@adhdev/daemon-core 0.9.82-rc.323 → 0.9.82-rc.324

package/dist/commands/router.d.ts

@@ -87,6 +87,43 @@ type MeshRefineSubmoduleConflictHint = {
     nextSteps: string[];
 };
 export declare function runMeshRefinePatchEquivalenceGate(repoRoot: string, baseHead: string, branchHead: string): Promise<MeshRefinePatchEquivalenceSummary>;
+export type MeshWorktreePatchContainmentSummary = {
+    /** True only when merging worktreeHead into ref introduces no new patch. */
+    contained: boolean;
+    ref: string;
+    worktreeHead: string;
+    mergeBase?: string;
+    mergedTree?: string;
+    /** patch-id of (ref -> synthesized merge tree); empty string when nothing new is added. */
+    residualPatchId?: string;
+    durationMs: number;
+    /** Set when the check could not run (treated conservatively as NOT contained). */
+    error?: string;
+};
+/**
+ * Patch-equivalence containment check for the worktree force-cleanup convergence
+ * guard. Answers a narrower question than {@link runMeshRefinePatchEquivalenceGate}:
+ * "are the worktree branch's changes ALREADY present in `ref` (e.g. origin/main),
+ * even though the worktree HEAD's commit SHA is not an ancestor of ref?"
+ *
+ * This is the cherry-pick / squash / rebase case: the same content landed on the
+ * default ref under a different commit SHA, so `merge-base --is-ancestor` (the
+ * primary cleanup guard) reports the worktree as un-converged and refuses to
+ * remove it. Refinery already accepts patch-equivalent landings via merge-tree +
+ * patch-id; this brings the same notion of "convergence" to the cleanup guard.
+ *
+ * Mechanism: synthesize the merge of `worktreeHead` into `ref` (reusing the same
+ * trivial-gitlink-fast-forward handling as the refine gate) and compute the
+ * patch-id of (ref -> mergedTree). If that residual diff is EMPTY, merging the
+ * worktree adds nothing new on top of ref — its changes are already present there
+ * and the worktree is safe to remove. A non-empty residual means the worktree
+ * still carries content not in ref, so it is NOT contained and must stay blocked.
+ *
+ * Conservative by construction: any merge-tree / patch-id failure, a genuine
+ * (non-trivial) submodule conflict, or any thrown error yields `contained: false`
+ * so an exception can never widen the cleanup allow-list.
+ */
+export declare function checkWorktreeChangesPatchEquivalentInRef(repoRoot: string, ref: string, worktreeHead: string): Promise<MeshWorktreePatchContainmentSummary>;
 /**
  * No-op guard: detect a "silent no-op" merge before the Refinery merge runs.
  *

package/dist/index.js

@@ -313,10 +313,10 @@ function readInjected(value) {
 }
 function getDaemonBuildInfo() {
   if (cached) return cached;
-  const commit = readInjected(true ? "c19690a16292dbcb1ed5ff5458b94596fce46e38" : void 0) ?? "unknown";
-  const commitShort = readInjected(true ? "c19690a1" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
-  const version = readInjected(true ? "0.9.82-rc.323" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
-  const builtAt = readInjected(true ? "2026-06-19T06:24:49.522Z" : void 0);
+  const commit = readInjected(true ? "a0aeebdac30d9abea5b46e3f2618f864bbff19d0" : void 0) ?? "unknown";
+  const commitShort = readInjected(true ? "a0aeebda" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
+  const version = readInjected(true ? "0.9.82-rc.324" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
+  const builtAt = readInjected(true ? "2026-06-19T07:37:54.347Z" : void 0);
   cached = builtAt ? { commit, commitShort, version, builtAt } : { commit, commitShort, version };
   return cached;
 }
@@ -2947,26 +2947,113 @@ __export(mesh_work_queue_exports, {
   updateTaskStatus: () => updateTaskStatus,
   validateMeshTaskModeRequest: () => validateMeshTaskModeRequest
 });
+function hasNegationBefore(text, matchIndex) {
+  const before = text.slice(0, matchIndex);
+  const clauseStart = Math.max(
+    before.lastIndexOf("\n"),
+    before.lastIndexOf(". "),
+    before.lastIndexOf("! "),
+    before.lastIndexOf("? "),
+    before.lastIndexOf(";")
+  );
+  const clause = before.slice(clauseStart + 1);
+  const lower = clause.toLowerCase();
+  const tokens = clause.split(/\s+/).filter(Boolean);
+  const windowTokens = tokens.slice(Math.max(0, tokens.length - NEGATION_WINDOW_TOKENS));
+  const windowText = windowTokens.join(" ").toLowerCase();
+  for (const cue of NEGATION_CUES) {
+    const c = cue.toLowerCase();
+    if (/[^\x00-\x7f]/.test(c)) {
+      if (lower.includes(c)) return true;
+    } else if (windowText.includes(c)) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasTrailingNegation(text, matchEnd) {
+  const after = text.slice(matchEnd);
+  const clauseEnd = (() => {
+    const stops = [after.indexOf("\n"), after.indexOf(". "), after.indexOf("; ")].filter((i) => i >= 0);
+    return stops.length ? Math.min(...stops) : after.length;
+  })();
+  const clause = after.slice(0, clauseEnd).toLowerCase();
+  for (const cue of NEGATION_CUES) {
+    const c = cue.toLowerCase();
+    if (/[^\x00-\x7f]/.test(c) && clause.includes(c)) return true;
+  }
+  return false;
+}
+function isMutationKeywordInCommandContext(text, matchStart, matchEnd) {
+  if (isInsideBackticksOrFence(text, matchStart, matchEnd)) return true;
+  const lineStart = text.lastIndexOf("\n", matchStart - 1) + 1;
+  const linePrefix = text.slice(lineStart, matchStart);
+  if (/^\s*[$>]\s/.test(text.slice(lineStart))) return true;
+  if (/^\s*$/.test(linePrefix)) return true;
+  if (/(?:&&|\|\||\||;)\s*$/.test(linePrefix)) return true;
+  if (/(?:^|[\s,])(?:then|run|first)\s+$/i.test(linePrefix)) return true;
+  if (/,\s*$/.test(linePrefix)) return true;
+  return false;
+}
+function isInsideBackticksOrFence(text, matchStart, matchEnd) {
+  const fenceRe = /```/g;
+  let fenceCount = 0;
+  let m;
+  while ((m = fenceRe.exec(text)) !== null) {
+    if (m.index >= matchStart) break;
+    fenceCount++;
+  }
+  if (fenceCount % 2 === 1) return true;
+  let inlineCount = 0;
+  for (let i = 0; i < matchStart; i++) {
+    if (text[i] === "`") {
+      if (text[i + 1] === "`" && text[i + 2] === "`") {
+        i += 2;
+        continue;
+      }
+      inlineCount++;
+    }
+  }
+  return inlineCount % 2 === 1;
+}
+function isRealMutationMatch(text, matchStart, matchEnd) {
+  if (hasNegationBefore(text, matchStart)) return false;
+  if (hasTrailingNegation(text, matchEnd)) return false;
+  return isMutationKeywordInCommandContext(text, matchStart, matchEnd);
+}
+function patternHasRealMutation(pattern, text) {
+  const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g");
+  let match;
+  while ((match = re.exec(text)) !== null) {
+    if (isRealMutationMatch(text, match.index, match.index + match[0].length)) return true;
+    if (match.index === re.lastIndex) re.lastIndex++;
+  }
+  return false;
+}
 function detectGitMutation(message) {
   const re = /\bgit\s+([a-z][a-z0-9-]*)/gi;
   let match;
   while ((match = re.exec(message)) !== null) {
     const sub = match[1].toLowerCase();
-    if (GIT_MUTATION_SUBCOMMANDS.has(sub)) return true;
+    const isReal = () => isRealMutationMatch(message, match.index, match.index + match[0].length);
+    if (GIT_MUTATION_SUBCOMMANDS.has(sub)) {
+      if (isReal()) return true;
+      continue;
+    }
     if (sub === "stash") {
       const after = message.slice(re.lastIndex).match(/^\s+([a-z][a-z0-9-]*)/i);
       const next = after ? after[1].toLowerCase() : "";
-      if (!GIT_STASH_READONLY_SUBCOMMANDS.has(next)) return true;
+      if (!GIT_STASH_READONLY_SUBCOMMANDS.has(next) && isReal()) return true;
     } else if (sub === "checkout") {
-      return true;
+      if (isReal()) return true;
     } else if (sub === "submodule") {
       const after = message.slice(re.lastIndex).match(/^\s+([a-z][a-z0-9-]*)/i);
       const next = after ? after[1].toLowerCase() : "";
-      if (next === "update" || next === "add" || next === "sync" || next === "deinit") return true;
+      if ((next === "update" || next === "add" || next === "sync" || next === "deinit") && isReal()) return true;
     } else if (sub === "worktree") {
       const after = message.slice(re.lastIndex).match(/^\s+([a-z][a-z0-9-]*)/i);
       const next = after ? after[1].toLowerCase() : "";
-      if (next === "add" || next === "remove" || next === "move" || next === "prune") return true;
+      if ((next === "add" || next === "remove" || next === "move" || next === "prune") && isReal()) return true;
     }
   }
   return false;
@@ -2985,7 +3072,7 @@ function validateMeshTaskModeRequest(mode, message) {
     return { valid: true, taskMode, violations: [] };
   }
   const text = message || "";
-  const violations = LIVE_DEBUG_READONLY_FORBIDDEN.filter((rule) => rule.pattern.test(text)).map((rule) => rule.label);
+  const violations = LIVE_DEBUG_READONLY_FORBIDDEN.filter((rule) => patternHasRealMutation(rule.pattern, text)).map((rule) => rule.label);
   if (detectGitMutation(text)) {
     violations.push("git_mutation");
   }
@@ -3015,13 +3102,21 @@ function firstProviderPriority(policy) {
   if (!Array.isArray(raw)) return void 0;
   return raw.find((type) => typeof type === "string" && type.trim())?.trim();
 }
+function readNodeOverride(node, key) {
+  const overrides = node?.userOverrides;
+  if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) return null;
+  const value = overrides[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
 function buildMeshNodeCapabilityTags(node, providerType) {
   const provider = typeof providerType === "string" && providerType.trim() ? providerType.trim() : firstProviderPriority(node?.policy);
   const worktreeBranch = typeof node?.worktreeBranch === "string" && node.worktreeBranch.trim() ? node.worktreeBranch.trim() : null;
+  const os30 = readNodeOverride(node, "platform") ?? process.platform;
+  const arch2 = readNodeOverride(node, "arch") ?? process.arch;
   return normalizeMeshCapabilityTags([
     ...Array.isArray(node?.capabilities) ? node.capabilities : [],
-    `os=${process.platform}`,
-    `arch=${process.arch}`,
+    `os=${os30}`,
+    `arch=${arch2}`,
     ...provider ? [`provider=${provider}`] : [],
     // Worktree nodes automatically expose a "worktree=<branch>" tag so that
     // mesh_enqueue_task with required_tags: ["worktree=<branch>"] routes
@@ -3378,7 +3473,7 @@ function recordMeshToolCall(opts) {
     return { rateLimitExceeded: false, callsInWindow: 0, advisory: null };
   }
 }
-var import_crypto5, ACTIVE_MESH_QUEUE_STATUSES, HISTORICAL_MESH_QUEUE_STATUSES, MESH_TASK_MODES, LIVE_DEBUG_READONLY_FORBIDDEN, GIT_MUTATION_SUBCOMMANDS, GIT_STASH_READONLY_SUBCOMMANDS, DEPENDENCY_FAILURE_TERMINALS;
+var import_crypto5, ACTIVE_MESH_QUEUE_STATUSES, HISTORICAL_MESH_QUEUE_STATUSES, MESH_TASK_MODES, LIVE_DEBUG_READONLY_FORBIDDEN, NEGATION_CUES, NEGATION_WINDOW_TOKENS, GIT_MUTATION_SUBCOMMANDS, GIT_STASH_READONLY_SUBCOMMANDS, DEPENDENCY_FAILURE_TERMINALS;
 var init_mesh_work_queue = __esm({
   "src/mesh/mesh-work-queue.ts"() {
     "use strict";
@@ -3398,6 +3493,23 @@ var init_mesh_work_queue = __esm({
       { label: "package_install", pattern: /\b(npm\s+(?:install|i|add|link|uninstall|remove)|yarn\s+(?:add|remove|link)|pnpm\s+(?:add|remove|link)|pip\s+install|brew\s+install|apt\s+install|cargo\s+install)\b/i },
       { label: "container_mutation", pattern: /\b(docker\s+(?:build|run|exec|push|tag|rmi|rm|create|start|stop|kill)|kubectl\s+(?:apply|delete|patch|replace|create|scale))\b/i }
     ];
+    NEGATION_CUES = [
+      "don't",
+      "do not",
+      "never",
+      "avoid",
+      "without",
+      "no longer",
+      "not",
+      "forbidden",
+      "\uD558\uC9C0 \uB9C8",
+      "\uD558\uC9C0 \uB9C8\uC138\uC694",
+      "\uB9D0 \uAC83",
+      "\uAE08\uC9C0",
+      "\uC5C6\uC74C",
+      "\uC54A"
+    ];
+    NEGATION_WINDOW_TOKENS = 6;
     GIT_MUTATION_SUBCOMMANDS = /* @__PURE__ */ new Set([
       "add",
       "commit",
@@ -43869,6 +43981,70 @@ ${e?.stderr || ""}`
     };
   }
 }
+async function checkWorktreeChangesPatchEquivalentInRef(repoRoot, ref, worktreeHead) {
+  const startedAt = Date.now();
+  try {
+    const { execFileSync: execFileSync7 } = await import("child_process");
+    const git = (gitArgs) => execFileSync7("git", gitArgs, {
+      cwd: repoRoot,
+      encoding: "utf8",
+      maxBuffer: REFINE_PATCH_EQUIVALENCE_OUTPUT_LIMIT_BYTES
+    });
+    const mergeBase = git(["merge-base", ref, worktreeHead]).trim();
+    let mergedTree = "";
+    try {
+      mergedTree = git(["merge-tree", "--write-tree", ref, worktreeHead]).trim().split(/\s+/)[0] || "";
+    } catch (mergeTreeErr) {
+      const output = `${mergeTreeErr?.message || ""}
+${mergeTreeErr?.stdout || ""}
+${mergeTreeErr?.stderr || ""}`;
+      const isSubmoduleConflict = /(submodule|160000)/i.test(output) || /Recursive merging with submodules/i.test(output);
+      if (!isSubmoduleConflict) throw mergeTreeErr;
+      const evaluation = evaluateGitlinkTrivialFastForward(repoRoot, ref, worktreeHead);
+      if (!evaluation.trivial) {
+        return {
+          contained: false,
+          ref,
+          worktreeHead,
+          mergeBase: mergeBase || void 0,
+          durationMs: Date.now() - startedAt,
+          error: `merge-tree submodule conflict is not a trivial fast-forward: ${evaluation.reason || "unknown"}`
+        };
+      }
+      mergedTree = synthesizeTrivialFastForwardMergeTree(repoRoot, ref, worktreeHead, evaluation.gitlinks) || "";
+    }
+    if (!mergedTree) {
+      return {
+        contained: false,
+        ref,
+        worktreeHead,
+        mergeBase: mergeBase || void 0,
+        durationMs: Date.now() - startedAt,
+        error: "could not resolve synthetic merge tree for containment check"
+      };
+    }
+    const ffGitlinkExcludePaths = collectFastForwardGitlinkPaths(repoRoot, ref, worktreeHead);
+    const residualPatchId = await computeGitPatchId(repoRoot, ref, mergedTree, ffGitlinkExcludePaths);
+    const contained = residualPatchId === "";
+    return {
+      contained,
+      ref,
+      worktreeHead,
+      mergeBase: mergeBase || void 0,
+      mergedTree,
+      residualPatchId,
+      durationMs: Date.now() - startedAt
+    };
+  } catch (e) {
+    return {
+      contained: false,
+      ref,
+      worktreeHead,
+      durationMs: Date.now() - startedAt,
+      error: e?.message || String(e)
+    };
+  }
+}
 async function runMeshRefineEffectiveDiffGate(repoRoot, baseHead, branchHead) {
   const startedAt = Date.now();
   try {
@@ -44840,13 +45016,19 @@ function buildMemberJoinNode(mesh, args, fallbackDaemonId) {
   const workspace = typeof source?.workspace === "string" && source.workspace.trim() ? source.workspace.trim() : typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
   if (!workspace) return null;
   const nodeId = typeof source?.id === "string" && source.id.trim() ? source.id.trim() : typeof source?.nodeId === "string" && source.nodeId.trim() ? source.nodeId.trim() : void 0;
+  const baseOverrides = source?.userOverrides && typeof source.userOverrides === "object" && !Array.isArray(source.userOverrides) ? source.userOverrides : {};
+  const userOverrides = {
+    ...baseOverrides,
+    ...typeof baseOverrides.platform === "string" && baseOverrides.platform.trim() ? {} : { platform: process.platform },
+    ...typeof baseOverrides.arch === "string" && baseOverrides.arch.trim() ? {} : { arch: process.arch }
+  };
   return {
     ...nodeId ? { id: nodeId } : {},
     workspace,
     ...typeof source?.repoRoot === "string" && source.repoRoot.trim() ? { repoRoot: source.repoRoot.trim() } : {},
     ...typeof source?.daemonId === "string" && source.daemonId.trim() ? { daemonId: source.daemonId.trim() } : fallbackDaemonId ? { daemonId: fallbackDaemonId } : {},
     ...typeof source?.machineId === "string" && source.machineId.trim() ? { machineId: source.machineId.trim() } : {},
-    userOverrides: source?.userOverrides && typeof source.userOverrides === "object" && !Array.isArray(source.userOverrides) ? source.userOverrides : {},
+    userOverrides,
     policy: source?.policy && typeof source.policy === "object" && !Array.isArray(source.policy) ? source.policy : {},
     role: "member"
   };
@@ -45356,6 +45538,7 @@ var DaemonCommandRouter = class {
     candidateRefs.push("origin/main", "origin/master", "main", "master");
     const seen = /* @__PURE__ */ new Set();
     const checkedRefs = [];
+    const resolvedRefCommits = [];
     for (const ref of candidateRefs) {
       if (!ref || seen.has(ref)) continue;
       seen.add(ref);
@@ -45366,12 +45549,24 @@ var DaemonCommandRouter = class {
         continue;
       }
       checkedRefs.push(ref);
+      resolvedRefCommits.push({ ref, commit });
       try {
         await runGit3(["merge-base", "--is-ancestor", head, commit], args.repoRoot);
         return { allow: true, status: "merged_to_default_ref", source: "git_merge_base", ref };
       } catch {
       }
     }
+    for (const { ref, commit } of resolvedRefCommits) {
+      let containment;
+      try {
+        containment = await checkWorktreeChangesPatchEquivalentInRef(args.repoRoot, commit, head);
+      } catch {
+        continue;
+      }
+      if (containment.contained) {
+        return { allow: true, status: "patch_equivalent_to_default_ref", source: "git_patch_equivalence", ref };
+      }
+    }
     return {
       allow: false,
       status: metadataStatus || void 0,