@adhdev/daemon-core 0.9.82-rc.384 → 0.9.82-rc.386

package/dist/mesh/mesh-events.d.ts

@@ -1,6 +1,6 @@
 export type { PendingMeshCoordinatorEvent } from './mesh-events-pending.js';
 export { queuePendingMeshCoordinatorEvent, drainPendingMeshCoordinatorEvents, getPendingMeshCoordinatorEvents, clearPendingMeshCoordinatorEvents, } from './mesh-events-pending.js';
 export { reconcileDirectDispatchCompletionFromTranscript, } from './mesh-events-stale.js';
-export { setupMeshReconcileLoop, runMeshReconcileTick, } from './mesh-reconcile-loop.js';
+export { setupMeshReconcileLoop, runMeshReconcileTick, resolveCoordinatorDrainDeliverability, shouldHoldPendingDrainForBusyLocalCoordinator, } from './mesh-reconcile-loop.js';
 export type { MeshQueueTriggerResult } from './mesh-events-coordinator.js';
 export { tryAssignQueueTask, triggerMeshQueue, handleMeshForwardEvent, setupMeshEventForwarding, isMeshCoordinatorEvent, __resetIdleAutoFastForwardForTests, __resetMeshWorkspaceCacheForTests, } from './mesh-events-coordinator.js';

package/dist/mesh/mesh-reconcile-loop.d.ts

@@ -1,4 +1,60 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
+/**
+ * DRAIN-WITHOUT-INJECT guard. Classify, for a mesh on THIS daemon, whether a
+ * queue-drain caller (the MCP `get_pending_mesh_events` poll) may safely consume
+ * pending coordinator events — i.e. whether there is a surface that will actually
+ * deliver them.
+ *
+ * Root cause being guarded: `get_pending_mesh_events` marks rows drained=1
+ * atomically and unconditionally. When the live CLI coordinator for the mesh is
+ * GENERATING (or modal-parked), the reconcile loop correctly HOLDS its terminal
+ * events (drained=0) for the coordinator's next idle tick — but a concurrent MCP
+ * poll draining the SAME queue consumes those held rows into a tool result that
+ * the busy coordinator never surfaces as a turn, so the completion is lost
+ * forever (drained=1, never re-queued). The reconcile loop is the authoritative
+ * delivery path for a live CLI coordinator; the MCP poll must defer to it.
+ *
+ * Returns:
+ *  - hasLiveCliCoordinator: a CLI session with meshCoordinatorFor === meshId
+ *    exists on this daemon (the reconcile loop owns its delivery).
+ *  - deliverableNow: there is an IDLE live CLI coordinator (reconcile would
+ *    full-drain into it) — draining now is safe and equivalent.
+ *  - holdForReconcile: a live CLI coordinator exists but is non-idle
+ *    (generating / modal-parked). The MCP poll MUST NOT drain; the reconcile
+ *    loop holds the events undrained and injects them on the next idle tick.
+ *
+ * A mesh with NO live CLI coordinator on this daemon is a pure stdio MCP / LLM
+ * coordinator: the MCP tool result IS the only surface, so the poll legitimately
+ * drains (holdForReconcile=false). No regression to that path.
+ */
+export declare function resolveCoordinatorDrainDeliverability(components: Pick<DaemonComponents, 'instanceManager'>, meshId: string): {
+    hasLiveCliCoordinator: boolean;
+    deliverableNow: boolean;
+    holdForReconcile: boolean;
+};
+/**
+ * DRAIN-WITHOUT-INJECT guard for the `get_pending_mesh_events` daemon handler.
+ *
+ * Decides whether an incoming pending-events DRAIN must be held (return nothing,
+ * leave rows drained=0) because the only surface for those events is a LOCAL live
+ * CLI coordinator that is currently busy (generating / modal-parked) — in which
+ * case the reconcile loop owns delivery on the coordinator's next idle tick, and
+ * the poll draining them now would lose them.
+ *
+ * The hold applies ONLY when BOTH:
+ *   1) a live CLI coordinator for this mesh on THIS daemon is non-idle, AND
+ *   2) the drain is targeted at THIS daemon (the requested coordinatorDaemonId is
+ *      empty/broadcast, or matches one of this daemon's id forms).
+ *
+ * A REMOTE coordinator pulling our worker's events passes its own (remote)
+ * coordinatorDaemonId — condition (2) is false — so the drain proceeds and the
+ * remote pull is never blocked by our local coordinator's busy state. A pure
+ * stdio MCP coordinator (no live CLI session) never satisfies (1), so its tool
+ * result remains the surface and the drain proceeds. No regression to either.
+ */
+export declare function shouldHoldPendingDrainForBusyLocalCoordinator(components: Pick<DaemonComponents, 'instanceManager'> & {
+    statusInstanceId?: string;
+}, meshId: string, requestedCoordinatorDaemonId?: string | null): boolean;
 export declare function runMeshReconcileTick(components: DaemonComponents): Promise<void>;
 export declare function __resetUnresolvedForwardRejectionCountsForTests(): void;
 interface ReconcileLoopHandle {

package/dist/providers/cli-provider-instance.d.ts

@@ -66,6 +66,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private context;
     private events;
     private lastStatus;
+    private agentReadyEmitted;
     private generatingStartedAt;
     private settings;
     private monitor;
@@ -220,6 +221,13 @@ export declare class CliProviderInstance implements ProviderInstance {
      * the approval decision; the next real PTY frame refreshes visible status.
      */
     private recheckAutoApproveSettled;
+    /**
+     * Emit the queue-claim agent:ready event at most once per session. Both the
+     * boot-time starting→idle one-shot and the fsmReadySeen re-arm call this; the
+     * agentReadyEmitted guard ensures the second caller is a no-op so a worker is
+     * never claimed twice and a queued task is never double-dispatched.
+     */
+    private emitAgentReadyOnce;
     private detectStatusTransition;
     private pushEvent;
     private flushEvents;

package/dist/providers/spec/fsm-driver.d.ts

@@ -134,6 +134,7 @@ export interface ISpecDriver {
     }> | null;
     getLastBusyAt(): number;
     hasIdleHoldPending(): boolean;
+    hasSeenReady(): boolean;
     getCompletionIdleDebounceState(): {
         active: boolean;
         ageMs: number;
@@ -264,6 +265,15 @@ export declare class FsmDriver implements ISpecDriver {
      *  working without branching on driver type. */
     getLastBusyAt(): number;
     hasIdleHoldPending(): boolean;
+    /**
+     * True once the machine has reached its first non-initial idle state (the
+     * prompt is genuinely drawn — see maybeMarkReady). The cli-adapter surfaces
+     * this on its idle status so CliProviderInstance can re-arm the queue-claim
+     * agent:ready on the first genuine ready, independent of the boot-time
+     * starting→idle one-shot (which is consumed too early for specs whose
+     * initial state already reports idle).
+     */
+    hasSeenReady(): boolean;
     getCompletionIdleDebounceState(): {
         active: boolean;
         ageMs: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.384",
+  "version": "0.9.82-rc.386",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.384",
+    "@adhdev/mesh-shared": "0.9.82-rc.386",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/cli-adapter-types.ts

@@ -28,6 +28,18 @@ export interface CliAdapterStatus {
     providerSessionId?: string;
     errorMessage?: string;
     errorReason?: string;
+    /**
+     * FSM-spec adapters only: true once the driver has observed its first
+     * non-initial idle state (the prompt is genuinely drawn — see
+     * FsmDriver.maybeMarkReady / readySeenOnce). Used by CliProviderInstance to
+     * re-arm the queue-claim `agent:ready` event on the first genuine ready,
+     * independent of the boot-time starting→idle one-shot. That one-shot is
+     * consumed too early for providers whose INITIAL FSM state already reports
+     * status 'idle' (e.g. antigravity-cli), so without this re-arm the worker
+     * never claims its queued task and the coordinator relaunch-loops. Absent
+     * (undefined) for non-FSM adapters — they keep the boot one-shot behavior.
+     */
+    fsmReadySeen?: boolean;
 }
 
 export interface AcpAdapterHandle {

package/src/cli-adapters/provider-cli-shared.ts

@@ -60,6 +60,17 @@ export interface CliSessionStatus {
     errorMessage?: string;
     errorReason?: string;
     providerSessionId?: string;
+    /**
+     * Spec/FSM adapters only (SpecCliAdapter): true once the driver has observed
+     * its first non-initial idle state — the prompt is genuinely drawn. The
+     * legacy ProviderCliAdapter never sets it (undefined). CliProviderInstance
+     * uses it to re-arm the queue-claim agent:ready on the first genuine ready,
+     * independent of the boot-time starting→idle one-shot (which is consumed too
+     * early for specs whose initial state already reports status 'idle', e.g.
+     * antigravity-cli — without the re-arm the worker never claims its queued
+     * task and the coordinator relaunch-loops).
+     */
+    fsmReadySeen?: boolean;
     /**
      * Timestamp (ms) of the most recent raw PTY output chunk. Advances on every
      * byte the process emits, including tool/build output that produces no

package/src/commands/high-family/mesh-events.ts

@@ -10,6 +10,7 @@
 import {
     handleMeshForwardEvent,
     drainPendingMeshCoordinatorEvents,
+    shouldHoldPendingDrainForBusyLocalCoordinator,
 } from '../../mesh/mesh-events.js';
 import { normalizeInteractivePromptResponse } from '../../providers/types/interactive-prompt.js';
 import type { HighFamilyContext, HighFamilyHandler } from './types.js';
@@ -19,7 +20,7 @@ export const meshEventsHandlers: Record<string, HighFamilyHandler> = {
         return handleMeshForwardEvent({ instanceManager: ctx.deps.instanceManager } as any, args as Record<string, unknown>);
     },
 
-    get_pending_mesh_events: async (_ctx: HighFamilyContext, args: any) => {
+    get_pending_mesh_events: async (ctx: HighFamilyContext, args: any) => {
         const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
         // (B3) Respect coordinatorDaemonId when the caller declares it
         // so unicast events route to the right coordinator instead of
@@ -27,6 +28,17 @@ export const meshEventsHandlers: Record<string, HighFamilyHandler> = {
         const coordinatorDaemonId = typeof args?.coordinatorDaemonId === 'string' && args.coordinatorDaemonId.trim()
             ? args.coordinatorDaemonId.trim()
             : undefined;
+        // DRAIN-WITHOUT-INJECT guard: when a LOCAL live CLI coordinator for this mesh is
+        // busy (generating / modal-parked), the reconcile loop is HOLDING its terminal
+        // events (drained=0) for the coordinator's next idle tick. Draining here would
+        // consume those held rows (drained=1) into an MCP tool result the busy coordinator
+        // never surfaces as a turn — losing the completion forever. Defer to the reconcile
+        // loop: return nothing, leaving the rows undrained for its idle-tick delivery. A
+        // remote pull (foreign coordinatorDaemonId) or a pure stdio MCP coordinator (no live
+        // CLI session) is NOT held — see shouldHoldPendingDrainForBusyLocalCoordinator.
+        if (meshId && shouldHoldPendingDrainForBusyLocalCoordinator(ctx.deps, meshId, coordinatorDaemonId)) {
+            return { success: true, events: [], heldForBusyLocalCoordinator: true };
+        }
         const events = drainPendingMeshCoordinatorEvents(meshId || undefined, coordinatorDaemonId);
         return { success: true, events };
     },

package/src/mesh/mesh-events.ts

@@ -20,6 +20,8 @@ export {
 export {
     setupMeshReconcileLoop,
     runMeshReconcileTick,
+    resolveCoordinatorDrainDeliverability,
+    shouldHoldPendingDrainForBusyLocalCoordinator,
 } from './mesh-reconcile-loop.js';
 
 export type { MeshQueueTriggerResult } from './mesh-events-coordinator.js';

package/src/mesh/mesh-reconcile-loop.ts

@@ -248,6 +248,90 @@ function findLiveCoordinators(components: DaemonComponents): LiveCoordinator[] {
     return out;
 }
 
+/**
+ * DRAIN-WITHOUT-INJECT guard. Classify, for a mesh on THIS daemon, whether a
+ * queue-drain caller (the MCP `get_pending_mesh_events` poll) may safely consume
+ * pending coordinator events — i.e. whether there is a surface that will actually
+ * deliver them.
+ *
+ * Root cause being guarded: `get_pending_mesh_events` marks rows drained=1
+ * atomically and unconditionally. When the live CLI coordinator for the mesh is
+ * GENERATING (or modal-parked), the reconcile loop correctly HOLDS its terminal
+ * events (drained=0) for the coordinator's next idle tick — but a concurrent MCP
+ * poll draining the SAME queue consumes those held rows into a tool result that
+ * the busy coordinator never surfaces as a turn, so the completion is lost
+ * forever (drained=1, never re-queued). The reconcile loop is the authoritative
+ * delivery path for a live CLI coordinator; the MCP poll must defer to it.
+ *
+ * Returns:
+ *  - hasLiveCliCoordinator: a CLI session with meshCoordinatorFor === meshId
+ *    exists on this daemon (the reconcile loop owns its delivery).
+ *  - deliverableNow: there is an IDLE live CLI coordinator (reconcile would
+ *    full-drain into it) — draining now is safe and equivalent.
+ *  - holdForReconcile: a live CLI coordinator exists but is non-idle
+ *    (generating / modal-parked). The MCP poll MUST NOT drain; the reconcile
+ *    loop holds the events undrained and injects them on the next idle tick.
+ *
+ * A mesh with NO live CLI coordinator on this daemon is a pure stdio MCP / LLM
+ * coordinator: the MCP tool result IS the only surface, so the poll legitimately
+ * drains (holdForReconcile=false). No regression to that path.
+ */
+export function resolveCoordinatorDrainDeliverability(
+    components: Pick<DaemonComponents, 'instanceManager'>,
+    meshId: string,
+): { hasLiveCliCoordinator: boolean; deliverableNow: boolean; holdForReconcile: boolean } {
+    const coordinators = findLiveCoordinators(components as DaemonComponents).filter(c => c.meshId === meshId);
+    if (coordinators.length === 0) {
+        return { hasLiveCliCoordinator: false, deliverableNow: false, holdForReconcile: false };
+    }
+    const hasIdle = coordinators.some(c => c.idle);
+    return {
+        hasLiveCliCoordinator: true,
+        deliverableNow: hasIdle,
+        // A live CLI coordinator exists but none is idle → the reconcile loop is
+        // holding the events; the poll must not steal them.
+        holdForReconcile: !hasIdle,
+    };
+}
+
+/**
+ * DRAIN-WITHOUT-INJECT guard for the `get_pending_mesh_events` daemon handler.
+ *
+ * Decides whether an incoming pending-events DRAIN must be held (return nothing,
+ * leave rows drained=0) because the only surface for those events is a LOCAL live
+ * CLI coordinator that is currently busy (generating / modal-parked) — in which
+ * case the reconcile loop owns delivery on the coordinator's next idle tick, and
+ * the poll draining them now would lose them.
+ *
+ * The hold applies ONLY when BOTH:
+ *   1) a live CLI coordinator for this mesh on THIS daemon is non-idle, AND
+ *   2) the drain is targeted at THIS daemon (the requested coordinatorDaemonId is
+ *      empty/broadcast, or matches one of this daemon's id forms).
+ *
+ * A REMOTE coordinator pulling our worker's events passes its own (remote)
+ * coordinatorDaemonId — condition (2) is false — so the drain proceeds and the
+ * remote pull is never blocked by our local coordinator's busy state. A pure
+ * stdio MCP coordinator (no live CLI session) never satisfies (1), so its tool
+ * result remains the surface and the drain proceeds. No regression to either.
+ */
+export function shouldHoldPendingDrainForBusyLocalCoordinator(
+    components: Pick<DaemonComponents, 'instanceManager'> & { statusInstanceId?: string },
+    meshId: string,
+    requestedCoordinatorDaemonId?: string | null,
+): boolean {
+    if (!meshId) return false;
+    const deliverability = resolveCoordinatorDrainDeliverability(components, meshId);
+    if (!deliverability.holdForReconcile) return false;
+    // The local CLI coordinator is busy. Hold only when the drain is for THIS daemon.
+    const requested = readNonEmptyString(requestedCoordinatorDaemonId);
+    if (!requested) return true; // broadcast drain → would consume the held local events
+    const localIds = expandDaemonIdForms([
+        readNonEmptyString((components as { statusInstanceId?: string }).statusInstanceId),
+        readNonEmptyString(loadConfig().machineId),
+    ]);
+    return localIds.some(id => daemonIdsEquivalent(id, requested));
+}
+
 // Inject a drained pending event into a live coordinator session. Force-inject
 // events carry force:true so they bypass the busy send-guard and land in the PTY
 // even while the coordinator is generating (see shouldForceInjectMeshEvent).

package/src/providers/cli-provider-instance.ts

@@ -430,6 +430,14 @@ export class CliProviderInstance implements ProviderInstance {
     private context: InstanceContext | null = null;
     private events: ProviderEvent[] = [];
     private lastStatus: string = 'starting';
+    // Idempotency guard for the queue-claim agent:ready event. agent:ready is the
+    // sole signal the mesh coordinator's tryAssignQueueTask waits on to hand a
+    // queued task to this worker. It is emitted in two places: the boot-time
+    // starting→idle one-shot, and the readySeen re-arm below. This flag makes the
+    // event fire AT MOST ONCE per session so a worker is never claimed twice and a
+    // queued task is never double-dispatched/double-injected. Whichever path fires
+    // first sets it; the other becomes a no-op.
+    private agentReadyEmitted = false;
     private generatingStartedAt: number = 0;
     private settings: Record<string, any> = {};
     private monitor: StatusMonitor;
@@ -1920,6 +1928,18 @@ export class CliProviderInstance implements ProviderInstance {
         } catch { /* adapter gone / transient — next frame retries */ }
     }
 
+    /**
+     * Emit the queue-claim agent:ready event at most once per session. Both the
+     * boot-time starting→idle one-shot and the fsmReadySeen re-arm call this; the
+     * agentReadyEmitted guard ensures the second caller is a no-op so a worker is
+     * never claimed twice and a queued task is never double-dispatched.
+     */
+    private emitAgentReadyOnce(chatTitle: string, now: number): void {
+        if (this.agentReadyEmitted) return;
+        this.agentReadyEmitted = true;
+        this.pushEvent({ event: 'agent:ready', chatTitle, timestamp: now });
+    }
+
     private detectStatusTransition(): void {
         const now = Date.now();
         // Status-change handling is a hot path: PTY output can fire it many times
@@ -2142,7 +2162,7 @@ export class CliProviderInstance implements ProviderInstance {
                     this.scheduleCompletedDebounceFlush(flushDelay);
                 }
             } else if (newStatus === 'idle' && this.lastStatus === 'starting') {
-                this.pushEvent({ event: 'agent:ready', chatTitle, timestamp: now });
+                this.emitAgentReadyOnce(chatTitle, now);
             } else if (newStatus === 'error') {
                 if (this.generatingDebounceTimer) { clearTimeout(this.generatingDebounceTimer); this.generatingDebounceTimer = null; }
                 this.generatingDebouncePending = null;
@@ -2171,6 +2191,28 @@ export class CliProviderInstance implements ProviderInstance {
             this.lastStatus = newStatus;
         }
 
+        // Re-arm the queue-claim agent:ready on the FSM's first GENUINE ready.
+        //
+        // The boot-time starting→idle one-shot above is the historical claim
+        // trigger, but it is consumed too early for FSM-spec providers whose
+        // INITIAL state already reports status 'idle' (e.g. antigravity-cli): the
+        // adapter reports idle before maybeMarkReady has fired, so lastStatus
+        // advances starting→idle while the prompt is not yet drawn and the worker
+        // cannot yet claim. Subsequent state-driven idle frames are idle→idle (no
+        // status change), so the one-shot never re-fires and the worker strands its
+        // queued task — the coordinator then relaunch-loops every ~90s.
+        //
+        // The adapter surfaces fsmReadySeen=true exactly when the FSM reaches its
+        // first non-initial idle (the prompt is genuinely up). On that signal we
+        // emit agent:ready once more. emitAgentReadyOnce is idempotent (guarded by
+        // agentReadyEmitted), so providers whose boot one-shot already landed on a
+        // real ready (claude-cli / codex-cli / hermes-cli, which use a startup
+        // grace and whose initial state is not idle) treat this as a no-op — no
+        // double claim, no double task injection.
+        if (newStatus === 'idle' && adapterStatus.fsmReadySeen === true && !this.agentReadyEmitted) {
+            this.emitAgentReadyOnce(chatTitle, now);
+        }
+
         this.applyProviderResponse(parsedStatus, {
             phase: (newStatus === 'idle' && (previousStatus === 'generating' || previousStatus === 'waiting_approval'))
                 ? 'turn_completed'

package/src/providers/spec/cli-adapter.ts

@@ -206,7 +206,12 @@ export class SpecCliAdapter implements CliAdapter {
         if (state.status === 'generating') {
             return { status: 'generating', messages: [], activeModal: null, activeInteractivePrompt: this.activeInteractivePrompt, ...sessionFields };
         }
-        return { status: 'idle', messages: [], activeModal: null, activeInteractivePrompt: this.activeInteractivePrompt, ...sessionFields };
+        // fsmReadySeen lets CliProviderInstance re-arm the queue-claim agent:ready
+        // on the first genuine ready (prompt drawn), independent of the boot-time
+        // starting→idle one-shot that the provider-instance otherwise relies on.
+        // Surfaced only on idle so the provider-instance fires agent:ready exactly
+        // when the worker is actually ready to claim.
+        return { status: 'idle', messages: [], activeModal: null, activeInteractivePrompt: this.activeInteractivePrompt, fsmReadySeen: this.driver.hasSeenReady?.() ?? false, ...sessionFields };
     }
 
     private maybeRefreshNativeHistory(): void {

package/src/providers/spec/fsm-driver.ts

@@ -125,6 +125,7 @@ export interface ISpecDriver {
     getSections(): Array<{ id: string; text: string }> | null;
     getLastBusyAt(): number;
     hasIdleHoldPending(): boolean;
+    hasSeenReady(): boolean;
     getCompletionIdleDebounceState(): { active: boolean; ageMs: number; holdMs: number; forceAfterMs: number } | null;
     getFsmDebug?(): unknown;
     getFsmSnapshotHistory?(): ReadonlyArray<FsmSnapshotEntry>;
@@ -466,6 +467,17 @@ export class FsmDriver implements ISpecDriver {
         // Report true while any outgoing transition is hold-blocked.
         return (this.lastFsmEval?.transitions ?? []).some(t => !t.holdSatisfied && t.condResult);
     }
+    /**
+     * True once the machine has reached its first non-initial idle state (the
+     * prompt is genuinely drawn — see maybeMarkReady). The cli-adapter surfaces
+     * this on its idle status so CliProviderInstance can re-arm the queue-claim
+     * agent:ready on the first genuine ready, independent of the boot-time
+     * starting→idle one-shot (which is consumed too early for specs whose
+     * initial state already reports idle).
+     */
+    hasSeenReady(): boolean {
+        return this.readySeenOnce;
+    }
     getCompletionIdleDebounceState(): { active: boolean; ageMs: number; holdMs: number; forceAfterMs: number } | null {
         // Surface the busy→ready transition's stable countdown, if any, so the
         // existing panel field stays meaningful.