@adhdev/daemon-core 0.9.82-rc.352 → 0.9.82-rc.354

package/dist/providers/acp-provider-instance.d.ts

@@ -88,6 +88,9 @@ export declare class AcpProviderInstance implements ProviderInstance {
     sendPrompt(text: string, contentBlocks?: ContentBlock[]): Promise<void>;
     private cancelSession;
     private permissionResolvers;
+    private readonly manualAttendance;
+    /** @see ProviderInstance.noteManualInteraction */
+    noteManualInteraction(now?: number): void;
     resolvePermission(approved: boolean): Promise<void>;
     private handleSessionUpdate;
     /** Handle legacy session/update formats (pre-standardization compat) */

package/dist/providers/cli-provider-instance.d.ts

@@ -79,6 +79,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private pendingAutoApprovalSince;
     private autoApproveSettleTimer;
     private autoApproveInactiveSince;
+    private readonly manualAttendance;
     private controlValues;
     private summaryMetadata;
     private appliedEffectKeys;
@@ -204,6 +205,17 @@ export declare class CliProviderInstance implements ProviderInstance {
     get cliType(): string;
     get cliName(): string;
     private shouldAutoApprove;
+    /** @see ProviderInstance.noteManualInteraction */
+    noteManualInteraction(now?: number): void;
+    /**
+     * Whether auto-approve should be treated as active *right now* for display
+     * and firing decisions: the configured intent AND the user is not currently
+     * attending this session by hand. When a human is attending, auto-approve is
+     * held so the modal stays visible and they can drive it via the controlbar.
+     * Provider-agnostic — the attendance signal is the command set, never any
+     * CLI-specific modal text.
+     */
+    private autoApproveEffectivelyActive;
     private recordAutoApproval;
     recordApprovalSelection(buttonText: string): void;
     private formatMarkerTimestamp;

package/dist/providers/manual-attendance.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ManualAttendanceTracker — provider-agnostic "is a human driving this session
+ * right now" signal, used to suppress auto-approve while the user is taking
+ * manual control of a session from the dashboard.
+ *
+ * Why this exists
+ * ---------------
+ * When `autoApprove` is on, an approval modal is auto-dismissed within a few
+ * hundred ms of appearing. For a background mesh worker that is exactly the
+ * desired delegated behavior. But for a session the user is actively watching
+ * and operating (a base-node / foreground session), the auto-fire closes the
+ * modal before the human can pick a button — and likewise fights their use of
+ * the controlbar. The fix is to give the human a short quiet window: while they
+ * are attending the session by hand, auto-approve holds; once they go idle it
+ * resumes.
+ *
+ * The tracker holds only a timestamp. The *signal* — which commands count as
+ * "a human attending" — is decided by the caller (the command handler), and is
+ * the same set for every provider: foreground tab selection (select_session /
+ * open_panel), controlbar use (invoke_provider_script / set_mode / change_model
+ * / set_thought_level), manual approval (resolve_action) and manual terminal
+ * input (pty_input). Notably NOT send_chat, which is also how a coordinator
+ * delegates a task to a worker — counting it would wrongly suppress the
+ * worker's delegated auto-approve.
+ *
+ * Because a background worker never receives any of those attending commands,
+ * it is never "attended", so its delegated auto-approve is unaffected. The
+ * mechanism is therefore provider-common AND preserves worker auto-approve
+ * without any per-provider branching.
+ */
+/**
+ * How long after the last manual interaction auto-approve stays suppressed.
+ *
+ * Trade-off: long enough that after foregrounding a session's tab the user has
+ * a realistic chance to act on an incoming approval (the auto-approve settle
+ * window is only ~600ms, so a human cannot out-race it), yet short enough that
+ * a session left unattended — e.g. a worker tab the user briefly peeked at —
+ * resumes auto-approving within about a minute. Re-armed on every attending
+ * command, so a user who keeps interacting keeps the window fresh.
+ */
+export declare const AUTO_APPROVE_MANUAL_ATTENDANCE_SUPPRESS_MS = 60000;
+export declare class ManualAttendanceTracker {
+    private readonly suppressMs;
+    private lastInteractionAt;
+    constructor(suppressMs?: number);
+    /** Record that a human just drove this session by hand. */
+    note(now?: number): void;
+    /** True while a manual interaction is recent enough to suppress auto-approve. */
+    isAttended(now?: number): boolean;
+    /**
+     * Milliseconds remaining in the current suppression window, or 0 when not
+     * attended. Used to re-arm a re-check timer so auto-approve fires the moment
+     * the window lapses even if the PTY/agent has since gone silent.
+     */
+    remainingMs(now?: number): number;
+}
+/**
+ * The session-scoped commands that count as "a human is attending this session
+ * by hand". Shared so the command handler and any forward path agree on one
+ * definition. Deliberately excludes send_chat (coordinator task delegation) and
+ * pure read commands (read_chat / list_chats — passive polling, not driving).
+ */
+export declare const MANUAL_ATTENDANCE_COMMANDS: ReadonlySet<string>;

package/dist/providers/provider-instance.d.ts

@@ -194,6 +194,14 @@ export interface ProviderInstance {
     detachMeshAssignment?(): void;
     /** Refresh static provider definition/scripts without restarting the live runtime. */
     refreshProviderDefinition?(provider: ProviderModule): void;
+    /**
+     * Record that a human is actively attending this session by hand right now
+     * (foreground tab selection, controlbar use, manual approval, terminal
+     * input). Provider-common signal that suppresses auto-approve for a short
+     * window so the user can drive the session manually; background mesh worker
+     * sessions never receive it, so their delegated auto-approve is unaffected.
+     */
+    noteManualInteraction?(now?: number): void;
     /** cleanup */
     dispose(): void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.352",
+  "version": "0.9.82-rc.354",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.352",
+    "@adhdev/mesh-shared": "0.9.82-rc.354",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/cli-manager.ts

@@ -18,7 +18,7 @@ import { loadConfig } from '../config/config.js';
 import { loadState, saveState } from '../config/state-store.js';
 import { getWorkspaceState, resolveLaunchDirectory } from '../config/workspaces.js';
 import { appendRecentActivity } from '../config/recent-activity.js';
-import { unregisterMeshCoordinator } from '../mesh/coordinator-registry.js';
+import { unregisterMeshCoordinator, getCoordinatorForSession } from '../mesh/coordinator-registry.js';
 import { upsertSavedProviderSession } from '../config/saved-sessions.js';
 import { buildLegacyModelModeSummaryMetadata, normalizeProviderSummaryMetadata } from '../providers/summary-metadata.js';
 import { CliProviderInstance } from '../providers/cli-provider-instance.js';
@@ -1042,6 +1042,24 @@ export class DaemonCliManager {
                 );
                 continue;
             }
+            // Re-establish the launch-time settings a fresh launch applies. startSession
+            // seeds every new instance with { ...providerLoader.getSettings(type), ...override };
+            // passing a bare {} here on restart silently dropped TWO launch settings, so a
+            // restored session diverged from a freshly-launched one:
+            //   - autoApprove (a provider/machine setting from getSettings) → a restored
+            //     coordinator self-session lost auto-approve and re-prompted on every tool call.
+            //   - meshCoordinatorFor (the coordinator launch's settingsOverride) → the restored
+            //     session was no longer recognized as this daemon's live CLI coordinator by
+            //     findLiveCoordinators (so pending mesh events stopped draining into its PTY) nor
+            //     surfaced with the coordinator badge via settings. The persisted coordinator
+            //     registry (loaded on boot) is the source of truth to rebuild that mark.
+            // Both restores are provider-agnostic — getSettings is keyed by provider type and the
+            // registry mark is type-independent.
+            const restoredSettings: Record<string, any> = { ...this.providerLoader.getSettings(normalizedType) };
+            const coordinatorEntry = getCoordinatorForSession(record.runtimeId);
+            if (coordinatorEntry?.meshId) {
+                restoredSettings.meshCoordinatorFor = coordinatorEntry.meshId;
+            }
             try {
                 await this.registerCliInstance(
                     record.runtimeId,
@@ -1050,7 +1068,7 @@ export class DaemonCliManager {
                     record.workspace,
                     record.cliArgs,
                     resolvedProvider,
-                    {},
+                    restoredSettings,
                     true,
                     {
                         providerSessionId: sessionBinding.providerSessionId,
@@ -1097,10 +1115,19 @@ export class DaemonCliManager {
                 }
             }
         }
- // 2. Fuzzy match (returns first of multiple sessions — may be inaccurate)
-        for (const [k, a] of this.adapters) {
-            if (a.cliType === agentType) {
-                return { adapter: a, key: k };
+ // 2. Fuzzy match (returns first of multiple sessions — may be inaccurate).
+ //    FAIL-CLOSED: only when NO explicit instanceKey/targetSessionId was requested.
+ //    When a specific session WAS named (step 0) but is not hosted on this daemon,
+ //    falling back to the first same-cliType adapter silently redirects the command
+ //    into an UNRELATED session — e.g. a relayed/misrouted mesh send_chat lands in the
+ //    coordinator's own CLI session, echoing the dispatched task body back to the
+ //    coordinator (TASKECHO self-inject). Returning null instead makes the caller
+ //    surface an explicit "not running" error rather than mis-delivering the message.
+        if (!opts?.instanceKey) {
+            for (const [k, a] of this.adapters) {
+                if (a.cliType === agentType) {
+                    return { adapter: a, key: k };
+                }
             }
         }
         return null;

package/src/commands/handler.ts

@@ -25,6 +25,7 @@ import type { SessionRegistry, SessionRuntimeTarget } from '../sessions/registry
 import { reconcileIdeRuntimeSessions } from '../sessions/reconcile.js';
 import { LOG } from '../logging/logger.js';
 import { resolveLegacyProviderScript, type LegacyStringScript } from './provider-script-resolver.js';
+import { MANUAL_ATTENDANCE_COMMANDS } from '../providers/manual-attendance.js';
 
 // Sub-module imports
 import * as Chat from './chat-commands.js';
@@ -375,6 +376,36 @@ export class DaemonCommandHandler implements CommandHelpers {
         this._agentStream = manager;
     }
 
+    /**
+     * When a command in the manual-attendance set arrives for a session this
+     * daemon hosts, stamp the live instance so auto-approve holds while the user
+     * drives the session by hand. Provider-common: the signal is the command
+     * (foreground select_session / open_panel, controlbar invoke_provider_script
+     * / set_mode / change_model / set_thought_level, manual resolve_action,
+     * pty_input), never any CLI-specific modal text — so it works identically for
+     * every CLI/ACP provider. send_chat is deliberately excluded because a
+     * coordinator delegating a task to a worker also uses send_chat; counting it
+     * would wrongly suppress the worker's delegated auto-approve. For a remote
+     * mesh worker session the controlbar commands are forwarded to the owning
+     * worker daemon, which runs this same hook there, so attendance is recorded
+     * on the daemon that actually hosts the instance.
+     */
+    private noteManualAttendanceIfApplicable(cmd: string, args: any): void {
+        if (!MANUAL_ATTENDANCE_COMMANDS.has(cmd)) return;
+        const sessionId = this._currentRoute.session?.sessionId
+            || (typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : '');
+        if (!sessionId) return;
+        const session = this._ctx.sessionRegistry?.get(sessionId);
+        const instanceKey = session?.adapterKey || session?.instanceKey || sessionId;
+        const instance = this._ctx.instanceManager?.getInstance(instanceKey) as
+            { noteManualInteraction?: (now?: number) => void } | undefined;
+        try {
+            instance?.noteManualInteraction?.();
+        } catch {
+            // attendance is best-effort — never block command dispatch
+        }
+    }
+
     // ─── Command Dispatcher ──────────────────────────
 
     async handle(cmd: string, args: any): Promise<CommandResult> {
@@ -382,6 +413,7 @@ export class DaemonCommandHandler implements CommandHelpers {
         this._currentRoute = this.resolveRoute(args);
         const startedAt = Date.now();
         this.logCommandStart(cmd, args);
+        this.noteManualAttendanceIfApplicable(cmd, args);
         let result: CommandResult;
 
         if (isGitCommandName(cmd)) {

package/src/commands/router.ts

@@ -40,6 +40,7 @@ import {
     summarizeGitShape as sharedSummarizeGitShape,
     normalizeMeshNodeId,
     meshNodeIdMatches,
+    daemonIdsEquivalent,
 } from '@adhdev/mesh-shared';
 import { SessionRegistry } from '../sessions/registry.js';
 import { LOG } from '../logging/logger.js';
@@ -3462,6 +3463,13 @@ const MESH_FORWARDABLE_SESSION_COMMANDS = new Set([
     'set_mode',
     'change_model',
     'set_thought_level',
+    // agent_command (send_chat / clear_history / stop) is session-scoped too: a command
+    // explicitly naming a targetSessionId MUST reach that session wherever it lives, never a
+    // different local session. Without forwarding, a misrouted/relayed send_chat for a REMOTE
+    // worker session that reaches the wrong daemon used to fuzzy-inject the task body into that
+    // daemon's own CLI session (TASKECHO coordinator self-echo). Forwarding to the owning daemon
+    // delivers it to the real worker instead. (findAdapter is also fail-closed as the backstop.)
+    'agent_command',
 ]);
 const READ_DEBUG_ENABLED = process.argv.includes('--dev') || process.env.ADHDEV_READ_DEBUG === '1';
 
@@ -3901,7 +3909,10 @@ export class DaemonCommandRouter {
             if (!nodeDaemonId) continue;
             // Only forward to a genuinely remote daemon. When the owning node is this
             // coordinator itself (locally hosted worker), fall through to local handling.
-            if (selfDaemonId && nodeDaemonId === selfDaemonId) return undefined;
+            // id-form robust: the node daemonId and selfDaemonId may be stored in different
+            // forms of the same machine — a strict `===` would miss the self-match and forward
+            // a local session to a remote form of THIS daemon (loopback).
+            if (selfDaemonId && daemonIdsEquivalent(nodeDaemonId, selfDaemonId)) return undefined;
             return nodeDaemonId;
         }
         return undefined;
@@ -4090,12 +4101,52 @@ export class DaemonCommandRouter {
         return false;
     }
 
+    /**
+     * Best-effort recursive removal of a managed worktree directory.
+     *
+     * The git-registry de-registration is the safety-critical step of worktree
+     * teardown; a leftover directory must never gate dropping the node from the
+     * mesh. On Windows, `fs.rmSync` can throw EINVAL/EPERM/EBUSY on submodule
+     * gitlink (`.git`) files, long paths, junctions, or while a just-stopped
+     * delegate session is still releasing a handle/cwd on the directory. This
+     * helper absorbs those errors (never throws), with bounded retries + backoff
+     * to give handles time to release, and reports whether residue remains.
+     */
+    private async bestEffortRemoveWorktreeDir(dir: string): Promise<{ removed: boolean; residue: boolean; error?: string }> {
+        if (!dir || !fs.existsSync(dir)) return { removed: true, residue: false };
+        const sleep = (ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms));
+        // EINVAL is the Windows symptom for submodule gitlink residue; the rest are
+        // transient lock/permission classes. None should escape as a throw here.
+        const ABSORB = new Set(['EINVAL', 'EPERM', 'EBUSY', 'ENOTEMPTY', 'EACCES', 'EMFILE', 'ENFILE']);
+        let lastErr: any;
+        for (let attempt = 0; attempt < 4; attempt++) {
+            try {
+                // maxRetries/retryDelay give fs.rmSync its own internal backoff for
+                // EBUSY/EPERM/ENOTEMPTY; the outer loop extends tolerance to EINVAL.
+                fs.rmSync(dir, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+                if (!fs.existsSync(dir)) return { removed: true, residue: false };
+                lastErr = new Error('directory still present after rmSync');
+            } catch (e: any) {
+                lastErr = e;
+                const code = typeof e?.code === 'string' ? e.code : '';
+                if (code && !ABSORB.has(code)) {
+                    // Unexpected error class — stay best-effort (no throw) but stop retrying.
+                    break;
+                }
+            }
+            await sleep(150 * (attempt + 1));
+        }
+        return fs.existsSync(dir)
+            ? { removed: false, residue: true, error: String(lastErr?.message || lastErr || 'unknown rm error') }
+            : { removed: true, residue: false };
+    }
+
     private async cleanupLocalWorktreeNode(args: {
         mesh: any;
         node: any;
         nodeId: string;
         force?: boolean;
-    }): Promise<{ success: true; skipped?: boolean; removedPath?: string; repoRoot?: string; reason?: string; fallback?: string; forced?: boolean; convergence?: Record<string, unknown> } | { success: false; code: string; error: string; recoveryHint: string; convergence?: Record<string, unknown> }> {
+    }): Promise<{ success: true; skipped?: boolean; removedPath?: string; repoRoot?: string; reason?: string; fallback?: string; forced?: boolean; convergence?: Record<string, unknown>; recovered?: boolean; residue?: boolean; residueWarning?: string; residueError?: string } | { success: false; code: string; error: string; recoveryHint: string; convergence?: Record<string, unknown> }> {
         const workspace = typeof args.node?.workspace === 'string' ? args.node.workspace.trim() : '';
         if (!workspace) {
             return {
@@ -4155,11 +4206,35 @@ export class DaemonCommandRouter {
         const entries = await listWorktrees(repoRoot);
         const managedEntry = entries.find(entry => normalizePath(entry.path) === actualPath);
         if (!managedEntry) {
+            // Idempotent residue recovery (NOT a refusal). By this point the path is
+            // already proven ADHDev-managed: worktreeBranch metadata is present and
+            // actualPath === expectedPath. Git nonetheless no longer lists it as a
+            // worktree. This is the post-force-fallback re-entry state — an earlier
+            // removal de-registered the worktree from git but left the directory
+            // behind (commonly Windows EINVAL on submodule gitlink files). Refusing
+            // here would strand the node in mesh membership forever, so prune any
+            // stale registration, best-effort remove the leftover directory, and
+            // report success so the caller drops the node from the mesh registry.
+            try {
+                const { execFile } = await import('node:child_process');
+                const { promisify } = await import('node:util');
+                const execFileAsync = promisify(execFile);
+                await execFileAsync('git', ['worktree', 'prune'], {
+                    cwd: repoRoot, encoding: 'utf8', timeout: 30_000, maxBuffer: 4 * 1024 * 1024, windowsHide: true,
+                });
+            } catch { /* prune is best-effort */ }
+            const rm = await this.bestEffortRemoveWorktreeDir(workspace);
             return {
-                success: false,
-                code: 'mesh_worktree_cleanup_not_registered',
-                error: `Refusing to remove '${workspace}' because it is not registered in git worktree list for '${repoRoot}'`,
-                recoveryHint: 'Inspect git worktree list --porcelain from the source repo. If the path was already removed, prune git worktrees before retrying.',
+                success: true,
+                removedPath: workspace,
+                repoRoot,
+                reason: 'worktree_unregistered_residue_recovered',
+                recovered: true,
+                ...(rm.residue ? {
+                    residue: true,
+                    residueWarning: `Worktree was already de-registered from git but the directory could not be fully removed (leftover residue at '${workspace}'): ${rm.error || 'unknown error'}. The node will be dropped from the mesh; remove the directory manually if needed.`,
+                    residueError: rm.error,
+                } : {}),
             };
         }
         if (managedEntry.branch && managedEntry.branch !== args.node.worktreeBranch) {
@@ -4221,29 +4296,31 @@ export class DaemonCommandRouter {
                         convergence: forceFallbackConvergence,
                     };
                 } catch (deinitError: any) {
-                    // Fallback 2: deinit+remove still failed — rmSync + prune
+                    // Fallback 2: deinit+remove still failed — best-effort directory
+                    // removal + prune. The path is already proven managed/converged
+                    // here, and a leftover directory must NOT gate dropping the node
+                    // from the mesh, so absorb Windows EINVAL/EPERM and report success
+                    // with a residue warning instead of failing the whole removal.
+                    const rm = await this.bestEffortRemoveWorktreeDir(workspace);
                     try {
-                        fs.rmSync(workspace, { recursive: true, force: true });
                         await execFileAsync('git', ['worktree', 'prune'], {
                             cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_CLEANUP, maxBuffer: GIT_MAX_BUFFER_CLEANUP, windowsHide: true,
                         });
-                        return {
-                            success: true,
-                            removedPath: workspace,
-                            repoRoot,
-                            fallback: 'fs_rm_worktree_prune' as const,
-                            forced: true,
-                            reason: 'working_trees_containing_submodules' as const,
-                            convergence: forceFallbackConvergence,
-                        };
-                    } catch (rmError: any) {
-                        return {
-                            success: false,
-                            code: 'mesh_worktree_cleanup_failed',
-                            error: `All removal fallbacks exhausted. deinit+remove: ${deinitError?.message || deinitError}; rmSync+prune: ${rmError?.message || rmError}`,
-                            recoveryHint: 'Manually remove the worktree directory and run git worktree prune from the source repo.',
-                        };
-                    }
+                    } catch { /* prune is best-effort */ }
+                    return {
+                        success: true,
+                        removedPath: workspace,
+                        repoRoot,
+                        fallback: 'fs_rm_worktree_prune' as const,
+                        forced: true,
+                        reason: 'working_trees_containing_submodules' as const,
+                        convergence: forceFallbackConvergence,
+                        ...(rm.residue ? {
+                            residue: true,
+                            residueWarning: `Worktree was de-registered from git but the directory could not be fully removed (leftover residue at '${workspace}'): ${rm.error || 'unknown error'}; deinit+remove first failed with: ${deinitError?.message || deinitError}. The node will be dropped from the mesh; remove the directory manually if needed.`,
+                            residueError: rm.error,
+                        } : {}),
+                    };
                 }
             }
 
@@ -6260,14 +6337,17 @@ export class DaemonCommandRouter {
         // Session-scoped commands issued from the dashboard (the controlbar Model/Mode
         // selectors → invoke_provider_script, and modal approval → resolve_action, plus the
         // direct set_mode/change_model/set_thought_level mutations) target a session by
-        // targetSessionId. When that session is a mesh worker hosted on a REMOTE daemon, this
+        // targetSessionId. agent_command (send_chat / clear_history / stop) is included for the
+        // same reason: a command naming a session must reach THAT session, never a different
+        // local one. When that session is a mesh worker hosted on a REMOTE daemon, this
         // coordinator never holds its live instance, so the CommandHandler delegation would
-        // fail with "Live session not found". Forward to the owning worker daemon — the same
-        // daemon that already executes send_chat for that session — so the controlbar acts on
-        // the real worker. _meshDirectDispatch prevents re-forwarding once the call lands on
-        // the owning daemon (it then handles the session locally). A locally-hosted worker (or
-        // any session this coordinator owns) resolves to undefined below and falls through to
-        // normal local handling — no regression.
+        // fail with "Live session not found" — or, for agent_command, findAdapter would have
+        // fuzzy-injected the message into the coordinator's own CLI session (TASKECHO). Forward
+        // to the owning worker daemon — the same daemon that already executes send_chat for that
+        // session — so the command acts on the real worker. _meshDirectDispatch prevents
+        // re-forwarding once the call lands on the owning daemon (it then handles the session
+        // locally). A locally-hosted worker (or any session this coordinator owns) resolves to
+        // undefined below and falls through to normal local handling — no regression.
         if (MESH_FORWARDABLE_SESSION_COMMANDS.has(cmd) && this.deps.dispatchMeshCommand && !args?._meshDirectDispatch) {
             const targetSessionId = readStringValue(args?.targetSessionId, args?.sessionId, args?.instanceId);
             if (targetSessionId) {
@@ -8279,6 +8359,14 @@ export class DaemonCommandRouter {
                             return (forwarded ?? { success: false, error: 'no response from remote node' }) as CommandRouterResult;
                         }
                         const cleanupResult = await this.cleanupLocalWorktreeNode({ mesh, node, nodeId, force: args?.force === true });
+                        // De-gating: membership removal is NOT gated on the worktree
+                        // directory actually being deleted. cleanupLocalWorktreeNode now
+                        // returns success:true (with a residue flag) whenever the path is
+                        // proven managed and the only remaining problem is leftover
+                        // directory bytes (e.g. Windows EINVAL). A success:false here means
+                        // a genuinely-unsafe condition — missing metadata, a non-managed /
+                        // unexpected path, a branch mismatch, a dirty worktree, or an
+                        // unverified force fallback — and those still block removal.
                         if (cleanupResult.success === false) {
                             return {
                                 success: false,
@@ -8335,7 +8423,19 @@ export class DaemonCommandRouter {
                         } catch { /* ledger append is best-effort */ }
                     }
 
-                    return { success: true, removed, ...(sessionCleanup ? { sessionCleanup } : {}), ...(worktreeCleanup ? { worktreeCleanup } : {}) };
+                    // Surface leftover-directory residue at the top level so callers
+                    // see the node was dropped from the mesh even though the worktree
+                    // directory could not be fully removed (best-effort, non-gating).
+                    const residueWarning = worktreeCleanup?.residue === true && typeof worktreeCleanup?.residueWarning === 'string'
+                        ? worktreeCleanup.residueWarning
+                        : undefined;
+                    return {
+                        success: true,
+                        removed,
+                        ...(residueWarning ? { residueWarning } : {}),
+                        ...(sessionCleanup ? { sessionCleanup } : {}),
+                        ...(worktreeCleanup ? { worktreeCleanup } : {}),
+                    };
                 } catch (e: any) {
                     return { success: false, error: e.message };
                 }

package/src/git/git-diff.ts

@@ -1,7 +1,7 @@
 import { readFile, realpath } from 'node:fs/promises';
 import * as path from 'node:path';
 import type { GitDiffSummary, GitFileChange, GitFileChangeStatus } from './git-types.js';
-import { GitCommandError, isPathInside, resolveGitRepository, runGit } from './git-executor.js';
+import { GIT_STATUS_TIMEOUT_MS, GitCommandError, isPathInside, resolveGitRepository, runGit } from './git-executor.js';
 
 const DEFAULT_MAX_FILES = 200;
 const DEFAULT_MAX_BYTES = 200_000;
@@ -18,6 +18,21 @@ export interface GitDiffOptions {
   baseRef?: string;
 }
 
+/**
+ * Diff collection fans out an even larger parallel git burst than status (up to five
+ * concurrent spawns — name-status/numstat × unstaged/staged + ls-files — plus its own
+ * `rev-parse --show-toplevel`) and runs concurrently with the status path. On Windows the
+ * per-spawn cost alone can exceed the 5s `execGitRaw` default, so — exactly like
+ * getGitRepoStatus — give the collection path the larger status budget unless the caller
+ * pinned a timeout. Without this, a slow-but-healthy Windows worktree times out on the diff
+ * burst and the catch below flattens it to `repoRoot:null, isGitRepo:false`, dropping the
+ * diff while the (already-hardened) status block reports isGitRepo:true — an asymmetric
+ * failure that reads as "not a git repo" for diff only.
+ */
+function withCollectionTimeout(options: GitDiffOptions): GitDiffOptions {
+  return options.timeoutMs === undefined ? { ...options, timeoutMs: GIT_STATUS_TIMEOUT_MS } : options;
+}
+
 function validateBaseRef(ref: string): string {
   const trimmed = ref.trim();
   if (!trimmed || trimmed.startsWith('-') || trimmed.includes('..') || !/^[A-Za-z0-9][A-Za-z0-9._/@-]*$/.test(trimmed)) {
@@ -54,16 +69,17 @@ export async function getGitDiffSummary(
   options: GitDiffOptions = {},
 ): Promise<GitDiffSummary> {
   const lastCheckedAt = Date.now();
+  const effectiveOptions = withCollectionTimeout(options);
 
   try {
-    const repo = await resolveGitRepository(workspace, options);
+    const repo = await resolveGitRepository(workspace, effectiveOptions);
     const repoRoot = repo.repoRoot!;
 
     if (options.baseRef) {
       const range = `${validateBaseRef(options.baseRef)}...HEAD`;
       const [nameStatus, numstat] = await Promise.all([
-        runGit(repo, ['diff', '--no-ext-diff', '--name-status', range, '--'], { ...options, cwd: repoRoot }),
-        runGit(repo, ['diff', '--no-ext-diff', '--numstat', range, '--'], { ...options, cwd: repoRoot }),
+        runGit(repo, ['diff', '--no-ext-diff', '--name-status', range, '--'], { ...effectiveOptions, cwd: repoRoot }),
+        runGit(repo, ['diff', '--no-ext-diff', '--numstat', range, '--'], { ...effectiveOptions, cwd: repoRoot }),
       ]);
       const outputBytes = byteLength(nameStatus.stdout + numstat.stdout);
       const changes = combineDiffEntries(nameStatus.stdout, numstat.stdout, false);
@@ -83,11 +99,11 @@ export async function getGitDiffSummary(
     }
 
     const [unstagedNameStatus, unstagedNumstat, stagedNameStatus, stagedNumstat, untracked] = await Promise.all([
-      runGit(repo, ['diff', '--no-ext-diff', '--name-status'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['diff', '--no-ext-diff', '--numstat'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--name-status'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--numstat'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['ls-files', '--others', '--exclude-standard'], { ...options, cwd: repoRoot }),
+      runGit(repo, ['diff', '--no-ext-diff', '--name-status'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['diff', '--no-ext-diff', '--numstat'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--name-status'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--numstat'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['ls-files', '--others', '--exclude-standard'], { ...effectiveOptions, cwd: repoRoot }),
     ]);
 
     const outputBytes = byteLength(
@@ -139,14 +155,15 @@ export async function getGitFileDiff(
   options: GitDiffOptions = {},
 ): Promise<GitFileDiffResult> {
   const lastCheckedAt = Date.now();
-  const repo = await resolveGitRepository(workspace, options);
+  const effectiveOptions = withCollectionTimeout(options);
+  const repo = await resolveGitRepository(workspace, effectiveOptions);
   const repoRoot = repo.repoRoot!;
   const selected = await resolveRepoFilePath(repoRoot, filePath);
   const maxBytes = normalizePositiveInteger(options.maxBytes, DEFAULT_MAX_BYTES);
 
   if (options.baseRef) {
     const range = `${validateBaseRef(options.baseRef)}...HEAD`;
-    const result = await runGit(repo, ['diff', '--no-ext-diff', range, '--', selected.relativePath], { ...options, cwd: repoRoot });
+    const result = await runGit(repo, ['diff', '--no-ext-diff', range, '--', selected.relativePath], { ...effectiveOptions, cwd: repoRoot });
     const bounded = truncateText(result.stdout, maxBytes);
     return {
       workspace: repo.workspace,
@@ -160,15 +177,15 @@ export async function getGitFileDiff(
   }
 
   const [unstaged, staged] = await Promise.all([
-    runGit(repo, ['diff', '--no-ext-diff', '--', selected.relativePath], { ...options, cwd: repoRoot }),
-    runGit(repo, ['diff', '--cached', '--no-ext-diff', '--', selected.relativePath], { ...options, cwd: repoRoot }),
+    runGit(repo, ['diff', '--no-ext-diff', '--', selected.relativePath], { ...effectiveOptions, cwd: repoRoot }),
+    runGit(repo, ['diff', '--cached', '--no-ext-diff', '--', selected.relativePath], { ...effectiveOptions, cwd: repoRoot }),
   ]);
 
   let diff = [unstaged.stdout, staged.stdout].filter((part) => part.length > 0).join('\n');
 
   if (!diff) {
     const untracked = await runGit(repo, ['ls-files', '--others', '--exclude-standard', '--', selected.relativePath], {
-      ...options,
+      ...effectiveOptions,
       cwd: repoRoot,
     });
     const untrackedFiles = untracked.stdout.split('\n').filter(Boolean);

package/src/index.ts

@@ -186,6 +186,11 @@ export {
 } from './config/mesh-config.js';
 export type { CreateMeshOptions, UpdateMeshOptions, AddNodeOptions } from './config/mesh-config.js';
 
+// ── Mesh shared daemon-id helpers (re-export so external tooling — e.g. the
+//    mcp-server, which depends only on @adhdev/daemon-core — can canonicalize
+//    daemon-id forms without taking a direct @adhdev/mesh-shared dependency). ──
+export { expandDaemonIdForms, daemonIdsEquivalent, machineCoreFromDaemonId } from '@adhdev/mesh-shared';
+
 // ── Mesh Coordinator ──
 export { buildCoordinatorSystemPrompt } from './mesh/coordinator-prompt.js';
 export { upsertMeshMission, getMeshMissions, getMeshMission, summarizeMissionTasks, summarizeMeshMission, getActiveMeshMissionSummaries, getMeshStatusMissionSummaries, getMeshStatusMissionsCompact, listMeshMissionSummaries, buildMissionPromptSection, GOAL_PREVIEW_MAX, COMPACT_STATUS_GOAL_PREVIEW_MAX, MESH_MISSION_STATUSES } from './mesh/mesh-missions.js';