@ export function updateMesh(meshId: string, opts: UpdateMeshOptions): LocalMeshEn
     if (opts.defaultBranch !== undefined) mesh.defaultBranch = opts.defaultBranch;
     if (opts.policy) mesh.policy = mergeMeshPolicy(mesh.policy, opts.policy);
     if (opts.coordinator) mesh.coordinator = opts.coordinator;
+    if (opts.meshHost) mesh.meshHost = opts.meshHost;
     mesh.updatedAt = new Date().toISOString();
 
     saveMeshConfig(config);
@@ -174,6 +234,240 @@ export function deleteMesh(meshId: string): boolean {
     return true;
 }
 
+function normalizeManualHostAddress(hostAddress: string): string {
+    const normalized = hostAddress.trim().replace(/\/+$/, '');
+    if (!normalized) throw new Error('hostAddress required');
+    let parsed: URL;
+    try {
+        parsed = new URL(normalized);
+    } catch {
+        throw new Error('hostAddress must be a valid http(s) or ws(s) URL');
+    }
+    if (!['http:', 'https:', 'ws:', 'wss:'].includes(parsed.protocol)) {
+        throw new Error('hostAddress must use http, https, ws, or wss');
+    }
+    return normalized;
+}
+
+export function tokenIdForManualPairing(token: string): string {
+    return `tok_${createHash('sha256').update(token).digest('hex').slice(0, 16)}`;
+}
+
+function normalizeTokenExpiry(value: unknown): string | undefined {
+    if (typeof value !== 'string' || !value.trim()) return undefined;
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) throw new Error('expiresAt must be a valid ISO date');
+    return date.toISOString();
+}
+
+function assertPairingTokenValid(pairing: RepoMeshHostMetadata['pairing'], rawToken: string, nowIso: string): { ok: true; tokenId: string } | { ok: false; reason: string; expectedTokenId?: string; presentedTokenId?: string } {
+    const token = rawToken.trim();
+    if (!token) return { ok: false, reason: 'token required' };
+    const presentedTokenId = tokenIdForManualPairing(token);
+    const expectedTokenId = pairing?.tokenId;
+    if (!expectedTokenId || pairing?.status === 'not_configured' || pairing?.status === 'revoked') {
+        return { ok: false, reason: 'host pairing token is not configured', presentedTokenId };
+    }
+    if (pairing.expiresAt && new Date(pairing.expiresAt).getTime() <= new Date(nowIso).getTime()) {
+        return { ok: false, reason: 'host pairing token expired', expectedTokenId, presentedTokenId };
+    }
+    if (presentedTokenId !== expectedTokenId) {
+        return { ok: false, reason: 'invalid pairing token', expectedTokenId, presentedTokenId };
+    }
+    return { ok: true, tokenId: presentedTokenId };
+}
+
+export interface ConfigureMeshHostPairingOptions {
+    hostAddress: string;
+    token: string;
+    now?: string;
+}
+
+export function configureMeshHostPairing(
+    meshId: string,
+    opts: ConfigureMeshHostPairingOptions,
+): { mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata; hostAddress: string } | undefined {
+    const hostAddress = normalizeManualHostAddress(opts.hostAddress);
+    const token = opts.token.trim();
+    if (!token) throw new Error('token required');
+
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+
+    const now = opts.now || new Date().toISOString();
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    const meshHost: RepoMeshHostMetadata = {
+        ...previous,
+        role: 'member',
+        hostAddress,
+        pairing: {
+            status: 'pairing',
+            tokenId: tokenIdForManualPairing(token),
+            lastPairedAt: now,
+        },
+    };
+
+    mesh.meshHost = meshHost;
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { mesh, meshHost, hostAddress };
+}
+
+export interface CreateMeshHostPairingTokenOptions {
+    token?: string;
+    expiresAt?: string;
+    now?: string;
+}
+
+export function createMeshHostPairingToken(
+    meshId: string,
+    opts: CreateMeshHostPairingTokenOptions = {},
+): { mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata; token: string; tokenId: string; expiresAt?: string } | undefined {
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+    const now = opts.now || new Date().toISOString();
+    const token = (opts.token || `mhj_${randomBytes(24).toString('base64url')}`).trim();
+    if (!token) throw new Error('token required');
+    const tokenId = tokenIdForManualPairing(token);
+    const expiresAt = normalizeTokenExpiry(opts.expiresAt);
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    if (previous.role === 'member') {
+        throw new Error('Mesh Host daemon required to create host pairing tokens; member daemons cannot mint host join tokens.');
+    }
+    const meshHost: RepoMeshHostMetadata = {
+        ...previous,
+        role: 'host',
+        pairing: {
+            status: 'pairing',
+            tokenId,
+            lastPairedAt: now,
+            ...(expiresAt ? { expiresAt } : {}),
+        },
+    };
+    mesh.meshHost = meshHost;
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { mesh, meshHost, token, tokenId, ...(expiresAt ? { expiresAt } : {}) };
+}
+
+export interface MeshHostJoinMemberNodeInput {
+    id?: string;
+    workspace: string;
+    repoRoot?: string;
+    daemonId?: string;
+    machineId?: string;
+    userOverrides?: Partial<RepoMeshNodeCapabilities>;
+    policy?: RepoMeshNodePolicy;
+    role?: RepoMeshDaemonRole;
+}
+
+export interface ApplyMeshHostJoinOptions {
+    token: string;
+    memberNode: MeshHostJoinMemberNodeInput;
+    memberMeshId?: string;
+    now?: string;
+}
+
+export function applyMeshHostJoinRequest(
+    meshId: string,
+    opts: ApplyMeshHostJoinOptions,
+): { accepted: true; mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata; node: LocalMeshNodeEntry; tokenId: string } | { accepted: false; mesh?: LocalMeshEntry; meshHost?: RepoMeshHostMetadata; tokenId?: string; reason: string } | undefined {
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+    const now = opts.now || new Date().toISOString();
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    if (previous.role === 'member') {
+        return { accepted: false, mesh, meshHost: previous, reason: 'Mesh Host daemon required to accept join requests' };
+    }
+    const meshHost: RepoMeshHostMetadata = { ...previous, role: 'host' };
+    const validation = assertPairingTokenValid(meshHost.pairing, opts.token, now);
+    if (!validation.ok) {
+        mesh.meshHost = {
+            ...meshHost,
+            pairing: {
+                ...(meshHost.pairing || { status: 'not_configured' as const }),
+                status: 'rejected',
+                lastRejectedAt: now,
+            },
+        };
+        mesh.updatedAt = now;
+        saveMeshConfig(config);
+        return { accepted: false, mesh, meshHost: mesh.meshHost, tokenId: validation.presentedTokenId, reason: validation.reason };
+    }
+
+    const workspace = opts.memberNode.workspace.trim();
+    if (!workspace) throw new Error('memberNode.workspace required');
+    const memberId = opts.memberNode.id?.trim();
+    let node = mesh.nodes.find(n => (memberId && n.id === memberId) || n.workspace === workspace);
+    if (node) {
+        node.workspace = workspace;
+        node.repoRoot = opts.memberNode.repoRoot;
+        node.daemonId = opts.memberNode.daemonId;
+        node.machineId = opts.memberNode.machineId;
+        node.userOverrides = opts.memberNode.userOverrides || node.userOverrides || {};
+        node.policy = { ...(node.policy || {}), ...(opts.memberNode.policy || {}) };
+        node.role = 'member';
+    } else {
+        if (mesh.nodes.length >= 10) throw new Error('Maximum 10 nodes per mesh');
+        node = {
+            id: memberId || `node_${randomUUID().replace(/-/g, '')}`,
+            workspace,
+            repoRoot: opts.memberNode.repoRoot,
+            daemonId: opts.memberNode.daemonId,
+            machineId: opts.memberNode.machineId,
+            userOverrides: opts.memberNode.userOverrides || {},
+            policy: opts.memberNode.policy || {},
+            role: 'member',
+        };
+        mesh.nodes.push(node);
+    }
+    mesh.meshHost = {
+        ...meshHost,
+        pairing: {
+            ...(meshHost.pairing || {}),
+            status: 'paired',
+            tokenId: validation.tokenId,
+            joinedAt: now,
+            lastPairedAt: meshHost.pairing?.lastPairedAt || now,
+            ...(meshHost.pairing?.expiresAt ? { expiresAt: meshHost.pairing.expiresAt } : {}),
+        },
+    };
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { accepted: true, mesh, meshHost: mesh.meshHost, node, tokenId: validation.tokenId };
+}
+
+export function markMeshHostPairingJoined(
+    meshId: string,
+    opts: { hostDaemonId?: string; hostNodeId?: string; joinedAt?: string; token?: string; tokenId?: string },
+): { mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata } | undefined {
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+    const now = opts.joinedAt || new Date().toISOString();
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    const tokenId = opts.tokenId || (opts.token ? tokenIdForManualPairing(opts.token) : previous.pairing?.tokenId);
+    mesh.meshHost = {
+        ...previous,
+        role: 'member',
+        ...(opts.hostDaemonId ? { hostDaemonId: opts.hostDaemonId } : {}),
+        ...(opts.hostNodeId ? { hostNodeId: opts.hostNodeId } : {}),
+        pairing: {
+            ...(previous.pairing || {}),
+            status: 'paired',
+            ...(tokenId ? { tokenId } : {}),
+            joinedAt: now,
+            lastPairedAt: previous.pairing?.lastPairedAt || now,
+        },
+    };
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { mesh, meshHost: mesh.meshHost };
+}
+
 // ─── Node Operations ────────────────────────────
 
 export interface AddNodeOptions {
@@ -181,11 +475,14 @@ export interface AddNodeOptions {
     repoRoot?: string;
     daemonId?: string;
     machineId?: string;
+    capabilities?: string[];
     userOverrides?: Partial<RepoMeshNodeCapabilities>;
     policy?: RepoMeshNodePolicy;
     isLocalWorktree?: boolean;
     worktreeBranch?: string;
     clonedFromNodeId?: string;
+    worktreeBootstrap?: LocalMeshNodeEntry['worktreeBootstrap'];
+    role?: RepoMeshDaemonRole;
 }
 
 export function addNode(meshId: string, opts: AddNodeOptions): LocalMeshNodeEntry | undefined {
@@ -208,11 +505,14 @@ export function addNode(meshId: string, opts: AddNodeOptions): LocalMeshNodeEntr
         repoRoot: opts.repoRoot,
         daemonId: opts.daemonId,
         machineId: opts.machineId,
+        capabilities: normalizeCapabilityTags(opts.capabilities),
         userOverrides: opts.userOverrides || {},
         policy: opts.policy || {},
         isLocalWorktree: opts.isLocalWorktree,
         worktreeBranch: opts.worktreeBranch,
         clonedFromNodeId: opts.clonedFromNodeId,
+        worktreeBootstrap: opts.worktreeBootstrap,
+        role: opts.role,
     };
 
     mesh.nodes.push(node);
@@ -238,7 +538,14 @@ export function removeNode(meshId: string, nodeId: string): boolean {
 export function updateNode(
     meshId: string,
     nodeId: string,
-    opts: { userOverrides?: Partial<RepoMeshNodeCapabilities>; policy?: RepoMeshNodePolicy },
+    opts: {
+        userOverrides?: Partial<RepoMeshNodeCapabilities>;
+        policy?: RepoMeshNodePolicy;
+        worktreeBootstrap?: LocalMeshNodeEntry['worktreeBootstrap'];
+        /** Per-node instruction surfaced in the coordinator prompt. Pass an
+         *  empty string or undefined to clear it. */
+        systemPrompt?: string;
+    },
 ): LocalMeshNodeEntry | undefined {
     const config = loadMeshConfig();
     const mesh = config.meshes.find(m => m.id === meshId);
@@ -249,6 +556,15 @@ export function updateNode(
 
     if (opts.userOverrides) node.userOverrides = { ...node.userOverrides, ...opts.userOverrides };
     if (opts.policy) node.policy = { ...node.policy, ...opts.policy };
+    if (opts.worktreeBootstrap) node.worktreeBootstrap = opts.worktreeBootstrap;
+    if (Object.prototype.hasOwnProperty.call(opts, 'systemPrompt')) {
+        // Honor explicit clears: { systemPrompt: undefined } drops the field.
+        if (opts.systemPrompt && opts.systemPrompt.trim()) {
+            node.systemPrompt = opts.systemPrompt;
+        } else {
+            delete node.systemPrompt;
+        }
+    }
     mesh.updatedAt = new Date().toISOString();
     saveMeshConfig(config);
     return node;

package/src/config/recent-activity.ts

@@ -92,12 +92,18 @@ export function buildSessionReadStateKey(sessionId: string, providerSessionId?:
 
 export function getSessionSeenAt(state: DaemonState, sessionId: string, providerSessionId?: string | null): number {
     const providerKey = buildSessionReadStateKey(sessionId, providerSessionId);
-    return state.sessionReads?.[providerKey] || state.sessionReads?.[sessionId] || 0;
+    return Math.max(state.sessionReads?.[providerKey] || 0, state.sessionReads?.[sessionId] || 0);
 }
 
 export function getSessionSeenMarker(state: DaemonState, sessionId: string, providerSessionId?: string | null): string {
     const providerKey = buildSessionReadStateKey(sessionId, providerSessionId);
-    return state.sessionReadMarkers?.[providerKey] || state.sessionReadMarkers?.[sessionId] || '';
+    const providerSeenAt = state.sessionReads?.[providerKey] || 0;
+    const sessionSeenAt = state.sessionReads?.[sessionId] || 0;
+    const providerMarker = state.sessionReadMarkers?.[providerKey] || '';
+    const sessionMarker = state.sessionReadMarkers?.[sessionId] || '';
+    if (sessionSeenAt > providerSeenAt && sessionMarker) return sessionMarker;
+    if (providerSeenAt > sessionSeenAt && providerMarker) return providerMarker;
+    return providerMarker || sessionMarker;
 }
 
 export function getSessionNotificationDismissal(state: DaemonState, sessionId: string, providerSessionId?: string | null): string {

package/src/daemon/dev-auto-implement.ts

@@ -9,6 +9,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { DEFAULT_SESSION_HOST_COLS, DEFAULT_SESSION_HOST_ROWS } from '@adhdev/session-host-core';
 import type * as http from 'http';
 import type { ChildProcess } from 'child_process';
 import type { DevServerContext, ProviderCategory } from './dev-server-types.js';
@@ -482,8 +483,8 @@ export async function handleAutoImplement(ctx: DevServerContext, type: string, r
       const isWin = os.platform() === 'win32';
       child = pty.spawn(isWin ? 'cmd.exe' : (process.env.SHELL || '/bin/zsh'), [isWin ? '/c' : '-c', shellCmd], {
         name: 'xterm-256color',
-        cols: 120,
-        rows: 40,
+        cols: DEFAULT_SESSION_HOST_COLS,
+        rows: DEFAULT_SESSION_HOST_ROWS,
         cwd: providerDir,
         env: { ...process.env, ...(spawn.env || {}) },
       });

package/src/daemon/dev-cli-debug.ts

@@ -802,7 +802,16 @@ export async function handleCliSend(ctx: DevServerContext, req: http.IncomingMes
   }
 
   try {
-    ctx.instanceManager!.sendEvent(target.instanceId, 'send_message', { text });
+    if (target.category === 'cli') {
+      const bundle = getCliTargetBundle(ctx, type, instanceId);
+      if (!bundle) {
+        ctx.json(res, 404, { error: `No running CLI adapter found for: ${type || instanceId}` });
+        return;
+      }
+      await bundle.adapter.sendMessage(text);
+    } else {
+      ctx.instanceManager!.sendEvent(target.instanceId, 'send_message', { text });
+    }
     ctx.json(res, 200, { sent: true, type: target.type, instanceId: target.instanceId });
   } catch (e: any) {
     ctx.json(res, 500, { error: `Send failed: ${e.message}` });

package/src/detection/cli-detector.ts

@@ -12,6 +12,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { existsSync } from 'fs';
 import type { ProviderLoader } from '../providers/provider-loader.js';
+import { findBinary } from '../cli-adapters/provider-cli-shared.js';
 
 export interface CLIInfo {
     id: string;
@@ -57,6 +58,29 @@ function resolveCommandPath(command: string): string | null {
     return null;
 }
 
+/**
+ * Resolve a CLI command to an absolute path for install detection.
+ * Order: explicit path → PATH (`where`/`which`) → well-known global-bin dirs
+ * (e.g. %APPDATA%\npm) via the shared spawn-layer findBinary.
+ *
+ * The final step keeps detection consistent with the spawn layer: findBinary
+ * already searches npm's default Windows prefix at %APPDATA%\npm (where
+ * `npm i -g @openai/codex` lands), so a CLI installed under an npm prefix that
+ * is NOT on the daemon's inherited PATH is detected as installed instead of
+ * being blocked at the launch gate. findBinary returns a bare "<name>.cmd"
+ * (non-absolute) when nothing is found, so we only accept an absolute path
+ * that actually exists.
+ */
+async function resolveDetectionPath(command: string, whichCmd: string): Promise<string | null> {
+    const explicitPath = resolveCommandPath(command);
+    if (explicitPath) return explicitPath;
+    const whichResult = await execAsync(`${whichCmd} ${shellQuote(command)}`);
+    if (whichResult) return whichResult.split('\n')[0];
+    const resolved = findBinary(command);
+    if (path.isAbsolute(resolved) && existsSync(resolved)) return resolved;
+    return null;
+}
+
 /** Run a shell command with timeout, returning stdout or null on failure */
 function execAsync(cmd: string, timeoutMs = 5000): Promise<string | null> {
     return new Promise((resolve) => {
@@ -97,11 +121,8 @@ export async function detectCLIs(
     const results = await Promise.all(
         cliList.map(async (cli): Promise<CLIInfo> => {
             try {
-                const explicitPath = resolveCommandPath(cli.command);
-                const pathResult = explicitPath || await execAsync(`${whichCmd} ${shellQuote(cli.command)}`);
-                if (!pathResult) return { ...cli, installed: false };
-
-                const firstPath = explicitPath || pathResult.split('\n')[0];
+                const firstPath = await resolveDetectionPath(cli.command, whichCmd);
+                if (!firstPath) return { ...cli, installed: false };
 
                 // Get version (parallel with other checks)
                 let version: string | undefined;
@@ -148,10 +169,8 @@ export async function detectCLI(
             const platform = os.platform();
             const whichCmd = platform === 'win32' ? 'where' : 'which';
             try {
-                const explicitPath = resolveCommandPath(target.command);
-                const pathResult = explicitPath || await execAsync(`${whichCmd} ${shellQuote(target.command)}`);
-                if (!pathResult) return null;
-                const firstPath = explicitPath || pathResult.split('\n')[0];
+                const firstPath = await resolveDetectionPath(target.command, whichCmd);
+                if (!firstPath) return null;
                 let version: string | undefined;
                 if (options?.includeVersion !== false) {
                     const versionCommands = [

package/src/detection/ide-detector.ts

@@ -7,11 +7,14 @@
  * Migrated from @adhdev/core — this is now the single source of truth.
  */
 
-import { execSync } from 'child_process';
-import { existsSync } from 'fs';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+const execAsync = promisify(exec);
+import { existsSync, statSync } from 'fs';
 import { platform, homedir } from 'os';
 import * as path from 'path';
 import type { ProviderLoader } from '../providers/provider-loader.js';
+import { isKnownWin32GuiExe, readWin32IdeVersionFromDisk } from './win32-ide-version.js';
 
 // ─── Types ──────────────────────────────────────
 
@@ -73,25 +76,54 @@ function findCliCommand(command: string): string | null {
         const resolved = path.isAbsolute(candidate) ? candidate : path.resolve(candidate);
         return existsSync(resolved) ? resolved : null;
     }
-    try {
-        const result = execSync(
-            platform() === 'win32' ? `where ${trimmed}` : `which ${trimmed}`,
-            { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }
-        ).trim();
-        return result.split('\n')[0] || null;
-    } catch {
-        return null;
+    const isWin = platform() === 'win32';
+    const paths = (process.env.PATH || '').split(isWin ? ';' : ':');
+    const exes = isWin ? ['.exe', '.cmd', '.bat', ''] : [''];
+    for (const p of paths) {
+        if (!p) continue;
+        for (const ext of exes) {
+            const fullPath = path.join(p, trimmed + ext);
+            try {
+                if (existsSync(fullPath)) {
+                    const stat = statSync(fullPath);
+                    if (stat.isFile() && (isWin || (stat.mode & 0o111))) {
+                        return fullPath;
+                    }
+                }
+            } catch { }
+        }
     }
+    return null;
 }
 
-function getIdeVersion(cliCommand: string): string | null {
+/**
+ * Resolve an IDE version on demand (NOT at boot).
+ *
+ * Order of preference, all spawn-free where possible:
+ *  1. win32: read the bundled product.json/package.json next to the exe.
+ *  2. Otherwise spawn `<cli> --version` — but ONLY when the binary is not a
+ *     known GUI executable (the #4 guard), so we never boot an IDE window.
+ *
+ * `win32ProcessNames` is provider.json `processNames.win32` (type → exe names),
+ * used to recognise GUI executables. Callers that have a ProviderLoader can
+ * pass `providerLoader.getWinProcessNames()`.
+ */
+export async function getIdeVersion(
+    cliCommand: string,
+    win32ProcessNames: Record<string, string[]> = {},
+): Promise<string | null> {
+    if (platform() === 'win32') {
+        const fromDisk = readWin32IdeVersionFromDisk(cliCommand);
+        if (fromDisk) return fromDisk;
+        // Refuse to spawn a known GUI exe — it would launch the IDE window.
+        if (isKnownWin32GuiExe(cliCommand, win32ProcessNames)) return null;
+    }
     try {
-        const result = execSync(`"${cliCommand}" --version`, {
+        const { stdout } = await execAsync(`"${cliCommand}" --version`, {
             encoding: 'utf-8',
             timeout: 10000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return result.split('\n')[0] || null;
+        });
+        return stdout.trim().split('\n')[0] || null;
     } catch {
         return null;
     }
@@ -152,7 +184,14 @@ export async function detectIDEs(providerLoader?: ProviderLoader): Promise<IDEIn
         const installed = os === 'darwin'
             ? !!(resolvedCli || appPath)
             : !!resolvedCli;
-        const version = resolvedCli ? getIdeVersion(resolvedCli) : null;
+        // Boot-time IDE detection must NOT spawn `<cli> --version`. On Windows
+        // the resolved "CLI" is frequently the GUI Electron exe (case-insensitive
+        // FS matches `...\cursor\cursor.exe` against `Cursor.exe`), and running it
+        // with `--version` boots the IDE window. `installed` is decided purely by
+        // existsSync above, and the dashboard drops `version` anyway — the only
+        // real version consumer is provider-loader.resolve() at CDP attach time,
+        // which fetches the version lazily. So leave it null here.
+        const version: string | null = null;
 
         results.push({
             id: def.id,