@adhdev/daemon-core 0.9.82-rc.385 → 0.9.82-rc.387

package/dist/providers/cli-provider-instance.d.ts

@@ -66,6 +66,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private context;
     private events;
     private lastStatus;
+    private agentReadyEmitted;
     private generatingStartedAt;
     private settings;
     private monitor;
@@ -220,6 +221,13 @@ export declare class CliProviderInstance implements ProviderInstance {
      * the approval decision; the next real PTY frame refreshes visible status.
      */
     private recheckAutoApproveSettled;
+    /**
+     * Emit the queue-claim agent:ready event at most once per session. Both the
+     * boot-time starting→idle one-shot and the fsmReadySeen re-arm call this; the
+     * agentReadyEmitted guard ensures the second caller is a no-op so a worker is
+     * never claimed twice and a queued task is never double-dispatched.
+     */
+    private emitAgentReadyOnce;
     private detectStatusTransition;
     private pushEvent;
     private flushEvents;

package/dist/providers/spec/fsm-driver.d.ts

@@ -134,6 +134,7 @@ export interface ISpecDriver {
     }> | null;
     getLastBusyAt(): number;
     hasIdleHoldPending(): boolean;
+    hasSeenReady(): boolean;
     getCompletionIdleDebounceState(): {
         active: boolean;
         ageMs: number;
@@ -264,6 +265,15 @@ export declare class FsmDriver implements ISpecDriver {
      *  working without branching on driver type. */
     getLastBusyAt(): number;
     hasIdleHoldPending(): boolean;
+    /**
+     * True once the machine has reached its first non-initial idle state (the
+     * prompt is genuinely drawn — see maybeMarkReady). The cli-adapter surfaces
+     * this on its idle status so CliProviderInstance can re-arm the queue-claim
+     * agent:ready on the first genuine ready, independent of the boot-time
+     * starting→idle one-shot (which is consumed too early for specs whose
+     * initial state already reports idle).
+     */
+    hasSeenReady(): boolean;
     getCompletionIdleDebounceState(): {
         active: boolean;
         ageMs: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.385",
+  "version": "0.9.82-rc.387",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.385",
+    "@adhdev/mesh-shared": "0.9.82-rc.387",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/cli-adapter-types.ts

@@ -28,6 +28,18 @@ export interface CliAdapterStatus {
     providerSessionId?: string;
     errorMessage?: string;
     errorReason?: string;
+    /**
+     * FSM-spec adapters only: true once the driver has observed its first
+     * non-initial idle state (the prompt is genuinely drawn — see
+     * FsmDriver.maybeMarkReady / readySeenOnce). Used by CliProviderInstance to
+     * re-arm the queue-claim `agent:ready` event on the first genuine ready,
+     * independent of the boot-time starting→idle one-shot. That one-shot is
+     * consumed too early for providers whose INITIAL FSM state already reports
+     * status 'idle' (e.g. antigravity-cli), so without this re-arm the worker
+     * never claims its queued task and the coordinator relaunch-loops. Absent
+     * (undefined) for non-FSM adapters — they keep the boot one-shot behavior.
+     */
+    fsmReadySeen?: boolean;
 }
 
 export interface AcpAdapterHandle {

package/src/cli-adapters/provider-cli-shared.ts

@@ -60,6 +60,17 @@ export interface CliSessionStatus {
     errorMessage?: string;
     errorReason?: string;
     providerSessionId?: string;
+    /**
+     * Spec/FSM adapters only (SpecCliAdapter): true once the driver has observed
+     * its first non-initial idle state — the prompt is genuinely drawn. The
+     * legacy ProviderCliAdapter never sets it (undefined). CliProviderInstance
+     * uses it to re-arm the queue-claim agent:ready on the first genuine ready,
+     * independent of the boot-time starting→idle one-shot (which is consumed too
+     * early for specs whose initial state already reports status 'idle', e.g.
+     * antigravity-cli — without the re-arm the worker never claims its queued
+     * task and the coordinator relaunch-loops).
+     */
+    fsmReadySeen?: boolean;
     /**
      * Timestamp (ms) of the most recent raw PTY output chunk. Advances on every
      * byte the process emits, including tool/build output that produces no

package/src/commands/med-family/mesh-crud.ts

@@ -422,6 +422,8 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                             worktreeCleanupFallback: typeof worktreeCleanup?.fallback === 'string' ? worktreeCleanup.fallback : undefined,
                             forced: worktreeCleanup?.forced === true ? true : undefined,
                             forceFallbackReason: typeof worktreeCleanup?.reason === 'string' ? worktreeCleanup.reason : undefined,
+                            branchRefDeleted: typeof worktreeCleanup?.branchRefDeleted === 'boolean' ? worktreeCleanup.branchRefDeleted : undefined,
+                            branchRefReason: typeof worktreeCleanup?.branchRefReason === 'string' ? worktreeCleanup.branchRefReason : undefined,
                         },
                     });
                 } catch { /* ledger append is best-effort */ }
@@ -434,6 +436,14 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                 ? worktreeCleanup.residueWarning
                 : undefined;
 
+            // Surface a preserved-branch warning at the top level so callers see
+            // that the branch ref was intentionally NOT deleted (unmerged work is
+            // never silently dropped). When the branch ref WAS deleted, the nested
+            // worktreeCleanup.branchRefDeleted flag already records it.
+            const branchRefWarning = typeof worktreeCleanup?.branchRefWarning === 'string'
+                ? worktreeCleanup.branchRefWarning
+                : undefined;
+
             // Orphan guard: if the session cleanup still left any LIVE session skipped
             // (e.g. a future skip reason, or a workspace-only session on a base node),
             // surface it at the top level so the caller knows a manual mesh_cleanup_sessions
@@ -451,6 +461,7 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                 success: true,
                 removed,
                 ...(residueWarning ? { residueWarning } : {}),
+                ...(branchRefWarning ? { branchRefWarning } : {}),
                 ...(sessionCleanup ? { sessionCleanup } : {}),
                 ...(worktreeCleanup ? { worktreeCleanup } : {}),
                 ...(orphanedSessionsRemaining

package/src/commands/router.ts

@@ -829,7 +829,7 @@ export class DaemonCommandRouter {
         node: any;
         nodeId: string;
         force?: boolean;
-    }): Promise<{ success: true; skipped?: boolean; removedPath?: string; repoRoot?: string; reason?: string; fallback?: string; forced?: boolean; convergence?: Record<string, unknown>; recovered?: boolean; residue?: boolean; residueWarning?: string; residueError?: string } | { success: false; code: string; error: string; recoveryHint: string; convergence?: Record<string, unknown> }> {
+    }): Promise<{ success: true; skipped?: boolean; removedPath?: string; repoRoot?: string; reason?: string; fallback?: string; forced?: boolean; convergence?: Record<string, unknown>; recovered?: boolean; residue?: boolean; residueWarning?: string; residueError?: string; branchRefDeleted?: boolean; branchRefReason?: string; branchRefForced?: boolean; branchRefWarning?: string } | { success: false; code: string; error: string; recoveryHint: string; convergence?: Record<string, unknown> }> {
         const workspace = typeof args.node?.workspace === 'string' ? args.node.workspace.trim() : '';
         if (!workspace) {
             return {
@@ -929,19 +929,62 @@ export class DaemonCommandRouter {
             };
         }
 
+        // Always evaluate real merge convergence so we can decide whether the
+        // branch ref is safe to delete after removal — even on the force path,
+        // where `force_override` only authorizes the *worktree* removal and must
+        // NOT be taken as proof the branch is merged (that would risk work loss).
+        const mergeConvergence = await this.getWorktreeForceCleanupConvergence({ repoRoot, workspace, node: args.node });
         const forceFallbackConvergence = args.force
             ? { allow: true, status: 'force_override', source: 'caller_force_flag' }
-            : await this.getWorktreeForceCleanupConvergence({ repoRoot, workspace, node: args.node });
+            : mergeConvergence;
+
+        // After the worktree is removed, delete the branch ref iff the branch is
+        // fully merged into the default ref (no work loss). Otherwise preserve it
+        // and surface a warning. `mergeConvergence` (NOT the force override) is the
+        // authority on merged-ness.
+        const deleteBranchIfMerged = async () => {
+            const branch = String(args.node.worktreeBranch).trim();
+            const status = mergeConvergence.allow ? (mergeConvergence.status || '') : '';
+            const MERGED_STATUSES = new Set([
+                'merged_to_main', 'merged_pushed', 'merged_to_default_ref', 'cleanup_candidate',
+            ]);
+            const PATCH_EQUIV_STATUS = 'patch_equivalent_to_default_ref';
+            if (!branch) {
+                return { branchRefDeleted: false, branchRefReason: 'empty_branch_name' };
+            }
+            if (!mergeConvergence.allow || (!MERGED_STATUSES.has(status) && status !== PATCH_EQUIV_STATUS)) {
+                return {
+                    branchRefDeleted: false,
+                    branchRefReason: `branch_not_merged_preserved: ${mergeConvergence.error || mergeConvergence.status || 'convergence_unverified'}`,
+                    branchRefWarning: `Branch ref '${branch}' was preserved (not deleted) because it is not confirmed merged into the default ref — no work was lost. Merge it (or pass a verified branchConvergence final state) and re-run cleanup, or delete it manually after confirming.`,
+                };
+            }
+            const { deleteBranchRef } = await import('../git/git-worktree.js');
+            // `-d` can detect a true fast-forward/merge; patch-equivalent landings
+            // (squash/cherry-pick) are invisible to `-d`, so allow the verified `-D`
+            // fallback only for the patch-equivalence status.
+            const res = await deleteBranchRef(repoRoot, branch, { safeDeleteOnly: status !== PATCH_EQUIV_STATUS });
+            return {
+                branchRefDeleted: res.deleted,
+                branchRefReason: res.reason,
+                ...(res.forced ? { branchRefForced: true } : {}),
+                ...(res.deleted ? {} : {
+                    branchRefWarning: `Branch ref '${branch}' could not be deleted (${res.reason}); it was preserved so no work is lost.`,
+                }),
+            };
+        };
 
         try {
             const result = await removeWorktree(repoRoot, workspace, {
                 requireClean: !args.force,
                 allowSubmoduleForceFallback: forceFallbackConvergence.allow,
             });
+            const branchOutcome = await deleteBranchIfMerged();
             return {
                 success: true,
                 removedPath: result.removedPath,
                 repoRoot,
+                ...branchOutcome,
                 ...(result.fallback ? {
                     fallback: result.fallback,
                     forced: result.forced,
@@ -969,10 +1012,12 @@ export class DaemonCommandRouter {
                     await execFileAsync('git', ['worktree', 'remove', '--force', workspace], {
                         cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_CLEANUP, maxBuffer: GIT_MAX_BUFFER_CLEANUP, windowsHide: true,
                     });
+                    const branchOutcome = await deleteBranchIfMerged();
                     return {
                         success: true,
                         removedPath: workspace,
                         repoRoot,
+                        ...branchOutcome,
                         fallback: 'git_worktree_remove_submodule_deinit' as const,
                         forced: true,
                         reason: 'working_trees_containing_submodules' as const,
@@ -990,10 +1035,12 @@ export class DaemonCommandRouter {
                             cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_CLEANUP, maxBuffer: GIT_MAX_BUFFER_CLEANUP, windowsHide: true,
                         });
                     } catch { /* prune is best-effort */ }
+                    const branchOutcome = await deleteBranchIfMerged();
                     return {
                         success: true,
                         removedPath: workspace,
                         repoRoot,
+                        ...branchOutcome,
                         fallback: 'fs_rm_worktree_prune' as const,
                         forced: true,
                         reason: 'working_trees_containing_submodules' as const,

package/src/git/git-worktree.ts

@@ -257,6 +257,74 @@ export function parseWorktreeListOutput(output: string): WorktreeEntry[] {
     return entries;
 }
 
+// ─── Branch ref deletion ────────────────────────
+
+export interface BranchRefDeleteResult {
+    /** True if the branch ref no longer exists after this call. */
+    deleted: boolean;
+    /** Why it was (not) deleted, for surfacing in the cleanup result. */
+    reason: string;
+    /** True when a forced delete (`-D`) was needed (e.g. squash/patch-equivalent merge). */
+    forced?: boolean;
+}
+
+/**
+ * Delete a local branch ref after its worktree was removed.
+ *
+ * SAFETY: this is only meant to be called once the caller has independently
+ * verified that the branch is fully merged / its content is contained in the
+ * default ref (no work loss). It first tries the safe `git branch -d`, which
+ * refuses to delete a branch git itself does not consider merged. If
+ * `safeDeleteOnly` is false (the caller proved containment by patch-equivalence,
+ * which `-d` cannot see), it falls back to `git branch -D`. When the branch is
+ * already gone, this reports `deleted: true` idempotently.
+ */
+export async function deleteBranchRef(
+    repoRoot: string,
+    branch: string,
+    opts: { safeDeleteOnly?: boolean } = {},
+): Promise<BranchRefDeleteResult> {
+    const name = (branch || '').trim();
+    if (!name) return { deleted: false, reason: 'empty_branch_name' };
+
+    // Idempotent: nothing to delete if the ref does not exist.
+    try {
+        await execFileAsync('git', ['rev-parse', '--verify', '--quiet', `refs/heads/${name}`], {
+            cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, windowsHide: true,
+        });
+    } catch {
+        return { deleted: true, reason: 'branch_ref_absent' };
+    }
+
+    // Try the safe delete first — git refuses if it cannot see the branch as merged.
+    try {
+        await execFileAsync('git', ['branch', '-d', name], {
+            cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, windowsHide: true,
+        });
+        return { deleted: true, reason: 'safe_deleted_merged_branch' };
+    } catch (error: any) {
+        const stderr = typeof error?.stderr === 'string' ? error.stderr : '';
+        const notMerged = /not fully merged/i.test(stderr) || /not fully merged/i.test(String(error?.message || ''));
+        if (!notMerged) {
+            return { deleted: false, reason: `branch_delete_failed: ${stderr.trim() || error?.message || 'unknown error'}` };
+        }
+        // git -d refused. Only force when the caller proved containment another way
+        // (e.g. squash/cherry-pick/patch-equivalent merge that -d cannot detect).
+        if (opts.safeDeleteOnly) {
+            return { deleted: false, reason: 'branch_not_merged_per_git_safe_delete_only' };
+        }
+        try {
+            await execFileAsync('git', ['branch', '-D', name], {
+                cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, windowsHide: true,
+            });
+            return { deleted: true, reason: 'force_deleted_patch_equivalent_branch', forced: true };
+        } catch (forceError: any) {
+            const fErr = typeof forceError?.stderr === 'string' ? forceError.stderr : forceError?.message;
+            return { deleted: false, reason: `branch_force_delete_failed: ${String(fErr || 'unknown error').trim()}` };
+        }
+    }
+}
+
 // ─── Prune ──────────────────────────────────────
 
 async function pruneWorktrees(repoRoot: string): Promise<void> {

package/src/mesh/mesh-work-queue.ts

@@ -130,6 +130,18 @@ function isMutationKeywordInCommandContext(text: string, matchStart: number, mat
     // Line start (only whitespace before the keyword on this line).
     if (/^\s*$/.test(linePrefix)) return true;
 
+    // Executed script at command position: the keyword sits inside a run-prefix
+    // path token (`./scripts/version-bump.sh`, `~/bin/deploy.sh`) that is the
+    // leading token of the line or follows a shell connective — the script is
+    // being invoked, so the keyword is a real command. (Path *arguments* like
+    // `list build/Release` are excluded earlier by isInsidePathSegment.)
+    let tokStart = matchStart;
+    while (tokStart > lineStart && !/\s/.test(text[tokStart - 1])) tokStart--;
+    const beforeToken = text.slice(lineStart, tokStart);
+    const tokenLead = text.slice(tokStart, matchStart);
+    const atCmdPos = /^\s*$/.test(beforeToken) || /(?:&&|\|\||\||;)\s*$/.test(beforeToken);
+    if (atCmdPos && /^(?:\.\/|\.\.\/|~\/|\/)/.test(tokenLead)) return true;
+
     // After a shell connective or imperative connective introducing a command.
     // We look at what immediately precedes the keyword on the same line.
     if (/(?:&&|\|\||\||;)\s*$/.test(linePrefix)) return true;
@@ -171,15 +183,111 @@ function isInsideBackticksOrFence(text: string, matchStart: number, matchEnd: nu
     return inlineCount % 2 === 1;
 }
 
+/**
+ * True if the matched keyword is part of a filesystem-path-like token rather than
+ * a standalone word/command. A "release" inside `build/Release`, `dist/release/`,
+ * or `packages\release` is a directory/file name, not a deploy instruction. We
+ * look at the characters immediately adjacent to the match: if either side is a
+ * path separator (`/` or `\`) joining it to another path segment, the keyword is
+ * a path component.
+ *
+ * IMPORTANT: a path token that is itself being *executed* — i.e. the leading
+ * token of a command line such as `./scripts/version-bump.sh patch` — is NOT a
+ * suppressible path; that is a real command. We therefore exclude the case where
+ * the path token sits at command-invocation position (line start, optionally with
+ * a leading `./` / `/` / `~/`, or right after a shell connective), which means it
+ * is the program being run rather than an argument being inspected.
+ */
+function isInsidePathSegment(text: string, matchStart: number, matchEnd: number): boolean {
+    const prev = matchStart > 0 ? text[matchStart - 1] : '';
+    const next = matchEnd < text.length ? text[matchEnd] : '';
+    const isSep = (c: string) => c === '/' || c === '\\';
+    const segChar = (c: string) => /[A-Za-z0-9._~-]/.test(c);
+    const inPath =
+        (isSep(prev) && (next === '' || isSep(next) || segChar(next) || /\s/.test(next))) ||
+        (isSep(next) && (prev === '' || isSep(prev) || segChar(prev) || /\s/.test(prev)));
+    if (!inPath) return false;
+
+    // Find the whole whitespace-delimited path token containing the match and the
+    // text on its line before it. If the token is the first thing on the line
+    // (after an optional `./`, `/`, `~/`, or `../` prefix) or directly follows a
+    // shell connective, it is being executed → not a suppressible path.
+    const lineStart = text.lastIndexOf('\n', matchStart - 1) + 1;
+    let tokStart = matchStart;
+    while (tokStart > lineStart && !/\s/.test(text[tokStart - 1])) tokStart--;
+    const linePrefixBeforeToken = text.slice(lineStart, tokStart);
+    const tokenPrefix = text.slice(tokStart, matchStart);
+    // The path token is in command position when nothing but whitespace (or a
+    // shell connective) precedes it on the line, AND the token itself is a
+    // run-prefix path (`./`, `/`, `~/`, `../`). A bare `build/Release` argument
+    // after a verb ("list build/Release") is NOT command position.
+    const atLineStart = /^\s*$/.test(linePrefixBeforeToken);
+    const afterConnective = /(?:&&|\|\||\||;)\s*$/.test(linePrefixBeforeToken);
+    const isRunPrefixPath = /^(?:\.\/|\.\.\/|~\/|\/)/.test(tokenPrefix);
+    if ((atLineStart || afterConnective) && isRunPrefixPath) return false;
+    return true;
+}
+
+/**
+ * True if [matchStart, matchEnd) lies inside a quoted span — straight quotes
+ * (`"..."`, `'...'`), typographic quotes (`“...”`, `‘...’`), or CJK brackets
+ * (`「...」`, `『...』`, `《...》`). Commit-message citations and other quoted prose
+ * (e.g. quoting a `chore: ... version-bump ...` log line, or the Korean
+ * "포인터 bump" phrase) are descriptive, not command invocations, so a forbidden
+ * keyword inside such a quote must not trip the guardrail. Backticks are excluded
+ * here on purpose — they denote shell/code snippets and are handled as command
+ * context in {@link isInsideBackticksOrFence}.
+ */
+function isInsideQuotedSpan(text: string, matchStart: number, matchEnd: number): boolean {
+    // Paired quotes: an opening char before the match without its closer in
+    // between, and the matching closer after the match.
+    const pairs: Array<[string, string]> = [
+        ['“', '”'], ['‘', '’'], ['「', '」'], ['『', '』'], ['《', '》'],
+    ];
+    for (const [open, close] of pairs) {
+        const openIdx = text.lastIndexOf(open, matchStart - 1);
+        if (openIdx < 0) continue;
+        // No closer between the opener and the match → still open at the match.
+        if (text.indexOf(close, openIdx + open.length) >= matchEnd) return true;
+    }
+    // Symmetric quotes (" and '): odd count of the quote char before the match,
+    // within the same line (a quote does not span newlines), and a closing quote
+    // later on the line.
+    const lineStart = text.lastIndexOf('\n', matchStart - 1) + 1;
+    const lineEnd = (() => { const i = text.indexOf('\n', matchEnd); return i < 0 ? text.length : i; })();
+    for (const q of ['"', "'"]) {
+        let count = 0;
+        for (let i = lineStart; i < matchStart; i++) if (text[i] === q) count++;
+        if (count % 2 === 1 && text.indexOf(q, matchEnd) >= 0 && text.indexOf(q, matchEnd) < lineEnd) {
+            // For "'" guard against the apostrophe-in-prose case (e.g. "don't"):
+            // require the opening quote to be preceded by a boundary (start/space/
+            // open-paren) so a contraction apostrophe is not read as a quote opener.
+            if (q === '"') return true;
+            // find the opening quote (the one making the count odd)
+            let openPos = -1, c = 0;
+            for (let i = lineStart; i < matchStart; i++) { if (text[i] === q) { c++; if (c % 2 === 1) openPos = i; } }
+            const beforeOpen = openPos > lineStart ? text[openPos - 1] : ' ';
+            if (/[\s(\[{>]/.test(beforeOpen) || openPos === lineStart) return true;
+        }
+    }
+    return false;
+}
+
 /**
  * Decides whether a forbidden keyword match at [matchStart, matchEnd) should
  * count as a real violation. A match counts only when it is in command context
- * and not negated. Negation always wins (even inside a code block), per the
- * conservative rule: code-block + negation → exclude; other code-block → keep.
+ * and not negated, and is NOT merely a path segment or quoted (descriptive)
+ * citation. Negation always wins (even inside a code block), per the conservative
+ * rule: code-block + negation → exclude; other code-block → keep.
  */
 function isRealMutationMatch(text: string, matchStart: number, matchEnd: number): boolean {
     if (hasNegationBefore(text, matchStart)) return false;
     if (hasTrailingNegation(text, matchEnd)) return false;
+    // A keyword that is part of a file path (build/Release, dist/release/) or
+    // sits inside quoted prose (a commit-message citation, "포인터 bump") is a
+    // description, not a command — suppress it even if it lands at line-start.
+    if (isInsidePathSegment(text, matchStart, matchEnd)) return false;
+    if (isInsideQuotedSpan(text, matchStart, matchEnd)) return false;
     return isMutationKeywordInCommandContext(text, matchStart, matchEnd);
 }
 

package/src/providers/cli-provider-instance.ts

@@ -430,6 +430,14 @@ export class CliProviderInstance implements ProviderInstance {
     private context: InstanceContext | null = null;
     private events: ProviderEvent[] = [];
     private lastStatus: string = 'starting';
+    // Idempotency guard for the queue-claim agent:ready event. agent:ready is the
+    // sole signal the mesh coordinator's tryAssignQueueTask waits on to hand a
+    // queued task to this worker. It is emitted in two places: the boot-time
+    // starting→idle one-shot, and the readySeen re-arm below. This flag makes the
+    // event fire AT MOST ONCE per session so a worker is never claimed twice and a
+    // queued task is never double-dispatched/double-injected. Whichever path fires
+    // first sets it; the other becomes a no-op.
+    private agentReadyEmitted = false;
     private generatingStartedAt: number = 0;
     private settings: Record<string, any> = {};
     private monitor: StatusMonitor;
@@ -1920,6 +1928,18 @@ export class CliProviderInstance implements ProviderInstance {
         } catch { /* adapter gone / transient — next frame retries */ }
     }
 
+    /**
+     * Emit the queue-claim agent:ready event at most once per session. Both the
+     * boot-time starting→idle one-shot and the fsmReadySeen re-arm call this; the
+     * agentReadyEmitted guard ensures the second caller is a no-op so a worker is
+     * never claimed twice and a queued task is never double-dispatched.
+     */
+    private emitAgentReadyOnce(chatTitle: string, now: number): void {
+        if (this.agentReadyEmitted) return;
+        this.agentReadyEmitted = true;
+        this.pushEvent({ event: 'agent:ready', chatTitle, timestamp: now });
+    }
+
     private detectStatusTransition(): void {
         const now = Date.now();
         // Status-change handling is a hot path: PTY output can fire it many times
@@ -2142,7 +2162,7 @@ export class CliProviderInstance implements ProviderInstance {
                     this.scheduleCompletedDebounceFlush(flushDelay);
                 }
             } else if (newStatus === 'idle' && this.lastStatus === 'starting') {
-                this.pushEvent({ event: 'agent:ready', chatTitle, timestamp: now });
+                this.emitAgentReadyOnce(chatTitle, now);
             } else if (newStatus === 'error') {
                 if (this.generatingDebounceTimer) { clearTimeout(this.generatingDebounceTimer); this.generatingDebounceTimer = null; }
                 this.generatingDebouncePending = null;
@@ -2171,6 +2191,28 @@ export class CliProviderInstance implements ProviderInstance {
             this.lastStatus = newStatus;
         }
 
+        // Re-arm the queue-claim agent:ready on the FSM's first GENUINE ready.
+        //
+        // The boot-time starting→idle one-shot above is the historical claim
+        // trigger, but it is consumed too early for FSM-spec providers whose
+        // INITIAL state already reports status 'idle' (e.g. antigravity-cli): the
+        // adapter reports idle before maybeMarkReady has fired, so lastStatus
+        // advances starting→idle while the prompt is not yet drawn and the worker
+        // cannot yet claim. Subsequent state-driven idle frames are idle→idle (no
+        // status change), so the one-shot never re-fires and the worker strands its
+        // queued task — the coordinator then relaunch-loops every ~90s.
+        //
+        // The adapter surfaces fsmReadySeen=true exactly when the FSM reaches its
+        // first non-initial idle (the prompt is genuinely up). On that signal we
+        // emit agent:ready once more. emitAgentReadyOnce is idempotent (guarded by
+        // agentReadyEmitted), so providers whose boot one-shot already landed on a
+        // real ready (claude-cli / codex-cli / hermes-cli, which use a startup
+        // grace and whose initial state is not idle) treat this as a no-op — no
+        // double claim, no double task injection.
+        if (newStatus === 'idle' && adapterStatus.fsmReadySeen === true && !this.agentReadyEmitted) {
+            this.emitAgentReadyOnce(chatTitle, now);
+        }
+
         this.applyProviderResponse(parsedStatus, {
             phase: (newStatus === 'idle' && (previousStatus === 'generating' || previousStatus === 'waiting_approval'))
                 ? 'turn_completed'

package/src/providers/spec/cli-adapter.ts

@@ -206,7 +206,12 @@ export class SpecCliAdapter implements CliAdapter {
         if (state.status === 'generating') {
             return { status: 'generating', messages: [], activeModal: null, activeInteractivePrompt: this.activeInteractivePrompt, ...sessionFields };
         }
-        return { status: 'idle', messages: [], activeModal: null, activeInteractivePrompt: this.activeInteractivePrompt, ...sessionFields };
+        // fsmReadySeen lets CliProviderInstance re-arm the queue-claim agent:ready
+        // on the first genuine ready (prompt drawn), independent of the boot-time
+        // starting→idle one-shot that the provider-instance otherwise relies on.
+        // Surfaced only on idle so the provider-instance fires agent:ready exactly
+        // when the worker is actually ready to claim.
+        return { status: 'idle', messages: [], activeModal: null, activeInteractivePrompt: this.activeInteractivePrompt, fsmReadySeen: this.driver.hasSeenReady?.() ?? false, ...sessionFields };
     }
 
     private maybeRefreshNativeHistory(): void {

package/src/providers/spec/fsm-driver.ts

@@ -125,6 +125,7 @@ export interface ISpecDriver {
     getSections(): Array<{ id: string; text: string }> | null;
     getLastBusyAt(): number;
     hasIdleHoldPending(): boolean;
+    hasSeenReady(): boolean;
     getCompletionIdleDebounceState(): { active: boolean; ageMs: number; holdMs: number; forceAfterMs: number } | null;
     getFsmDebug?(): unknown;
     getFsmSnapshotHistory?(): ReadonlyArray<FsmSnapshotEntry>;
@@ -466,6 +467,17 @@ export class FsmDriver implements ISpecDriver {
         // Report true while any outgoing transition is hold-blocked.
         return (this.lastFsmEval?.transitions ?? []).some(t => !t.holdSatisfied && t.condResult);
     }
+    /**
+     * True once the machine has reached its first non-initial idle state (the
+     * prompt is genuinely drawn — see maybeMarkReady). The cli-adapter surfaces
+     * this on its idle status so CliProviderInstance can re-arm the queue-claim
+     * agent:ready on the first genuine ready, independent of the boot-time
+     * starting→idle one-shot (which is consumed too early for specs whose
+     * initial state already reports idle).
+     */
+    hasSeenReady(): boolean {
+        return this.readySeenOnce;
+    }
     getCompletionIdleDebounceState(): { active: boolean; ageMs: number; holdMs: number; forceAfterMs: number } | null {
         // Surface the busy→ready transition's stable countdown, if any, so the
         // existing panel field stays meaningful.