@adhdev/daemon-core 0.9.82-rc.356 → 0.9.82-rc.357

package/dist/mesh/mesh-events-coordinator.d.ts

@@ -65,6 +65,7 @@ export declare function triggerMeshQueue(components: DaemonComponents, meshId: s
 export declare function isMeshCoordinatorEvent(eventName: unknown): eventName is string;
 export declare const MESH_FORCE_INJECT_EVENTS: ReadonlySet<string>;
 export declare function shouldForceInjectMeshEvent(eventName: unknown): boolean;
+export declare function buildRelayMetadataEvent(payload: Record<string, unknown>): Record<string, unknown>;
 export declare function handleMeshForwardEvent(components: DaemonComponents, payload: Record<string, unknown>): {
     success: boolean;
     forwarded: number;

package/dist/providers/spec/fsm-driver.d.ts

@@ -19,6 +19,7 @@ export type DashboardEvent = {
             index: number;
             label: string;
         }[];
+        kind: 'approval' | 'picker' | 'confirm' | null;
     } | null;
     controls: {
         id: string;

package/dist/providers/spec/fsm-types.d.ts

@@ -30,6 +30,27 @@ export interface FsmState {
     /** Modal states (approval/picker) expose modal buttons in the UI and are
      *  treated as "interesting" — the dashboard surfaces them distinctly. */
     modal?: boolean;
+    /**
+     * For a modal state, what KIND of modal it is — the semantic distinction the
+     * status field (always 'approval' for any modal, so the dashboard surfaces it)
+     * deliberately loses. The auto-approve worker uses this to decide whether it
+     * may answer the modal on the user's behalf:
+     *
+     *   - 'approval' — a tool/command/trust consent prompt ("Allow Bash?",
+     *     "Trust this folder?"). Auto-approve MAY fire (a background mesh worker
+     *     should not stall on these).
+     *   - 'picker'   — a selection menu the user opened (/model, /mode, …). There
+     *     is no "correct" answer to auto-pick; blindly selecting the first option
+     *     silently changes the model/mode. Auto-approve must NOT fire — the user
+     *     chooses.
+     *   - 'confirm'  — a non-consent yes/no the user must decide. Left to the user.
+     *
+     * Defaults to 'approval' for a modal state that omits it (preserves the
+     * pre-existing "auto-approve any modal" behaviour for un-migrated specs;
+     * picker/confirm states declare their kind explicitly). Non-modal states
+     * have no modal_kind.
+     */
+    modal_kind?: 'approval' | 'picker' | 'confirm';
     /** Status this state maps to for the dashboard/cli-adapter status field.
      *  One of: idle | generating | approval. Defaults: modal→approval,
      *  initial→idle, id==='busy'→generating, else idle. Explicit wins. */
@@ -142,3 +163,12 @@ export declare function outgoingTransitions(spec: CliSpecV4, stateId: string): F
 /** Map a state to the dashboard status string, applying the documented
  *  defaults when `status` is not explicit. */
 export declare function statusForState(state: FsmState): 'idle' | 'generating' | 'approval';
+/**
+ * The modal kind for a state, or null when the state is not modal. A modal state
+ * that omits `modal_kind` defaults to 'approval' so the established
+ * auto-approve-any-modal behaviour is preserved for specs that have not yet
+ * declared a kind; picker/confirm states must opt out by declaring their kind.
+ * This is the value the cli-adapter carries on `activeModal.kind` and the
+ * auto-approve gate reads — see cli-provider-instance.maybeAutoApproveStatus.
+ */
+export declare function modalKindForState(state: FsmState): 'approval' | 'picker' | 'confirm' | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.356",
+  "version": "0.9.82-rc.357",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.356",
+    "@adhdev/mesh-shared": "0.9.82-rc.357",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/cli-adapter-types.ts

@@ -14,6 +14,15 @@ export interface CliAdapterStatus {
     activeModal?: {
         message: string;
         buttons: string[];
+        /**
+         * Semantic modal class, when the adapter knows it (spec/FSM path):
+         * 'approval' = tool/command/trust consent (auto-approve may fire);
+         * 'picker' = a selection menu the user opened (/model, /mode — must NOT
+         * be auto-answered); 'confirm' = a yes/no left to the user. Absent/null
+         * for adapters that don't classify modals — the auto-approve gate then
+         * falls back to its structural heuristic.
+         */
+        kind?: 'approval' | 'picker' | 'confirm' | null;
     } | null;
     activeInteractivePrompt?: InteractivePrompt | null;
     providerSessionId?: string;

package/src/mesh/mesh-events-coordinator.ts

@@ -106,8 +106,51 @@ function sweepExpiredRemoteIdleSessions(): void {
 
 function getMeshWithCache(components: DaemonComponents, meshId: string): any | undefined {
     const localMesh = getMesh(meshId);
-    if (localMesh) return localMesh;
-    return components.router?.getCachedInlineMesh(meshId);
+    const cachedMesh = components.router?.getCachedInlineMesh(meshId);
+    if (!localMesh) return cachedMesh;
+    if (!cachedMesh) return localMesh;
+    return mergeInlineCacheOnlyNodes(localMesh, cachedMesh);
+}
+
+/**
+ * Claim-time membership view unification (CLAIMSTALL fix).
+ *
+ * The coordinator's claim path — triggerMeshQueue → autoLaunch candidate filter
+ * and the local/remote idle-session drain — reads mesh membership through
+ * getMeshWithCache, which historically returned the local-config mesh verbatim
+ * whenever one existed. A freshly cloned worktree node is registered ONLY into the
+ * router's inline mesh cache: clone_mesh_node's `meshRecord.inline` branch calls
+ * updateInlineMeshNode, NOT addNode, so the worktree node never reaches local
+ * config (meshes.json). The config-first view therefore omits the worktree node,
+ * while send_task — which resolves membership through getMeshForCommand(preferInline)
+ * over the same inline cache — sees it. That view asymmetry is the stall: a queue
+ * task pinned to the worktree node reports `target_node_id_unmatched` (autoLaunch
+ * candidate filter / targetPinUnmatched check) and the node's idle session is
+ * dropped from the drain pool (mesh.nodes.find miss), so claim never fires and the
+ * task is stranded pending — even though nodeId matching itself is correct.
+ *
+ * Fix: union the local-config nodes with any inline-cache-ONLY nodes, so the claim
+ * view matches the command (send_task) view. Base (non-worktree) nodes present in
+ * local config stay config-authoritative — their entry is taken verbatim from
+ * localMesh, so base node claim/matching is byte-for-byte unchanged. Only nodes
+ * that exist solely in the inline cache (the cloned worktree nodes) are appended.
+ * Identity comparison uses the shared 3-form normalizer (id / nodeId / node_id),
+ * identical to every other claim-path consumer — the matching logic is untouched,
+ * only which nodes are visible.
+ */
+function mergeInlineCacheOnlyNodes(localMesh: any, cachedMesh: any): any {
+    const localNodes = Array.isArray(localMesh?.nodes) ? localMesh.nodes : [];
+    const cachedNodes = Array.isArray(cachedMesh?.nodes) ? cachedMesh.nodes : [];
+    if (!cachedNodes.length) return localMesh;
+    const cacheOnly = cachedNodes.filter((cachedNode: any) => {
+        const cachedId = readMeshNodeId(cachedNode);
+        // Unidentifiable cache entries can never be a claim/route target — skip them
+        // rather than appending junk that no consumer can address.
+        if (!cachedId) return false;
+        return !localNodes.some((localNode: any) => meshNodeIdMatches(localNode, cachedId));
+    });
+    if (!cacheOnly.length) return localMesh;
+    return { ...localMesh, nodes: [...localNodes, ...cacheOnly] };
 }
 
 const INTENTIONAL_CLEANUP_STOP_SUPPRESSION_MS = 30 * 60 * 1000;
@@ -2143,6 +2186,88 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
     return { success: true, forwarded: 0 };
 }
 
+// Reconstruct the metadataEvent that injectMeshSystemMessage consumes from a forwarded
+// (cross-machine) mesh event. The remote relay hop arrives as a flat payload, NOT the
+// original provider event object, so this whitelists the fields the coordinator-side
+// pipeline reads and re-projects them. Kept pure + exported so the relay-path field
+// preservation (esp. taskId) is unit-testable without driving injectMeshSystemMessage.
+//
+// IMPORTANT asymmetry: the LOCAL in-process forward path (onMeshCoordinatorEventForwarded)
+// passes the whole event through as metadataEvent, so every field on the event survives
+// there for free. This remote-only path must explicitly mirror each field it needs.
+export function buildRelayMetadataEvent(payload: Record<string, unknown>): Record<string, unknown> {
+    const relayModalMessage = readNonEmptyString(payload.modalMessage);
+    const relayModalButtons = Array.isArray(payload.modalButtons)
+        ? (payload.modalButtons as unknown[]).filter((b): b is string => typeof b === 'string' && b.trim().length > 0)
+        : null;
+    return {
+        // Preserve the dispatch task id across the machine boundary. The `received` trace
+        // stage reads payload.taskId; without mirroring it here the rebuilt metadataEvent
+        // loses it, so injectMeshSystemMessage's traceCtx.taskId and the
+        // updateDirectDispatchStatus(eventTaskId) call go undefined — the EvtTrace
+        // queued/surfaced stages show task=- and the direct-dispatch ledger falls back to a
+        // session_id match (which can flip a sibling row). The local in-process forward path
+        // keeps event.taskId/meshActiveTaskId for free; this mirrors it for the remote relay.
+        // Same taskId/meshActiveTaskId ordering the local unroutable trace uses.
+        taskId: readNonEmptyString(payload.taskId) || readNonEmptyString(payload.meshActiveTaskId),
+        targetSessionId: readNonEmptyString(payload.targetSessionId) || readNonEmptyString(payload.sessionId) || readNonEmptyString(payload.instanceId),
+        providerType: readNonEmptyString(payload.providerType),
+        providerSessionId: readNonEmptyString(payload.providerSessionId),
+        // Preserve the originating coordinator SESSION id across the machine boundary so
+        // the completion routes back to the exact coordinator session (multi-coordinator).
+        // buildForwardPayloadFromPending spreads the worker event's metadata, so the id
+        // arrives as payload.meshCoordinatorSessionId; the top-level targetCoordinatorSessionId
+        // is also accepted as a fallback. injectMeshSystemMessage re-derives the routing
+        // anchors from this. Absent → daemon-level fallback (version-skew safe).
+        meshCoordinatorSessionId: readNonEmptyString(payload.meshCoordinatorSessionId) || readNonEmptyString(payload.targetCoordinatorSessionId),
+        // Carry the session identity fields the worker provider event emits so the
+        // coordinator's mirror (updateMeshOwnedSession) gets a real workspace/title/
+        // settings. Without these the remote-relay hop reconstructs metadataEvent with
+        // an empty workspace, and the dashboard flaps to the generic
+        // "Terminal (Mesh Node)" title (and degrades the provider label) between live
+        // events and the periodic get_status_metadata snapshot. The local in-process
+        // forward path (onMeshCoordinatorEventForwarded) already preserves these; this
+        // mirrors them for the remote-only relay path.
+        workspace: readNonEmptyString(payload.workspace) || readNonEmptyString(payload.workspaceName),
+        workspaceName: readNonEmptyString(payload.workspaceName) || readNonEmptyString(payload.workspace),
+        sessionTitle: readNonEmptyString(payload.sessionTitle),
+        sessionStatus: readNonEmptyString(payload.sessionStatus),
+        sessionChatStatus: readNonEmptyString(payload.sessionChatStatus),
+        providerName: readNonEmptyString(payload.providerName),
+        ...(payload.sessionSettings && typeof payload.sessionSettings === 'object' && !Array.isArray(payload.sessionSettings) ? { sessionSettings: payload.sessionSettings } : {}),
+        finalSummary: readNonEmptyString(payload.finalSummary) || readNonEmptyString(payload.summary),
+        // T2: carry the worker's status-snapshot last-message preview across the machine
+        // boundary so a summary-less completion still surfaces the assistant reply in the
+        // coordinator's inbox mirror. resolveMeshSurfacedSessionPreview reads these
+        // (assistant-role only) when finalSummary is absent.
+        lastMessagePreview: readNonEmptyString(payload.lastMessagePreview),
+        lastMessageRole: readNonEmptyString(payload.lastMessageRole),
+        ...(payload.lastMessageAt !== undefined ? { lastMessageAt: payload.lastMessageAt } : {}),
+        jobId: readNonEmptyString(payload.jobId),
+        interactionId: readNonEmptyString(payload.interactionId),
+        status: readNonEmptyString(payload.status),
+        targetDaemonId: readNonEmptyString(payload.targetDaemonId),
+        startedAt: readNonEmptyString(payload.startedAt),
+        completedAt: readNonEmptyString(payload.completedAt),
+        retryOfJobId: readNonEmptyString(payload.retryOfJobId),
+        ...(relayModalMessage ? { modalMessage: relayModalMessage } : {}),
+        ...(relayModalButtons && relayModalButtons.length > 0 ? { modalButtons: relayModalButtons } : {}),
+        ...(payload.result && typeof payload.result === 'object' && !Array.isArray(payload.result) ? { result: payload.result } : {}),
+        ...(payload.completionDiagnostic && typeof payload.completionDiagnostic === 'object' && !Array.isArray(payload.completionDiagnostic) ? { completionDiagnostic: payload.completionDiagnostic } : {}),
+        ...(payload.workerResult && typeof payload.workerResult === 'object' && !Array.isArray(payload.workerResult) ? { workerResult: payload.workerResult } : {}),
+        ...(payload.meshWorkerResult && typeof payload.meshWorkerResult === 'object' && !Array.isArray(payload.meshWorkerResult) ? { meshWorkerResult: payload.meshWorkerResult } : {}),
+        ...(payload.structuredResult && typeof payload.structuredResult === 'object' && !Array.isArray(payload.structuredResult) ? { structuredResult: payload.structuredResult } : {}),
+        ...(payload.timestamp !== undefined ? { timestamp: payload.timestamp } : {}),
+        intentional: payload.intentional === true,
+        intentionalStop: payload.intentionalStop === true,
+        operatorCleanup: payload.operatorCleanup === true,
+        reason: readNonEmptyString(payload.reason),
+        stopReason: readNonEmptyString(payload.stopReason),
+        cleanupReason: readNonEmptyString(payload.cleanupReason),
+        source: readNonEmptyString(payload.source),
+    };
+}
+
 export function handleMeshForwardEvent(components: DaemonComponents, payload: Record<string, unknown>) {
     const eventName = readNonEmptyString(payload.event);
     if (!isMeshCoordinatorEvent(eventName)) {
@@ -2184,73 +2309,13 @@ export function handleMeshForwardEvent(components: DaemonComponents, payload: Re
         event: eventName,
     });
     const nodeLabel = nodeId ? `Node '${nodeId}'` : workspace ? `Agent at ${workspace}` : 'Remote agent';
-    const relayModalMessage = readNonEmptyString(payload.modalMessage);
-    const relayModalButtons = Array.isArray(payload.modalButtons)
-        ? (payload.modalButtons as unknown[]).filter((b): b is string => typeof b === 'string' && b.trim().length > 0)
-        : null;
 
     return injectMeshSystemMessage(components, {
         meshId,
         nodeId,
         nodeLabel,
         event: eventName,
-        metadataEvent: {
-            targetSessionId: readNonEmptyString(payload.targetSessionId) || readNonEmptyString(payload.sessionId) || readNonEmptyString(payload.instanceId),
-            providerType: readNonEmptyString(payload.providerType),
-            providerSessionId: readNonEmptyString(payload.providerSessionId),
-            // Preserve the originating coordinator SESSION id across the machine boundary so
-            // the completion routes back to the exact coordinator session (multi-coordinator).
-            // buildForwardPayloadFromPending spreads the worker event's metadata, so the id
-            // arrives as payload.meshCoordinatorSessionId; the top-level targetCoordinatorSessionId
-            // is also accepted as a fallback. injectMeshSystemMessage re-derives the routing
-            // anchors from this. Absent → daemon-level fallback (version-skew safe).
-            meshCoordinatorSessionId: readNonEmptyString(payload.meshCoordinatorSessionId) || readNonEmptyString(payload.targetCoordinatorSessionId),
-            // Carry the session identity fields the worker provider event emits so the
-            // coordinator's mirror (updateMeshOwnedSession) gets a real workspace/title/
-            // settings. Without these the remote-relay hop reconstructs metadataEvent with
-            // an empty workspace, and the dashboard flaps to the generic
-            // "Terminal (Mesh Node)" title (and degrades the provider label) between live
-            // events and the periodic get_status_metadata snapshot. The local in-process
-            // forward path (onMeshCoordinatorEventForwarded) already preserves these; this
-            // mirrors them for the remote-only relay path.
-            workspace: readNonEmptyString(payload.workspace) || readNonEmptyString(payload.workspaceName),
-            workspaceName: readNonEmptyString(payload.workspaceName) || readNonEmptyString(payload.workspace),
-            sessionTitle: readNonEmptyString(payload.sessionTitle),
-            sessionStatus: readNonEmptyString(payload.sessionStatus),
-            sessionChatStatus: readNonEmptyString(payload.sessionChatStatus),
-            providerName: readNonEmptyString(payload.providerName),
-            ...(payload.sessionSettings && typeof payload.sessionSettings === 'object' && !Array.isArray(payload.sessionSettings) ? { sessionSettings: payload.sessionSettings } : {}),
-            finalSummary: readNonEmptyString(payload.finalSummary) || readNonEmptyString(payload.summary),
-            // T2: carry the worker's status-snapshot last-message preview across the machine
-            // boundary so a summary-less completion still surfaces the assistant reply in the
-            // coordinator's inbox mirror. resolveMeshSurfacedSessionPreview reads these
-            // (assistant-role only) when finalSummary is absent.
-            lastMessagePreview: readNonEmptyString(payload.lastMessagePreview),
-            lastMessageRole: readNonEmptyString(payload.lastMessageRole),
-            ...(payload.lastMessageAt !== undefined ? { lastMessageAt: payload.lastMessageAt } : {}),
-            jobId: readNonEmptyString(payload.jobId),
-            interactionId: readNonEmptyString(payload.interactionId),
-            status: readNonEmptyString(payload.status),
-            targetDaemonId: readNonEmptyString(payload.targetDaemonId),
-            startedAt: readNonEmptyString(payload.startedAt),
-            completedAt: readNonEmptyString(payload.completedAt),
-            retryOfJobId: readNonEmptyString(payload.retryOfJobId),
-            ...(relayModalMessage ? { modalMessage: relayModalMessage } : {}),
-            ...(relayModalButtons && relayModalButtons.length > 0 ? { modalButtons: relayModalButtons } : {}),
-            ...(payload.result && typeof payload.result === 'object' && !Array.isArray(payload.result) ? { result: payload.result } : {}),
-            ...(payload.completionDiagnostic && typeof payload.completionDiagnostic === 'object' && !Array.isArray(payload.completionDiagnostic) ? { completionDiagnostic: payload.completionDiagnostic } : {}),
-            ...(payload.workerResult && typeof payload.workerResult === 'object' && !Array.isArray(payload.workerResult) ? { workerResult: payload.workerResult } : {}),
-            ...(payload.meshWorkerResult && typeof payload.meshWorkerResult === 'object' && !Array.isArray(payload.meshWorkerResult) ? { meshWorkerResult: payload.meshWorkerResult } : {}),
-            ...(payload.structuredResult && typeof payload.structuredResult === 'object' && !Array.isArray(payload.structuredResult) ? { structuredResult: payload.structuredResult } : {}),
-            ...(payload.timestamp !== undefined ? { timestamp: payload.timestamp } : {}),
-            intentional: payload.intentional === true,
-            intentionalStop: payload.intentionalStop === true,
-            operatorCleanup: payload.operatorCleanup === true,
-            reason: readNonEmptyString(payload.reason),
-            stopReason: readNonEmptyString(payload.stopReason),
-            cleanupReason: readNonEmptyString(payload.cleanupReason),
-            source: readNonEmptyString(payload.source),
-        },
+        metadataEvent: buildRelayMetadataEvent(payload),
     });
 }
 

package/src/providers/cli-provider-instance.ts

@@ -24,7 +24,7 @@ import { LOG } from '../logging/logger.js';
 import { traceMeshEventStage, traceMeshEventDrop } from '../mesh/mesh-event-trace.js';
 import type { ChatMessage } from '../types.js';
 import { buildPersistedProviderEffectMessage, normalizeProviderEffects } from './control-effects.js';
-import { formatAutoApprovalMessage, pickApprovalButton, pickAutoApprovalButton, looksLikeActiveApprovalPromptText } from './approval-utils.js';
+import { formatAutoApprovalMessage, pickApprovalButton, hasNegativeApprovalOption, looksLikeActiveApprovalPromptText } from './approval-utils.js';
 import { getCliScriptCommand, parseCliScriptResult } from './cli-script-results.js';
 import { mergeProviderPatchState, resolveProviderStateSurface } from './provider-patch-state.js';
 import { normalizeProviderSessionId } from './provider-session-id.js';
@@ -1622,10 +1622,34 @@ export class CliProviderInstance implements ProviderInstance {
         if (!modal || buttons.length === 0) {
             return autoApproveActive;
         }
-        const { index: buttonIndex, label: buttonLabel } = pickAutoApprovalButton(buttons);
-        if (buttonIndex < 0) {
-            // No concrete button matched — don't pick a random index, just
-            // surface the modal so the user can decide.
+        // Picker/confirm exclusion (provider-common). A /model or /mode picker is
+        // surfaced with status=waiting_approval so the dashboard shows it, but it
+        // has no "correct" answer to auto-pick — blindly selecting the first
+        // option silently switches the model (the "always Opus, before I even
+        // choose" bug). Two independent gates, BOTH must pass to fire:
+        //
+        //   (1) modal_kind — the spec/FSM tells us this is an 'approval' modal,
+        //       not a 'picker'/'confirm'. A modal whose kind is unknown (legacy
+        //       adapter, or a spec that predates modal_kind) reads as 'approval'
+        //       so genuine approvals keep auto-approving; only an explicit
+        //       'picker'/'confirm' is excluded here.
+        //   (2) structural anchor — a real approval offers an affirmative AND a
+        //       decline option (pickApprovalButton finds a positive that isn't a
+        //       decline, and hasNegativeApprovalOption confirms a No/Cancel/Deny
+        //       is present). A model picker ("1. Default  2. Opus  3. Sonnet")
+        //       has no decline, so even an un-migrated picker is caught here.
+        //
+        // Mirrors the SDK v1 detect-status approval heuristic (detect-status.ts).
+        const modalKind = typeof modal?.kind === 'string' ? modal.kind : 'approval';
+        if (modalKind !== 'approval') {
+            // Picker/confirm — leave it for the user; keep the modal surfaced.
+            return autoApproveActive;
+        }
+        const { index: buttonIndex, label: buttonLabel } = pickApprovalButton(buttons, this.provider);
+        if (buttonIndex < 0 || !hasNegativeApprovalOption(buttons)) {
+            // No affirmative matched, or no decline option present (→ not a real
+            // consent prompt, e.g. a picker that slipped past the kind gate).
+            // Surface the modal so the user decides; never pick blindly.
             return autoApproveActive;
         }
         // Modal *identity* signature — the question/button set only, NO volatile

package/src/providers/spec/cli-adapter.ts

@@ -75,7 +75,7 @@ export class SpecCliAdapter implements CliAdapter {
     };
     private lastEvent: DashboardEvent | null = null;
     private latestState: { id: string; label: string; title: string | null; status: 'idle' | 'generating' | 'approval' } | null = null;
-    private latestModal: { title: string | null; buttons: { index: number; label: string }[] } | null = null;
+    private latestModal: { title: string | null; buttons: { index: number; label: string }[]; kind?: 'approval' | 'picker' | 'confirm' | null } | null = null;
     private statusCallback: (() => void) | null = null;
     private ptyDataCallback: ((data: string) => void) | null = null;
     private partialResponse = '';
@@ -193,8 +193,10 @@ export class SpecCliAdapter implements CliAdapter {
                 messages: [],
                 // Surface buttons when we have them; an approval state with no parsed
                 // modal this frame still stays waiting_approval (no activeModal yet).
+                // `kind` carries the semantic modal class through to the auto-approve
+                // gate so a /model picker (kind='picker') is never auto-answered.
                 activeModal: modal
-                    ? { message: modal.title ?? state.label, buttons: modal.buttons.map(b => b.label) }
+                    ? { message: modal.title ?? state.label, buttons: modal.buttons.map(b => b.label), kind: modal.kind ?? null }
                     : null,
                 activeInteractivePrompt: this.activeInteractivePrompt,
                 ...sessionFields,

package/src/providers/spec/fsm-driver.ts

@@ -32,7 +32,7 @@ import {
 import { evaluateFsm, type FsmClock, type TransitionEval, type FsmEvaluation } from './fsm-evaluator.js';
 import {
     type CliSpecV4, type FsmState, type FsmTransition,
-    initialState, stateById, statusForState, outgoingTransitions,
+    initialState, stateById, statusForState, modalKindForState, outgoingTransitions,
 } from './fsm-types.js';
 import { loadFsmSpec } from './fsm-loader.js';
 import { applyPreLaunchTrust } from './pre-launch-trust.js';
@@ -44,7 +44,7 @@ import { LOG } from '../../logging/logger.js';
 export type DashboardEvent =
     | { kind: 'pty_data'; chunk: string }
     | { kind: 'state_changed'; state: { id: string; label: string; title: string | null; status: 'idle' | 'generating' | 'approval' };
-        modal: { title: string | null; buttons: { index: number; label: string }[] } | null;
+        modal: { title: string | null; buttons: { index: number; label: string }[]; kind: 'approval' | 'picker' | 'confirm' | null } | null;
         controls: { id: string; label: string; action_type: string }[] }
     | { kind: 'notification'; id: string; title: string; body: string }
     | { kind: 'delegate'; id: string; task: string }
@@ -694,7 +694,12 @@ export class FsmDriver implements ISpecDriver {
             this.emit({
                 kind: 'state_changed',
                 state: next.state,
-                modal: next.modal ? { title: next.modal.title, buttons: next.modal.buttons.map(b => ({ index: b.index, label: b.label })) } : null,
+                // kind is the SEMANTIC modal class (approval vs picker/confirm)
+                // derived from the FSM state, NOT from the parsed buttons — the
+                // status field already collapsed it to 'approval' so the modal is
+                // surfaced. The auto-approve worker needs the distinction back to
+                // avoid answering a /model picker on the user's behalf.
+                modal: next.modal ? { title: next.modal.title, buttons: next.modal.buttons.map(b => ({ index: b.index, label: b.label })), kind: modalKindForState(state) } : null,
                 controls: next.controls.map(c => ({ id: c.id, label: c.label, action_type: c.actionType })),
             });
             this.fireNotifications(state.id, title);

package/src/providers/spec/fsm-types.ts

@@ -88,6 +88,27 @@ export interface FsmState {
     /** Modal states (approval/picker) expose modal buttons in the UI and are
      *  treated as "interesting" — the dashboard surfaces them distinctly. */
     modal?: boolean;
+    /**
+     * For a modal state, what KIND of modal it is — the semantic distinction the
+     * status field (always 'approval' for any modal, so the dashboard surfaces it)
+     * deliberately loses. The auto-approve worker uses this to decide whether it
+     * may answer the modal on the user's behalf:
+     *
+     *   - 'approval' — a tool/command/trust consent prompt ("Allow Bash?",
+     *     "Trust this folder?"). Auto-approve MAY fire (a background mesh worker
+     *     should not stall on these).
+     *   - 'picker'   — a selection menu the user opened (/model, /mode, …). There
+     *     is no "correct" answer to auto-pick; blindly selecting the first option
+     *     silently changes the model/mode. Auto-approve must NOT fire — the user
+     *     chooses.
+     *   - 'confirm'  — a non-consent yes/no the user must decide. Left to the user.
+     *
+     * Defaults to 'approval' for a modal state that omits it (preserves the
+     * pre-existing "auto-approve any modal" behaviour for un-migrated specs;
+     * picker/confirm states declare their kind explicitly). Non-modal states
+     * have no modal_kind.
+     */
+    modal_kind?: 'approval' | 'picker' | 'confirm';
     /** Status this state maps to for the dashboard/cli-adapter status field.
      *  One of: idle | generating | approval. Defaults: modal→approval,
      *  initial→idle, id==='busy'→generating, else idle. Explicit wins. */
@@ -236,3 +257,17 @@ export function statusForState(state: FsmState): 'idle' | 'generating' | 'approv
     if (state.id === 'busy' || state.id === 'generating') return 'generating';
     return 'idle';
 }
+
+/**
+ * The modal kind for a state, or null when the state is not modal. A modal state
+ * that omits `modal_kind` defaults to 'approval' so the established
+ * auto-approve-any-modal behaviour is preserved for specs that have not yet
+ * declared a kind; picker/confirm states must opt out by declaring their kind.
+ * This is the value the cli-adapter carries on `activeModal.kind` and the
+ * auto-approve gate reads — see cli-provider-instance.maybeAutoApproveStatus.
+ */
+export function modalKindForState(state: FsmState): 'approval' | 'picker' | 'confirm' | null {
+    if (state.modal_kind) return state.modal_kind;
+    if (state.modal) return 'approval';
+    return null;
+}