@adhdev/daemon-core 0.9.82-rc.353 → 0.9.82-rc.354

package/dist/providers/acp-provider-instance.d.ts

@@ -88,6 +88,9 @@ export declare class AcpProviderInstance implements ProviderInstance {
     sendPrompt(text: string, contentBlocks?: ContentBlock[]): Promise<void>;
     private cancelSession;
     private permissionResolvers;
+    private readonly manualAttendance;
+    /** @see ProviderInstance.noteManualInteraction */
+    noteManualInteraction(now?: number): void;
     resolvePermission(approved: boolean): Promise<void>;
     private handleSessionUpdate;
     /** Handle legacy session/update formats (pre-standardization compat) */

package/dist/providers/cli-provider-instance.d.ts

@@ -79,6 +79,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private pendingAutoApprovalSince;
     private autoApproveSettleTimer;
     private autoApproveInactiveSince;
+    private readonly manualAttendance;
     private controlValues;
     private summaryMetadata;
     private appliedEffectKeys;
@@ -204,6 +205,17 @@ export declare class CliProviderInstance implements ProviderInstance {
     get cliType(): string;
     get cliName(): string;
     private shouldAutoApprove;
+    /** @see ProviderInstance.noteManualInteraction */
+    noteManualInteraction(now?: number): void;
+    /**
+     * Whether auto-approve should be treated as active *right now* for display
+     * and firing decisions: the configured intent AND the user is not currently
+     * attending this session by hand. When a human is attending, auto-approve is
+     * held so the modal stays visible and they can drive it via the controlbar.
+     * Provider-agnostic — the attendance signal is the command set, never any
+     * CLI-specific modal text.
+     */
+    private autoApproveEffectivelyActive;
     private recordAutoApproval;
     recordApprovalSelection(buttonText: string): void;
     private formatMarkerTimestamp;

package/dist/providers/manual-attendance.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ManualAttendanceTracker — provider-agnostic "is a human driving this session
+ * right now" signal, used to suppress auto-approve while the user is taking
+ * manual control of a session from the dashboard.
+ *
+ * Why this exists
+ * ---------------
+ * When `autoApprove` is on, an approval modal is auto-dismissed within a few
+ * hundred ms of appearing. For a background mesh worker that is exactly the
+ * desired delegated behavior. But for a session the user is actively watching
+ * and operating (a base-node / foreground session), the auto-fire closes the
+ * modal before the human can pick a button — and likewise fights their use of
+ * the controlbar. The fix is to give the human a short quiet window: while they
+ * are attending the session by hand, auto-approve holds; once they go idle it
+ * resumes.
+ *
+ * The tracker holds only a timestamp. The *signal* — which commands count as
+ * "a human attending" — is decided by the caller (the command handler), and is
+ * the same set for every provider: foreground tab selection (select_session /
+ * open_panel), controlbar use (invoke_provider_script / set_mode / change_model
+ * / set_thought_level), manual approval (resolve_action) and manual terminal
+ * input (pty_input). Notably NOT send_chat, which is also how a coordinator
+ * delegates a task to a worker — counting it would wrongly suppress the
+ * worker's delegated auto-approve.
+ *
+ * Because a background worker never receives any of those attending commands,
+ * it is never "attended", so its delegated auto-approve is unaffected. The
+ * mechanism is therefore provider-common AND preserves worker auto-approve
+ * without any per-provider branching.
+ */
+/**
+ * How long after the last manual interaction auto-approve stays suppressed.
+ *
+ * Trade-off: long enough that after foregrounding a session's tab the user has
+ * a realistic chance to act on an incoming approval (the auto-approve settle
+ * window is only ~600ms, so a human cannot out-race it), yet short enough that
+ * a session left unattended — e.g. a worker tab the user briefly peeked at —
+ * resumes auto-approving within about a minute. Re-armed on every attending
+ * command, so a user who keeps interacting keeps the window fresh.
+ */
+export declare const AUTO_APPROVE_MANUAL_ATTENDANCE_SUPPRESS_MS = 60000;
+export declare class ManualAttendanceTracker {
+    private readonly suppressMs;
+    private lastInteractionAt;
+    constructor(suppressMs?: number);
+    /** Record that a human just drove this session by hand. */
+    note(now?: number): void;
+    /** True while a manual interaction is recent enough to suppress auto-approve. */
+    isAttended(now?: number): boolean;
+    /**
+     * Milliseconds remaining in the current suppression window, or 0 when not
+     * attended. Used to re-arm a re-check timer so auto-approve fires the moment
+     * the window lapses even if the PTY/agent has since gone silent.
+     */
+    remainingMs(now?: number): number;
+}
+/**
+ * The session-scoped commands that count as "a human is attending this session
+ * by hand". Shared so the command handler and any forward path agree on one
+ * definition. Deliberately excludes send_chat (coordinator task delegation) and
+ * pure read commands (read_chat / list_chats — passive polling, not driving).
+ */
+export declare const MANUAL_ATTENDANCE_COMMANDS: ReadonlySet<string>;

package/dist/providers/provider-instance.d.ts

@@ -194,6 +194,14 @@ export interface ProviderInstance {
     detachMeshAssignment?(): void;
     /** Refresh static provider definition/scripts without restarting the live runtime. */
     refreshProviderDefinition?(provider: ProviderModule): void;
+    /**
+     * Record that a human is actively attending this session by hand right now
+     * (foreground tab selection, controlbar use, manual approval, terminal
+     * input). Provider-common signal that suppresses auto-approve for a short
+     * window so the user can drive the session manually; background mesh worker
+     * sessions never receive it, so their delegated auto-approve is unaffected.
+     */
+    noteManualInteraction?(now?: number): void;
     /** cleanup */
     dispose(): void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.353",
+  "version": "0.9.82-rc.354",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.353",
+    "@adhdev/mesh-shared": "0.9.82-rc.354",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/cli-manager.ts

@@ -18,7 +18,7 @@ import { loadConfig } from '../config/config.js';
 import { loadState, saveState } from '../config/state-store.js';
 import { getWorkspaceState, resolveLaunchDirectory } from '../config/workspaces.js';
 import { appendRecentActivity } from '../config/recent-activity.js';
-import { unregisterMeshCoordinator } from '../mesh/coordinator-registry.js';
+import { unregisterMeshCoordinator, getCoordinatorForSession } from '../mesh/coordinator-registry.js';
 import { upsertSavedProviderSession } from '../config/saved-sessions.js';
 import { buildLegacyModelModeSummaryMetadata, normalizeProviderSummaryMetadata } from '../providers/summary-metadata.js';
 import { CliProviderInstance } from '../providers/cli-provider-instance.js';
@@ -1042,6 +1042,24 @@ export class DaemonCliManager {
                 );
                 continue;
             }
+            // Re-establish the launch-time settings a fresh launch applies. startSession
+            // seeds every new instance with { ...providerLoader.getSettings(type), ...override };
+            // passing a bare {} here on restart silently dropped TWO launch settings, so a
+            // restored session diverged from a freshly-launched one:
+            //   - autoApprove (a provider/machine setting from getSettings) → a restored
+            //     coordinator self-session lost auto-approve and re-prompted on every tool call.
+            //   - meshCoordinatorFor (the coordinator launch's settingsOverride) → the restored
+            //     session was no longer recognized as this daemon's live CLI coordinator by
+            //     findLiveCoordinators (so pending mesh events stopped draining into its PTY) nor
+            //     surfaced with the coordinator badge via settings. The persisted coordinator
+            //     registry (loaded on boot) is the source of truth to rebuild that mark.
+            // Both restores are provider-agnostic — getSettings is keyed by provider type and the
+            // registry mark is type-independent.
+            const restoredSettings: Record<string, any> = { ...this.providerLoader.getSettings(normalizedType) };
+            const coordinatorEntry = getCoordinatorForSession(record.runtimeId);
+            if (coordinatorEntry?.meshId) {
+                restoredSettings.meshCoordinatorFor = coordinatorEntry.meshId;
+            }
             try {
                 await this.registerCliInstance(
                     record.runtimeId,
@@ -1050,7 +1068,7 @@ export class DaemonCliManager {
                     record.workspace,
                     record.cliArgs,
                     resolvedProvider,
-                    {},
+                    restoredSettings,
                     true,
                     {
                         providerSessionId: sessionBinding.providerSessionId,

package/src/commands/handler.ts

@@ -25,6 +25,7 @@ import type { SessionRegistry, SessionRuntimeTarget } from '../sessions/registry
 import { reconcileIdeRuntimeSessions } from '../sessions/reconcile.js';
 import { LOG } from '../logging/logger.js';
 import { resolveLegacyProviderScript, type LegacyStringScript } from './provider-script-resolver.js';
+import { MANUAL_ATTENDANCE_COMMANDS } from '../providers/manual-attendance.js';
 
 // Sub-module imports
 import * as Chat from './chat-commands.js';
@@ -375,6 +376,36 @@ export class DaemonCommandHandler implements CommandHelpers {
         this._agentStream = manager;
     }
 
+    /**
+     * When a command in the manual-attendance set arrives for a session this
+     * daemon hosts, stamp the live instance so auto-approve holds while the user
+     * drives the session by hand. Provider-common: the signal is the command
+     * (foreground select_session / open_panel, controlbar invoke_provider_script
+     * / set_mode / change_model / set_thought_level, manual resolve_action,
+     * pty_input), never any CLI-specific modal text — so it works identically for
+     * every CLI/ACP provider. send_chat is deliberately excluded because a
+     * coordinator delegating a task to a worker also uses send_chat; counting it
+     * would wrongly suppress the worker's delegated auto-approve. For a remote
+     * mesh worker session the controlbar commands are forwarded to the owning
+     * worker daemon, which runs this same hook there, so attendance is recorded
+     * on the daemon that actually hosts the instance.
+     */
+    private noteManualAttendanceIfApplicable(cmd: string, args: any): void {
+        if (!MANUAL_ATTENDANCE_COMMANDS.has(cmd)) return;
+        const sessionId = this._currentRoute.session?.sessionId
+            || (typeof args?.targetSessionId === 'string' ? args.targetSessionId.trim() : '');
+        if (!sessionId) return;
+        const session = this._ctx.sessionRegistry?.get(sessionId);
+        const instanceKey = session?.adapterKey || session?.instanceKey || sessionId;
+        const instance = this._ctx.instanceManager?.getInstance(instanceKey) as
+            { noteManualInteraction?: (now?: number) => void } | undefined;
+        try {
+            instance?.noteManualInteraction?.();
+        } catch {
+            // attendance is best-effort — never block command dispatch
+        }
+    }
+
     // ─── Command Dispatcher ──────────────────────────
 
     async handle(cmd: string, args: any): Promise<CommandResult> {
@@ -382,6 +413,7 @@ export class DaemonCommandHandler implements CommandHelpers {
         this._currentRoute = this.resolveRoute(args);
         const startedAt = Date.now();
         this.logCommandStart(cmd, args);
+        this.noteManualAttendanceIfApplicable(cmd, args);
         let result: CommandResult;
 
         if (isGitCommandName(cmd)) {

package/src/git/git-diff.ts

@@ -1,7 +1,7 @@
 import { readFile, realpath } from 'node:fs/promises';
 import * as path from 'node:path';
 import type { GitDiffSummary, GitFileChange, GitFileChangeStatus } from './git-types.js';
-import { GitCommandError, isPathInside, resolveGitRepository, runGit } from './git-executor.js';
+import { GIT_STATUS_TIMEOUT_MS, GitCommandError, isPathInside, resolveGitRepository, runGit } from './git-executor.js';
 
 const DEFAULT_MAX_FILES = 200;
 const DEFAULT_MAX_BYTES = 200_000;
@@ -18,6 +18,21 @@ export interface GitDiffOptions {
   baseRef?: string;
 }
 
+/**
+ * Diff collection fans out an even larger parallel git burst than status (up to five
+ * concurrent spawns — name-status/numstat × unstaged/staged + ls-files — plus its own
+ * `rev-parse --show-toplevel`) and runs concurrently with the status path. On Windows the
+ * per-spawn cost alone can exceed the 5s `execGitRaw` default, so — exactly like
+ * getGitRepoStatus — give the collection path the larger status budget unless the caller
+ * pinned a timeout. Without this, a slow-but-healthy Windows worktree times out on the diff
+ * burst and the catch below flattens it to `repoRoot:null, isGitRepo:false`, dropping the
+ * diff while the (already-hardened) status block reports isGitRepo:true — an asymmetric
+ * failure that reads as "not a git repo" for diff only.
+ */
+function withCollectionTimeout(options: GitDiffOptions): GitDiffOptions {
+  return options.timeoutMs === undefined ? { ...options, timeoutMs: GIT_STATUS_TIMEOUT_MS } : options;
+}
+
 function validateBaseRef(ref: string): string {
   const trimmed = ref.trim();
   if (!trimmed || trimmed.startsWith('-') || trimmed.includes('..') || !/^[A-Za-z0-9][A-Za-z0-9._/@-]*$/.test(trimmed)) {
@@ -54,16 +69,17 @@ export async function getGitDiffSummary(
   options: GitDiffOptions = {},
 ): Promise<GitDiffSummary> {
   const lastCheckedAt = Date.now();
+  const effectiveOptions = withCollectionTimeout(options);
 
   try {
-    const repo = await resolveGitRepository(workspace, options);
+    const repo = await resolveGitRepository(workspace, effectiveOptions);
     const repoRoot = repo.repoRoot!;
 
     if (options.baseRef) {
       const range = `${validateBaseRef(options.baseRef)}...HEAD`;
       const [nameStatus, numstat] = await Promise.all([
-        runGit(repo, ['diff', '--no-ext-diff', '--name-status', range, '--'], { ...options, cwd: repoRoot }),
-        runGit(repo, ['diff', '--no-ext-diff', '--numstat', range, '--'], { ...options, cwd: repoRoot }),
+        runGit(repo, ['diff', '--no-ext-diff', '--name-status', range, '--'], { ...effectiveOptions, cwd: repoRoot }),
+        runGit(repo, ['diff', '--no-ext-diff', '--numstat', range, '--'], { ...effectiveOptions, cwd: repoRoot }),
       ]);
       const outputBytes = byteLength(nameStatus.stdout + numstat.stdout);
       const changes = combineDiffEntries(nameStatus.stdout, numstat.stdout, false);
@@ -83,11 +99,11 @@ export async function getGitDiffSummary(
     }
 
     const [unstagedNameStatus, unstagedNumstat, stagedNameStatus, stagedNumstat, untracked] = await Promise.all([
-      runGit(repo, ['diff', '--no-ext-diff', '--name-status'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['diff', '--no-ext-diff', '--numstat'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--name-status'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--numstat'], { ...options, cwd: repoRoot }),
-      runGit(repo, ['ls-files', '--others', '--exclude-standard'], { ...options, cwd: repoRoot }),
+      runGit(repo, ['diff', '--no-ext-diff', '--name-status'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['diff', '--no-ext-diff', '--numstat'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--name-status'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['diff', '--cached', '--no-ext-diff', '--numstat'], { ...effectiveOptions, cwd: repoRoot }),
+      runGit(repo, ['ls-files', '--others', '--exclude-standard'], { ...effectiveOptions, cwd: repoRoot }),
     ]);
 
     const outputBytes = byteLength(
@@ -139,14 +155,15 @@ export async function getGitFileDiff(
   options: GitDiffOptions = {},
 ): Promise<GitFileDiffResult> {
   const lastCheckedAt = Date.now();
-  const repo = await resolveGitRepository(workspace, options);
+  const effectiveOptions = withCollectionTimeout(options);
+  const repo = await resolveGitRepository(workspace, effectiveOptions);
   const repoRoot = repo.repoRoot!;
   const selected = await resolveRepoFilePath(repoRoot, filePath);
   const maxBytes = normalizePositiveInteger(options.maxBytes, DEFAULT_MAX_BYTES);
 
   if (options.baseRef) {
     const range = `${validateBaseRef(options.baseRef)}...HEAD`;
-    const result = await runGit(repo, ['diff', '--no-ext-diff', range, '--', selected.relativePath], { ...options, cwd: repoRoot });
+    const result = await runGit(repo, ['diff', '--no-ext-diff', range, '--', selected.relativePath], { ...effectiveOptions, cwd: repoRoot });
     const bounded = truncateText(result.stdout, maxBytes);
     return {
       workspace: repo.workspace,
@@ -160,15 +177,15 @@ export async function getGitFileDiff(
   }
 
   const [unstaged, staged] = await Promise.all([
-    runGit(repo, ['diff', '--no-ext-diff', '--', selected.relativePath], { ...options, cwd: repoRoot }),
-    runGit(repo, ['diff', '--cached', '--no-ext-diff', '--', selected.relativePath], { ...options, cwd: repoRoot }),
+    runGit(repo, ['diff', '--no-ext-diff', '--', selected.relativePath], { ...effectiveOptions, cwd: repoRoot }),
+    runGit(repo, ['diff', '--cached', '--no-ext-diff', '--', selected.relativePath], { ...effectiveOptions, cwd: repoRoot }),
   ]);
 
   let diff = [unstaged.stdout, staged.stdout].filter((part) => part.length > 0).join('\n');
 
   if (!diff) {
     const untracked = await runGit(repo, ['ls-files', '--others', '--exclude-standard', '--', selected.relativePath], {
-      ...options,
+      ...effectiveOptions,
       cwd: repoRoot,
     });
     const untrackedFiles = untracked.stdout.split('\n').filter(Boolean);

package/src/providers/acp-provider-instance.ts

@@ -51,6 +51,7 @@ import { normalizeContent, flattenContent, normalizeInputEnvelope } from './cont
 import { assertProviderSupportsDeclaredInput, getEffectiveMessageInputSupport } from './provider-input-support.js';
 import type { ProviderInstance, ProviderState, AcpProviderState, ProviderErrorReason, ProviderEvent, InstanceContext, SessionModalState } from './provider-instance.js';
 import { StatusMonitor } from './status-monitor.js';
+import { ManualAttendanceTracker } from './manual-attendance.js';
 import { buildLegacyModelModeSummaryMetadata } from './summary-metadata.js';
 import { workingDirBasename } from './working-dir.js';
 import {
@@ -845,7 +846,12 @@ export class AcpProviderInstance implements ProviderInstance {
                 }
 
                 // ─── Auto-approve: skip user confirmation ───
-                if (this.settings.autoApprove !== false) {
+                // Held while a human is actively attending this session (manual
+                // attendance) so they can decide the permission themselves; falls
+                // through to the waiting_approval manual path below. A background
+                // worker is never attended, so its delegated auto-approve fires
+                // as before.
+                if (this.settings.autoApprove !== false && !this.manualAttendance.isAttended()) {
                     const toolTitle = tc.title || tc.toolCallId || 'tool call';
                     this.log.info(`[${this.type}] Auto-approving: ${toolTitle}`);
                     this.appendSystemMessage(`Auto-approved: ${toolTitle}`);
@@ -1128,6 +1134,17 @@ export class AcpProviderInstance implements ProviderInstance {
 
     private permissionResolvers: ((approved: boolean) => void)[] = [];
 
+    // Provider-common manual-attendance signal: while a human is actively driving
+    // this session from the dashboard, auto-approve holds so they can decide on
+    // the permission request themselves. Background workers are never attended →
+    // delegated auto-approve is unaffected.
+    private readonly manualAttendance = new ManualAttendanceTracker();
+
+    /** @see ProviderInstance.noteManualInteraction */
+    noteManualInteraction(now = Date.now()): void {
+        this.manualAttendance.note(now);
+    }
+
     async resolvePermission(approved: boolean): Promise<void> {
         const resolver = this.permissionResolvers.shift();
         if (resolver) {

package/src/providers/cli-provider-instance.ts

@@ -29,6 +29,7 @@ import { mergeProviderPatchState, resolveProviderStateSurface } from './provider
 import { normalizeProviderSessionId } from './provider-session-id.js';
 import { buildChatMessage, buildRuntimeSystemChatMessage, isUserFacingChatMessage, normalizeChatMessages, resolveChatMessageKind, extractFinalSummaryFromMessages } from './chat-message-normalization.js';
 import { workingDirBasename } from './working-dir.js';
+import { ManualAttendanceTracker } from './manual-attendance.js';
 
 type PersistableCliHistoryMessage = {
     role: string;
@@ -416,6 +417,11 @@ export class CliProviderInstance implements ProviderInstance {
     // a settle gate was in progress. Drives AUTO_APPROVE_GATE_HYSTERESIS_MS so a
     // brief generating flip does not immediately wipe the settle clock.
     private autoApproveInactiveSince = 0;
+    // Provider-common manual-attendance signal: while a human is actively driving
+    // this session from the dashboard, auto-approve holds so they can take manual
+    // control. Background mesh workers are never attended → delegated auto-approve
+    // is unaffected.
+    private readonly manualAttendance = new ManualAttendanceTracker();
     private controlValues: Record<string, string | number | boolean> = {};
     private summaryMetadata: unknown = undefined;
     private appliedEffectKeys = new Set<string>();
@@ -828,7 +834,7 @@ export class CliProviderInstance implements ProviderInstance {
 
     getHotChatSessionState(): HotChatSessionState {
         const adapterStatus = this.adapter.getStatus({ allowParse: false });
-        const autoApproveActive = adapterStatus.status === 'waiting_approval' && this.shouldAutoApprove();
+        const autoApproveActive = this.autoApproveEffectivelyActive(adapterStatus.status);
         const autoApproveHoldIdle = this.autoApproveBusy && adapterStatus.status === 'idle';
         const visibleStatus = autoApproveActive || autoApproveHoldIdle ? 'generating' : adapterStatus.status;
         const runtime = this.adapter.getRuntimeMetadata();
@@ -844,7 +850,7 @@ export class CliProviderInstance implements ProviderInstance {
 
     getSessionModalState(sessionId?: string): SessionModalState {
         const adapterStatus = this.adapter.getStatus({ allowParse: true });
-        const autoApproveActive = adapterStatus.status === 'waiting_approval' && this.shouldAutoApprove();
+        const autoApproveActive = this.autoApproveEffectivelyActive(adapterStatus.status);
         const autoApproveHoldIdle = this.autoApproveBusy && adapterStatus.status === 'idle';
         const visibleStatus = autoApproveActive || autoApproveHoldIdle ? 'generating' : adapterStatus.status;
         const dirName = workingDirBasename(this.workingDir);
@@ -947,7 +953,10 @@ export class CliProviderInstance implements ProviderInstance {
         } catch {
             return null;
         }
-        if (adapterStatus.status === 'waiting_approval' && !this.shouldAutoApprove()) {
+        // A session whose auto-approve is held by manual attendance IS parked on a
+        // modal awaiting the human — autoApproveEffectivelyActive folds that in, so
+        // the mesh force-inject guard correctly treats it as modal-parked.
+        if (adapterStatus.status === 'waiting_approval' && !this.autoApproveEffectivelyActive(adapterStatus.status)) {
             return 'waiting_approval';
         }
         return null;
@@ -1481,6 +1490,29 @@ export class CliProviderInstance implements ProviderInstance {
     }
 
     private maybeAutoApproveStatus(adapterStatus: any, now = Date.now()): boolean {
+        // Manual-attendance suppression (provider-common): when a human is
+        // actively driving this session from the dashboard, hold auto-approve so
+        // the modal stays visible and they can pick a button / use the controlbar
+        // themselves. Return false (NOT auto-approving) so getState keeps the
+        // modal surfaced. Clear any in-progress settle gate — a genuine fire
+        // after the window lapses must re-settle from scratch — and arm a
+        // re-check for the lapse moment, because the PTY may have gone silent and
+        // would otherwise never re-drive this decision. Background mesh workers
+        // are never attended, so their delegated auto-approve is untouched.
+        if (adapterStatus?.status === 'waiting_approval'
+            && this.shouldAutoApprove()
+            && this.manualAttendance.isAttended(now)) {
+            this.lastAutoApprovalSignature = '';
+            this.pendingAutoApprovalSignature = '';
+            this.pendingAutoApprovalSince = 0;
+            this.autoApproveInactiveSince = 0;
+            if (this.autoApproveSettleTimer) clearTimeout(this.autoApproveSettleTimer);
+            this.autoApproveSettleTimer = setTimeout(() => {
+                this.autoApproveSettleTimer = null;
+                this.recheckAutoApproveSettled();
+            }, this.manualAttendance.remainingMs(now) + 20);
+            return false;
+        }
         const autoApproveActive = adapterStatus?.status === 'waiting_approval' && this.shouldAutoApprove();
         // Guard re-entry: onStatusChange/getState can observe the same modal multiple
         // times while the PTY absorbs the approval key. Without this flag, repeated
@@ -2096,6 +2128,25 @@ export class CliProviderInstance implements ProviderInstance {
         return false;
     }
 
+    /** @see ProviderInstance.noteManualInteraction */
+    noteManualInteraction(now = Date.now()): void {
+        this.manualAttendance.note(now);
+    }
+
+    /**
+     * Whether auto-approve should be treated as active *right now* for display
+     * and firing decisions: the configured intent AND the user is not currently
+     * attending this session by hand. When a human is attending, auto-approve is
+     * held so the modal stays visible and they can drive it via the controlbar.
+     * Provider-agnostic — the attendance signal is the command set, never any
+     * CLI-specific modal text.
+     */
+    private autoApproveEffectivelyActive(status: string | undefined, now = Date.now()): boolean {
+        return status === 'waiting_approval'
+            && this.shouldAutoApprove()
+            && !this.manualAttendance.isAttended(now);
+    }
+
     private recordAutoApproval(modalMessage?: string, buttonLabel?: string, now = Date.now()): void {
         this.appendRuntimeSystemMessage(
             formatAutoApprovalMessage(modalMessage, buttonLabel),

package/src/providers/manual-attendance.ts

@@ -0,0 +1,85 @@
+/**
+ * ManualAttendanceTracker — provider-agnostic "is a human driving this session
+ * right now" signal, used to suppress auto-approve while the user is taking
+ * manual control of a session from the dashboard.
+ *
+ * Why this exists
+ * ---------------
+ * When `autoApprove` is on, an approval modal is auto-dismissed within a few
+ * hundred ms of appearing. For a background mesh worker that is exactly the
+ * desired delegated behavior. But for a session the user is actively watching
+ * and operating (a base-node / foreground session), the auto-fire closes the
+ * modal before the human can pick a button — and likewise fights their use of
+ * the controlbar. The fix is to give the human a short quiet window: while they
+ * are attending the session by hand, auto-approve holds; once they go idle it
+ * resumes.
+ *
+ * The tracker holds only a timestamp. The *signal* — which commands count as
+ * "a human attending" — is decided by the caller (the command handler), and is
+ * the same set for every provider: foreground tab selection (select_session /
+ * open_panel), controlbar use (invoke_provider_script / set_mode / change_model
+ * / set_thought_level), manual approval (resolve_action) and manual terminal
+ * input (pty_input). Notably NOT send_chat, which is also how a coordinator
+ * delegates a task to a worker — counting it would wrongly suppress the
+ * worker's delegated auto-approve.
+ *
+ * Because a background worker never receives any of those attending commands,
+ * it is never "attended", so its delegated auto-approve is unaffected. The
+ * mechanism is therefore provider-common AND preserves worker auto-approve
+ * without any per-provider branching.
+ */
+
+/**
+ * How long after the last manual interaction auto-approve stays suppressed.
+ *
+ * Trade-off: long enough that after foregrounding a session's tab the user has
+ * a realistic chance to act on an incoming approval (the auto-approve settle
+ * window is only ~600ms, so a human cannot out-race it), yet short enough that
+ * a session left unattended — e.g. a worker tab the user briefly peeked at —
+ * resumes auto-approving within about a minute. Re-armed on every attending
+ * command, so a user who keeps interacting keeps the window fresh.
+ */
+export const AUTO_APPROVE_MANUAL_ATTENDANCE_SUPPRESS_MS = 60_000;
+
+export class ManualAttendanceTracker {
+    private lastInteractionAt = 0;
+
+    constructor(private readonly suppressMs: number = AUTO_APPROVE_MANUAL_ATTENDANCE_SUPPRESS_MS) {}
+
+    /** Record that a human just drove this session by hand. */
+    note(now = Date.now()): void {
+        this.lastInteractionAt = now;
+    }
+
+    /** True while a manual interaction is recent enough to suppress auto-approve. */
+    isAttended(now = Date.now()): boolean {
+        return this.lastInteractionAt > 0 && (now - this.lastInteractionAt) < this.suppressMs;
+    }
+
+    /**
+     * Milliseconds remaining in the current suppression window, or 0 when not
+     * attended. Used to re-arm a re-check timer so auto-approve fires the moment
+     * the window lapses even if the PTY/agent has since gone silent.
+     */
+    remainingMs(now = Date.now()): number {
+        if (this.lastInteractionAt <= 0) return 0;
+        return Math.max(0, this.suppressMs - (now - this.lastInteractionAt));
+    }
+}
+
+/**
+ * The session-scoped commands that count as "a human is attending this session
+ * by hand". Shared so the command handler and any forward path agree on one
+ * definition. Deliberately excludes send_chat (coordinator task delegation) and
+ * pure read commands (read_chat / list_chats — passive polling, not driving).
+ */
+export const MANUAL_ATTENDANCE_COMMANDS: ReadonlySet<string> = new Set([
+    'select_session',
+    'open_panel',
+    'invoke_provider_script',
+    'set_mode',
+    'change_model',
+    'set_thought_level',
+    'resolve_action',
+    'pty_input',
+]);

package/src/providers/provider-instance.ts

@@ -226,6 +226,15 @@ export interface ProviderInstance {
     /** Refresh static provider definition/scripts without restarting the live runtime. */
     refreshProviderDefinition?(provider: ProviderModule): void;
 
+    /**
+     * Record that a human is actively attending this session by hand right now
+     * (foreground tab selection, controlbar use, manual approval, terminal
+     * input). Provider-common signal that suppresses auto-approve for a short
+     * window so the user can drive the session manually; background mesh worker
+     * sessions never receive it, so their delegated auto-approve is unaffected.
+     */
+    noteManualInteraction?(now?: number): void;
+
  /** cleanup */
     dispose(): void;
 }