@adhdev/daemon-core 0.9.82-rc.43 → 0.9.82-rc.430

package/src/commands/cli-manager.ts

@@ -18,13 +18,15 @@ import { loadConfig } from '../config/config.js';
 import { loadState, saveState } from '../config/state-store.js';
 import { getWorkspaceState, resolveLaunchDirectory } from '../config/workspaces.js';
 import { appendRecentActivity } from '../config/recent-activity.js';
+import { shortHash } from '../system/hash.js';
+import { unregisterMeshCoordinator, getCoordinatorForSession, listCoordinatorsForWorkspace } from '../mesh/coordinator-registry.js';
 import { upsertSavedProviderSession } from '../config/saved-sessions.js';
 import { buildLegacyModelModeSummaryMetadata, normalizeProviderSummaryMetadata } from '../providers/summary-metadata.js';
 import { CliProviderInstance } from '../providers/cli-provider-instance.js';
 import { AcpProviderInstance } from '../providers/acp-provider-instance.js';
 import type { ProviderInstanceManager } from '../providers/provider-instance-manager.js';
 import { ProviderLoader } from '../providers/provider-loader.js';
-import { normalizeInputEnvelope, type ProviderModule, type ProviderResumeCapability } from '../providers/contracts.js';
+import { normalizeInputEnvelope, type MeshCoordinatorDelegatedWorkerIsolation, type ProviderModule, type ProviderResumeCapability } from '../providers/contracts.js';
 import { assertProviderSupportsDeclaredInput, assertTextOnlyInput } from '../providers/provider-input-support.js';
 import type { CliAdapter } from '../cli-adapter-types.js';
 import type { PtyTransportFactory } from '../cli-adapters/pty-transport.js';
@@ -80,6 +82,126 @@ export interface CliManagerDeps {
 
 type CommandResult = { success: boolean;[key: string]: unknown };
 
+const BUSY_AGENT_STATUSES = new Set(['generating', 'running', 'streaming', 'starting', 'busy', 'waiting', 'waiting_approval', 'no_progress', 'long_generating']);
+const ZERO_MESSAGE_STARTING_SEND_WAIT_MS = 2_000;
+
+function normalizeAgentStatus(value: unknown): string {
+    return typeof value === 'string' ? value.trim().toLowerCase() : '';
+}
+
+function hasNonEmptyModalButtons(activeModal: unknown): boolean {
+    const buttons = (activeModal as any)?.buttons;
+    return Array.isArray(buttons) && buttons.some((button) => String(button || '').trim().length > 0);
+}
+
+function hasAdapterPendingResponse(adapter: any): boolean {
+    if (adapter?.isWaitingForResponse === true) return true;
+    if (adapter?.currentTurnScope) return true;
+    try {
+        if (typeof adapter?.isProcessing === 'function' && adapter.isProcessing()) return true;
+    } catch { /* defensive: send guard should not fail on diagnostics */ }
+    try {
+        const partial = typeof adapter?.getPartialResponse === 'function' ? adapter.getPartialResponse() : '';
+        if (typeof partial === 'string' && partial.trim()) return true;
+    } catch { /* defensive: missing partial means no pending evidence */ }
+    return false;
+}
+
+function countMessages(value: unknown): number {
+    return Array.isArray(value) ? value.length : 0;
+}
+
+function hasFinalAssistantMessage(value: unknown): boolean {
+    const messages = Array.isArray(value) ? value : [];
+    const last = messages[messages.length - 1] as any;
+    if (!last || last.role !== 'assistant') return false;
+    if (last.bubbleState === 'streaming') return false;
+    if (last.meta?.streaming === true) return false;
+    return typeof last.content === 'string' && last.content.trim().length > 0;
+}
+
+function hasZeroMessageStartingLaunch(adapter: any): boolean {
+    const adapterStatus = adapter?.getStatus?.({ allowParse: false }) ?? adapter?.getStatus?.() ?? {};
+    const parsedStatus = typeof adapter?.getScriptParsedStatus === 'function'
+        ? adapter.getScriptParsedStatus()
+        : {};
+    const adapterRawStatus = normalizeAgentStatus(adapterStatus?.status);
+    const parsedRawStatus = normalizeAgentStatus(parsedStatus?.status);
+    if (adapterRawStatus !== 'starting') return false;
+    if (parsedRawStatus && parsedRawStatus !== 'starting' && parsedRawStatus !== 'generating') return false;
+    if (hasNonEmptyModalButtons(adapterStatus?.activeModal ?? adapterStatus?.modal ?? parsedStatus?.activeModal ?? parsedStatus?.modal)) return false;
+    if (countMessages(adapterStatus?.messages) > 0 || countMessages(parsedStatus?.messages) > 0) return false;
+    return !hasAdapterPendingResponse(adapter);
+}
+
+function hasCompletedStartingLaunch(adapter: any): boolean {
+    const adapterStatus = adapter?.getStatus?.({ allowParse: false }) ?? adapter?.getStatus?.() ?? {};
+    const adapterRawStatus = normalizeAgentStatus(adapterStatus?.status);
+    if (adapterRawStatus !== 'starting') return false;
+    if (hasAdapterPendingResponse(adapter)) return false;
+
+    const parsedStatus = typeof adapter?.getScriptParsedStatus === 'function'
+        ? adapter.getScriptParsedStatus()
+        : {};
+    const parsedRawStatus = normalizeAgentStatus(parsedStatus?.status);
+    if (parsedRawStatus !== 'idle') return false;
+    if (hasNonEmptyModalButtons(adapterStatus?.activeModal ?? adapterStatus?.modal ?? parsedStatus?.activeModal ?? parsedStatus?.modal)) return false;
+    return hasFinalAssistantMessage(parsedStatus?.messages);
+}
+
+/**
+ * WTCLAIM (B): compare two workspace paths for node scoping. Normalizes separator
+ * style, trailing slashes, and case (Windows paths are case-insensitive; the
+ * coordinator-supplied node.workspace and the adapter's launch workingDir can
+ * differ only in those) so a base node and a worktree clone are still told apart
+ * by their distinct workspace roots.
+ */
+function normalizeDirForCompare(dir?: string): string {
+    if (typeof dir !== 'string') return '';
+    return dir.trim().replace(/[\\/]+/g, '/').replace(/\/+$/, '').toLowerCase();
+}
+
+function shouldSuppressStaleParsedBusyStatus(adapterStatus: string, parsedStatus: any, adapter: any): boolean {
+    const parsedRawStatus = normalizeAgentStatus(parsedStatus?.status);
+    if (!BUSY_AGENT_STATUSES.has(parsedRawStatus)) return false;
+    if (adapterStatus !== 'idle') return false;
+    if (hasNonEmptyModalButtons(parsedStatus?.activeModal ?? parsedStatus?.modal)) return false;
+    return !hasAdapterPendingResponse(adapter);
+}
+
+function getEffectiveAgentSendStatus(adapter: any): string {
+    const adapterStatus = normalizeAgentStatus(adapter?.getStatus?.({ allowParse: false })?.status ?? adapter?.getStatus?.()?.status);
+    if (adapterStatus === 'starting' && hasCompletedStartingLaunch(adapter)) return 'idle';
+    if (adapterStatus && adapterStatus !== 'idle') return adapterStatus;
+    if (adapterStatus !== 'idle') return adapterStatus;
+
+    if (typeof adapter?.getScriptParsedStatus !== 'function') return adapterStatus;
+    try {
+        const parsedStatus = adapter.getScriptParsedStatus();
+        const parsedRawStatus = normalizeAgentStatus(parsedStatus?.status);
+        if (BUSY_AGENT_STATUSES.has(parsedRawStatus) && !shouldSuppressStaleParsedBusyStatus(adapterStatus, parsedStatus, adapter)) {
+            return parsedRawStatus;
+        }
+    } catch {
+        return adapterStatus;
+    }
+    return adapterStatus;
+}
+
+async function waitForZeroMessageStartingLaunch(adapter: any): Promise<boolean> {
+    try {
+        if (!hasZeroMessageStartingLaunch(adapter)) return false;
+    } catch {
+        return false;
+    }
+    await new Promise(resolve => setTimeout(resolve, ZERO_MESSAGE_STARTING_SEND_WAIT_MS));
+    try {
+        return hasZeroMessageStartingLaunch(adapter);
+    } catch {
+        return false;
+    }
+}
+
 export interface CliTransportFactoryParams {
     runtimeId: string;
     providerType: string;
@@ -138,18 +260,19 @@ type CliStartOptions = {
     extraEnv?: Record<string, string>;
 };
 
-const COORDINATOR_DELEGATED_ENV_UNSETS: Record<string, string> = {
-    ADHDEV_INLINE_MESH: '',
-    ADHDEV_MCP_TRANSPORT: '',
-    ADHDEV_MESH_ID: '',
-    HERMES_EPHEMERAL_SYSTEM_PROMPT: '',
-};
+const DEFAULT_COORDINATOR_DELEGATED_ENV_UNSETS = [
+    'ADHDEV_INLINE_MESH',
+    'ADHDEV_MCP_TRANSPORT',
+    'ADHDEV_MESH_ID',
+    'HERMES_EPHEMERAL_SYSTEM_PROMPT',
+] as const;
 
 export interface CoordinatorDelegatedCliLaunchOptionsInput {
     cliType: string;
     workspace: string;
     cliArgs?: string[];
     env?: Record<string, string>;
+    isolation?: MeshCoordinatorDelegatedWorkerIsolation;
 }
 
 export interface CoordinatorDelegatedCliLaunchOptions {
@@ -161,10 +284,25 @@ function hasCliArg(args: string[], flag: string): boolean {
     return args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
 }
 
+function hasConfigOverride(args: string[], key: string): boolean {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        const next = args[index + 1];
+        if ((arg === '-c' || arg === '--config') && typeof next === 'string') {
+            if (next === key || next.startsWith(`${key}=`) || next.startsWith(`${key}.`)) return true;
+        }
+        if (arg.startsWith('--config=')) {
+            const value = arg.slice('--config='.length);
+            if (value === key || value.startsWith(`${key}=`) || value.startsWith(`${key}.`)) return true;
+        }
+    }
+    return false;
+}
+
 function ensureEmptyDelegatedMcpConfig(workspace: string): string {
     const baseDir = path.join(os.tmpdir(), 'adhdev-delegated-agent-empty-mcp');
     mkdirSync(baseDir, { recursive: true });
-    const workspaceHash = crypto.createHash('sha256').update(path.resolve(workspace || os.tmpdir())).digest('hex').slice(0, 16);
+    const workspaceHash = shortHash(path.resolve(workspace || os.tmpdir()));
     const filePath = path.join(baseDir, `${workspaceHash}.json`);
     writeFileSync(filePath, JSON.stringify({ mcpServers: {} }, null, 2), 'utf-8');
     return filePath;
@@ -173,12 +311,31 @@ function ensureEmptyDelegatedMcpConfig(workspace: string): string {
 export function buildCoordinatorDelegatedCliLaunchOptions(
     input: CoordinatorDelegatedCliLaunchOptionsInput,
 ): CoordinatorDelegatedCliLaunchOptions {
-    const cliType = String(input.cliType || '').trim();
     const cliArgs = Array.isArray(input.cliArgs) ? [...input.cliArgs] : [];
-    const env: Record<string, string> = { ...(input.env || {}), ...COORDINATOR_DELEGATED_ENV_UNSETS };
+    const env: Record<string, string> = { ...(input.env || {}) };
+    const envUnsets = new Set<string>(DEFAULT_COORDINATOR_DELEGATED_ENV_UNSETS);
+    for (const key of input.isolation?.env?.unset || []) {
+        if (typeof key === 'string' && key.trim()) envUnsets.add(key.trim());
+    }
+    for (const key of envUnsets) env[key] = '';
 
-    if (cliType === 'claude-cli' && !hasCliArg(cliArgs, '--mcp-config')) {
-        cliArgs.unshift('--mcp-config', ensureEmptyDelegatedMcpConfig(input.workspace));
+    for (const rule of input.isolation?.args || []) {
+        if (!rule || typeof rule !== 'object') continue;
+        if (rule.mode === 'empty_mcp_config') {
+            if (rule.flag && !hasCliArg(cliArgs, rule.flag)) {
+                cliArgs.unshift(rule.flag, ensureEmptyDelegatedMcpConfig(input.workspace));
+            }
+            if (rule.strictFlag && !hasCliArg(cliArgs, rule.strictFlag)) {
+                cliArgs.unshift(rule.strictFlag);
+            }
+            continue;
+        }
+        if (rule.mode === 'config_override') {
+            const key = String(rule.dedupeKey || rule.key || '').trim();
+            const flag = String(rule.flag || '').trim();
+            if (!key || !flag || hasConfigOverride(cliArgs, key)) continue;
+            cliArgs.unshift(flag, `${rule.key}=${rule.value}`);
+        }
     }
 
     return { cliArgs, env };
@@ -255,10 +412,14 @@ function detectExplicitProviderSessionId(
 
     const subcommands = resume?.sessionIdFromSubcommand;
     if (Array.isArray(subcommands) && subcommands.length > 0) {
+        const hasResumeSubcommand = args.some((arg) => subcommands.includes(arg));
         const subcommandSessionId = readSubcommandSessionId(args, subcommands);
         if (subcommandSessionId) {
             return { providerSessionId: subcommandSessionId, launchMode: 'resume' };
         }
+        if (hasResumeSubcommand) {
+            return { launchMode: 'resume' };
+        }
     }
 
     return { launchMode: 'manual' };
@@ -292,6 +453,12 @@ export function resolveCliSessionBinding(
             launchMode: explicit.launchMode,
         };
     }
+    if (explicit.launchMode === 'resume') {
+        return {
+            cliArgs: baseArgs,
+            launchMode: 'resume',
+        };
+    }
     if (explicit.launchMode === 'manual' && hasArg(baseArgs || [], ['--session-id'])) {
         return {
             cliArgs: baseArgs,
@@ -435,7 +602,9 @@ export class DaemonCliManager {
                 providerSessionId,
                 attachExisting,
             );
-            return new ProviderCliAdapter(resolvedProvider as CliProviderModule, workingDir, cliArgs, extraEnv || {}, transportFactory);
+            const adapter = new ProviderCliAdapter(resolvedProvider as CliProviderModule, workingDir, cliArgs, extraEnv || {}, transportFactory);
+            if (providerSessionId) adapter.updateRuntimeMeta({ providerSessionId });
+            return adapter;
         }
 
         throw new Error(`No CLI provider found for '${cliType}'. Create a provider.js in providers/cli/${cliType}/`);
@@ -457,6 +626,7 @@ export class DaemonCliManager {
                             this.deps.removeAgentTracking(key);
                             sessionRegistry?.unregisterByInstanceKey(key);
                             instanceManager?.removeInstance(key);
+                            unregisterMeshCoordinator(key);
                             LOG.info('CLI', `🧹 Auto-cleaned ${status.status} CLI: ${cliType}`);
                             this.deps.onStatusChange();
                         }
@@ -516,6 +686,18 @@ export class DaemonCliManager {
                 transport: 'pty',
                 adapterKey: key,
                 instanceKey: key,
+                workspace: resolvedDir,
+                // attachExisting === true means we're restoring an already-spawned
+                // hosted runtime after a daemon restart, not starting a fresh PTY.
+                // The real spawn time is in the past and we don't have it on the
+                // restored descriptor; pinning spawnedAtMs to Date.now() in that
+                // case would push the native-history session-floor cutoff past
+                // every existing transcript file, so the agy/hermes/claude reader
+                // would return null even though the transcript on disk is fresh.
+                // 0 disables the floor for this session — recent_window_ms in the
+                // spec still bounds how far back we look. Fresh launches still
+                // get a proper floor so prior-session leak protection holds.
+                spawnedAtMs: attachExisting ? 0 : Date.now(),
             });
         } catch (spawnErr: any) {
             LOG.error('CLI', `[${cliType}] Spawn failed: ${spawnErr?.message}`);
@@ -524,6 +706,37 @@ export class DaemonCliManager {
         }
 
         this.adapters.set(key, cliInstance.getAdapter());
+
+        // WTDISPATCH (no_node_binding): a coordinator-launched worker carries its mesh node
+        // binding on the CLI-instance settings, but the session-host RECORD meta was never
+        // stamped with it — `updateRuntimeSettings` only mutates in-memory runtime settings and
+        // `updateRuntimeMeta` was only ever called with providerSessionId. So mesh_cleanup_sessions
+        // matched these worker sessions to a node by workspace ALONE
+        // (`live_session_matched_by_workspace_only_no_node_binding`), which on a daemon hosting
+        // sibling worktree nodes cannot tell two co-located clones apart. Push the launch-time node
+        // binding to the record meta so the record is 1:1 bound to its node (the spawned pty exists
+        // by now, so updateMeta reaches the session-host store). Best-effort; guarded.
+        const launchMeshNodeId = typeof settings?.meshNodeId === 'string' ? settings.meshNodeId.trim() : '';
+        const launchMeshNodeFor = typeof settings?.meshNodeFor === 'string' ? settings.meshNodeFor.trim() : '';
+        // Auto-launch attribution: the queue stamps the task id it auto-launched this
+        // worker FOR (autoLaunchedForQueueTaskId). Mirror it onto the record meta so a
+        // later cleanup (e.g. MAGI post-review auto-cleanup) can verify a session was
+        // auto-launched for a SPECIFIC replica task before stopping/deleting it — a reused
+        // idle session never carries this marker, so it is preserved.
+        const launchAutoLaunchedForQueueTaskId = typeof settings?.autoLaunchedForQueueTaskId === 'string'
+            ? settings.autoLaunchedForQueueTaskId.trim()
+            : '';
+        if (launchMeshNodeId || launchMeshNodeFor || launchAutoLaunchedForQueueTaskId) {
+            try {
+                cliInstance.getAdapter().updateRuntimeMeta?.({
+                    ...(launchMeshNodeId ? { meshNodeId: launchMeshNodeId } : {}),
+                    ...(launchMeshNodeFor ? { meshNodeFor: launchMeshNodeFor } : {}),
+                    ...(settings?.launchedByCoordinator === true ? { launchedByCoordinator: true } : {}),
+                    ...(launchAutoLaunchedForQueueTaskId ? { autoLaunchedForQueueTaskId: launchAutoLaunchedForQueueTaskId } : {}),
+                });
+            } catch { /* best-effort — record-meta stamp is cleanup hygiene, not on the dispatch path */ }
+        }
+
         this.startCliExitMonitor(key, cliType);
     }
 
@@ -556,6 +769,24 @@ export class DaemonCliManager {
 
  // Create UUID-based key (allows separate instances even for same type+dir)
         const key = crypto.randomUUID();
+
+        // (3) Session-anchored mesh routing: when launching a mesh COORDINATOR session
+        // (settings.meshCoordinatorFor set), expose this session's OWN runtime id to its MCP
+        // server via env. The MCP server is spawned by the CLI as a child and inherits this
+        // env, so the MCP layer can stamp ADHDEV_COORDINATOR_SESSION_ID as the originating
+        // coordinator on every dispatch (→ MeshContext.coordinatorSessionId → worker
+        // meshCoordinatorSessionId → completion targetCoordinatorSessionId → strict route).
+        // `key` IS the instance id findLiveCoordinators matches on, so the stamp and the live
+        // session agree. Re-applied on every (re)launch, so it always reflects the current id;
+        // a stale value only survives if the CLI process outlives a daemon restart, in which
+        // case routing falls back to the daemon level (no wedge — see mesh-reconcile-loop).
+        {
+            const coordinatorMeshId = (options?.settingsOverride as Record<string, unknown> | undefined)?.meshCoordinatorFor;
+            if (typeof coordinatorMeshId === 'string' && coordinatorMeshId.trim()) {
+                options = { ...options, extraEnv: { ...(options?.extraEnv || {}), ADHDEV_COORDINATOR_SESSION_ID: key } };
+            }
+        }
+
         const sessionRegistry = this.deps.getSessionRegistry?.() || null;
 
  // ─── ACP category handle ───
@@ -589,6 +820,7 @@ export class DaemonCliManager {
                 transport: 'acp',
                 adapterKey: key,
                 instanceKey: key,
+                workspace: resolvedDir,
             });
 
  // Register ACP entry in adapter map (getStatus queries from acpInstance in real-time)
@@ -783,6 +1015,7 @@ export class DaemonCliManager {
             this.deps.removeAgentTracking(key);
             this.deps.getSessionRegistry?.()?.unregisterByInstanceKey(key);
             this.deps.getInstanceManager()?.removeInstance(key);
+            unregisterMeshCoordinator(key);
             LOG.info('CLI', `🛑 Agent stopped: ${adapter.cliType} in ${adapter.workingDir}`);
             this.deps.onStatusChange();
         } else {
@@ -792,6 +1025,7 @@ export class DaemonCliManager {
                 this.deps.getSessionRegistry?.()?.unregisterByInstanceKey(key);
                 im.removeInstance(key);
                 this.deps.removeAgentTracking(key);
+                unregisterMeshCoordinator(key);
                 LOG.warn('CLI', `🧹 Force-removed orphan entry: ${key}`);
                 this.deps.onStatusChange();
             }
@@ -819,6 +1053,29 @@ export class DaemonCliManager {
         const restoredBindings = new Set<string>();
         const managerTag = this.deps.hostedRuntimeManagerTag;
 
+        // CORDBADGE worker-overbind guard pre-pass: the workspace-scoped coordinator
+        // rebind fallback (below) recovers a coordinator's mark when its runtimeId
+        // changed across restart. But a delegated WORKER session that shares the
+        // coordinator's workspace+cliType ALSO misses the exact by-id lookup, so the
+        // fallback would wrongly stamp it with the lone registered coordinator's mesh
+        // mark (the reported bug: a worker shown with role:coordinator after restart).
+        // Two batch-level signals let the fallback refuse to mark a worker:
+        //   - restoredRuntimeIds: every runtimeId in this restore batch. If a
+        //     registered coordinator's own sessionId appears here, that coordinator is
+        //     being restored under its known id (the exact match binds it), so ANY
+        //     other same-workspace session is a worker — not the renamed coordinator.
+        //   - workspaceTypeCounts: how many sessions in the batch share a
+        //     workspace+cliType. >1 means we cannot tell the coordinator from a worker
+        //     even if the coordinator's id changed, so we stay unbound (ambiguous).
+        const restoredRuntimeIds = new Set<string>();
+        const workspaceTypeCounts = new Map<string, number>();
+        for (const r of sessions) {
+            if (!r?.runtimeId || !r?.cliType || !r?.workspace) continue;
+            restoredRuntimeIds.add(r.runtimeId);
+            const key = `${r.workspace}::${r.cliType}`;
+            workspaceTypeCounts.set(key, (workspaceTypeCounts.get(key) || 0) + 1);
+        }
+
         for (const record of sessions) {
             if (!record?.runtimeId || !record?.cliType || !record?.workspace) continue;
             if (!shouldRestoreHostedRuntime(record, managerTag)) {
@@ -852,6 +1109,74 @@ export class DaemonCliManager {
                 );
                 continue;
             }
+            // Re-establish the launch-time settings a fresh launch applies. startSession
+            // seeds every new instance with { ...providerLoader.getSettings(type), ...override };
+            // passing a bare {} here on restart silently dropped TWO launch settings, so a
+            // restored session diverged from a freshly-launched one:
+            //   - autoApprove (a provider/machine setting from getSettings) → a restored
+            //     coordinator self-session lost auto-approve and re-prompted on every tool call.
+            //   - meshCoordinatorFor (the coordinator launch's settingsOverride) → the restored
+            //     session was no longer recognized as this daemon's live CLI coordinator by
+            //     findLiveCoordinators (so pending mesh events stopped draining into its PTY) nor
+            //     surfaced with the coordinator badge via settings. The persisted coordinator
+            //     registry (loaded on boot) is the source of truth to rebuild that mark.
+            // Both restores are provider-agnostic — getSettings is keyed by provider type and the
+            // registry mark is type-independent.
+            const restoredSettings: Record<string, any> = { ...this.providerLoader.getSettings(normalizedType) };
+            // Primary rebind: exact persisted-registry match by runtimeId (stable across
+            // restart, see session-host runtimeId = runtimeRecord.sessionId).
+            let coordinatorEntry = getCoordinatorForSession(record.runtimeId);
+            // CORDBADGE fallback: the by-id match misses when a coordinator's runtime
+            // re-attaches under a different runtimeId than the one it was registered with
+            // (the registry survived, but its key no longer lines up). Without a rebind the
+            // restored session silently loses meshCoordinatorFor → the coordinator badge and
+            // selfIdentification block vanish and pending mesh events stop draining into its
+            // PTY, and the only recovery is a manual coordinator restart. Recover the mark
+            // from the persisted registry scoped to this exact workspace, but ONLY when it is
+            // UNAMBIGUOUS: exactly one registered coordinator for this workspace AND its
+            // cliType matches the restored session's type.
+            //
+            // WORKER-OVERBIND guard: "exactly one registered coordinator" is NOT enough —
+            // a delegated worker session sharing the coordinator's workspace+cliType also
+            // misses the by-id lookup, and the registry holding only the (single) real
+            // coordinator does NOT stop the fallback from projecting that coordinator's
+            // mark onto the worker record. So before adopting the mark we positively rule
+            // the worker out:
+            //   (a) coordinatorPresentById — the registered coordinator's own sessionId is
+            //       in this restore batch, i.e. it is being restored under its known id and
+            //       the exact match already binds it. Then THIS record (which missed) is a
+            //       worker, not the renamed coordinator → do not rebind.
+            //   (b) siblingCount > 1 — more than one session shares this workspace+cliType,
+            //       so even if the coordinator's id changed we cannot tell it from a worker
+            //       → stay unbound (ambiguous).
+            // Anything ambiguous stays unbound (we would rather miss a badge than
+            // mis-attribute one).
+            if (!coordinatorEntry?.meshId && record.workspace) {
+                const workspaceCoordinators = listCoordinatorsForWorkspace(record.workspace)
+                    .filter(e => e.meshId && (!e.cliType || e.cliType === record.cliType));
+                if (workspaceCoordinators.length === 1) {
+                    const candidate = workspaceCoordinators[0];
+                    const coordinatorPresentById = !!candidate.sessionId && restoredRuntimeIds.has(candidate.sessionId);
+                    const siblingCount = workspaceTypeCounts.get(`${record.workspace}::${record.cliType}`) || 1;
+                    if (!coordinatorPresentById && siblingCount === 1) {
+                        coordinatorEntry = candidate;
+                        LOG.info(
+                            'CLI',
+                            `↻ Rebound coordinator mark by workspace for ${record.runtimeKey || record.runtimeId} (mesh ${candidate.meshId} @ ${record.workspace}); registry key did not match runtimeId`
+                        );
+                    } else {
+                        LOG.info(
+                            'CLI',
+                            `↷ Skipping workspace coordinator rebind for ${record.runtimeKey || record.runtimeId} (${record.cliType} @ ${record.workspace}): ${coordinatorPresentById
+                                ? 'registered coordinator is restoring under its own id — this is a delegated worker'
+                                : `ambiguous (${siblingCount} sessions share this workspace+cliType)`}`
+                        );
+                    }
+                }
+            }
+            if (coordinatorEntry?.meshId) {
+                restoredSettings.meshCoordinatorFor = coordinatorEntry.meshId;
+            }
             try {
                 await this.registerCliInstance(
                     record.runtimeId,
@@ -860,7 +1185,7 @@ export class DaemonCliManager {
                     record.workspace,
                     record.cliArgs,
                     resolvedProvider,
-                    {},
+                    restoredSettings,
                     true,
                     {
                         providerSessionId: sessionBinding.providerSessionId,
@@ -899,18 +1224,36 @@ export class DaemonCliManager {
             const adapter = this.adapters.get(ik);
             if (adapter) return { adapter, key: ik };
         }
- // 1. agentType + dir match
-        if (opts?.dir) {
+ // 1. agentType + dir match.
+ //    FAIL-CLOSED when an explicit instanceKey/targetSessionId was named (step 0) but
+ //    did not resolve: the caller pinned a SPECIFIC session, so healing by workspace must
+ //    not silently redirect the command into a co-located SIBLING worktree session. The
+ //    remote mesh relay (ipcDispatchToRemoteAgent) carries `dir: node.workspace` alongside
+ //    targetSessionId for the sessionless-scope case; when a session WAS named, that dir
+ //    fallback is the WTDISPATCH-FANOUT (a) leak — a stale/relaunched session_id would
+ //    dir-match whatever session lives in that workspace instead of failing. The sessionless
+ //    node-scoped path uses findMeshNodeAdapter, not this fallback, so gating dir on
+ //    !instanceKey loses no legitimate routing. Mirror step 2's fail-closed rule.
+        if (opts?.dir && !opts?.instanceKey) {
             for (const [k, a] of this.adapters) {
                 if (a.cliType === agentType && a.workingDir === opts.dir) {
                     return { adapter: a, key: k };
                 }
             }
         }
- // 2. Fuzzy match (returns first of multiple sessions — may be inaccurate)
-        for (const [k, a] of this.adapters) {
-            if (a.cliType === agentType) {
-                return { adapter: a, key: k };
+ // 2. Fuzzy match (returns first of multiple sessions — may be inaccurate).
+ //    FAIL-CLOSED: only when NO explicit instanceKey/targetSessionId was requested.
+ //    When a specific session WAS named (step 0) but is not hosted on this daemon,
+ //    falling back to the first same-cliType adapter silently redirects the command
+ //    into an UNRELATED session — e.g. a relayed/misrouted mesh send_chat lands in the
+ //    coordinator's own CLI session, echoing the dispatched task body back to the
+ //    coordinator (TASKECHO self-inject). Returning null instead makes the caller
+ //    surface an explicit "not running" error rather than mis-delivering the message.
+        if (!opts?.instanceKey) {
+            for (const [k, a] of this.adapters) {
+                if (a.cliType === agentType) {
+                    return { adapter: a, key: k };
+                }
             }
         }
         return null;
@@ -925,6 +1268,40 @@ export class DaemonCliManager {
         return adapter ? { adapter, key: ik } : null;
     }
 
+    /**
+     * WTCLAIM (B): resolve the adapter for a mesh dispatch that named a node
+     * (meshContext.nodeId) but carried no explicit session. Matches by the
+     * instance's bound mesh node id (settings.meshNodeId, falling back to the
+     * sticky meshLastNodeId) first, then by the node workspace (workingDir).
+     *
+     * Unlike findAdapter's step-2 fuzzy fallback, this NEVER degrades to a
+     * provider-only first-match: on a daemon hosting BOTH a base node and a
+     * cloned worktree node (same daemonId), that fuzzy match could land a
+     * worktree-targeted task on the base session. Returns null when no session
+     * is bound to this node so the caller fails closed.
+     */
+    private findMeshNodeAdapter(agentType: string, nodeId: string, dir?: string): { adapter: CliAdapter; key: string } | null {
+        const instanceManager = this.deps.getInstanceManager();
+        const targetDir = normalizeDirForCompare(dir);
+        let workspaceMatch: { adapter: CliAdapter; key: string } | null = null;
+        for (const [k, a] of this.adapters) {
+            if (a.cliType !== agentType) continue;
+            const settings = (instanceManager?.getInstance(k) as any)?.getState?.()?.settings as Record<string, unknown> | undefined;
+            const boundNodeId = (typeof settings?.meshNodeId === 'string' && settings.meshNodeId.trim())
+                ? settings.meshNodeId.trim()
+                : (typeof settings?.meshLastNodeId === 'string' ? settings.meshLastNodeId.trim() : '');
+            // Exact node binding wins immediately (most precise).
+            if (boundNodeId && boundNodeId === nodeId) return { adapter: a, key: k };
+            // Workspace identity is the secondary signal for a session not (yet)
+            // stamped with a node id — a base node and a worktree clone always have
+            // distinct workspaces, so this still separates them.
+            if (!workspaceMatch && targetDir && normalizeDirForCompare(a.workingDir) === targetDir) {
+                workspaceMatch = { adapter: a, key: k };
+            }
+        }
+        return workspaceMatch;
+    }
+
  // ─── CLI command handling ────────────────────────────
 
     async handleCliCommand(cmd: string, args: any): Promise<CommandResult | null> {
@@ -955,6 +1332,8 @@ export class DaemonCliManager {
                 const launchSource = resolved.source;
                 if (!cliType) throw new Error('cliType required');
 
+                const providerType = this.providerLoader.resolveAlias(cliType);
+                const provLookup = this.providerLoader.getMeta(providerType) as ProviderModule | undefined;
                 const settingsOverride = args?.settings && typeof args.settings === 'object' ? args.settings : undefined;
                 const delegatedLaunch = settingsOverride?.launchedByCoordinator === true
                     ? buildCoordinatorDelegatedCliLaunchOptions({
@@ -962,8 +1341,28 @@ export class DaemonCliManager {
                         workspace: dir,
                         cliArgs: args?.cliArgs,
                         env: args?.env,
+                        isolation: provLookup?.meshCoordinator?.delegatedWorkerIsolation,
                     })
                     : null;
+                // Untrusted-provider gate: an external source that ships JS
+                // hooks needs explicit user confirmation before its first
+                // launch. Dashboards add `confirmExternalUntrusted: true` to
+                // the launch args after showing the trust modal. Without
+                // that ack we refuse to spawn and tell the caller why.
+                const provMeta = provLookup as any;
+                const provTrust = provMeta?._sourceTrust;
+                if (provTrust === 'external-untrusted' && args?.confirmExternalUntrusted !== true) {
+                    return {
+                        success: false,
+                        error: 'untrusted_external_provider',
+                        provider: {
+                            type: provLookup?.type ?? cliType,
+                            sourceName: provMeta?._sourceName ?? null,
+                            trust: provTrust,
+                        },
+                        hint: 'Resend launch_cli with confirmExternalUntrusted=true after the user explicitly approves running JavaScript from this 3rd-party source.',
+                    };
+                }
                 const started = await this.startSession(
                     cliType,
                     dir,
@@ -1030,6 +1429,45 @@ export class DaemonCliManager {
                 this.deps.onStatusChange();
                 return { success: true, id: found.key, mode };
             }
+            case 'record_provider_pty': {
+                const cliType = args?.type || args?.cliType;
+                if (!cliType) {
+                    return { success: false, error: '`type` (provider type) is required', code: 'MISSING_TYPE' };
+                }
+                const targetSessionId = typeof args?.targetSessionId === 'string' ? args.targetSessionId : '';
+                const dir = args?.dir || '';
+                const found = (targetSessionId ? this.findAdapterBySessionId(targetSessionId) : null)
+                    || this.findAdapter(cliType, { instanceKey: targetSessionId, dir });
+                if (!found) {
+                    return {
+                        success: false,
+                        error: `No running ${cliType} session. Launch one first (adhdev launch ${cliType}) or pass --target-session-id.`,
+                        code: 'NO_RUNNING_SESSION',
+                    };
+                }
+                const instance = this.deps.getInstanceManager()?.getInstance(found.key);
+                if (!(instance instanceof CliProviderInstance)) {
+                    return { success: false, error: 'CLI instance not available', code: 'CLI_INSTANCE_NOT_FOUND' };
+                }
+                const adapter = instance.getAdapter();
+                if (!adapter || typeof (adapter as any).getAccumulatedRawBuffer !== 'function') {
+                    return { success: false, error: 'Adapter does not expose PTY buffer', code: 'ADAPTER_NOT_RECORDABLE' };
+                }
+                const buffer = (adapter as any).getAccumulatedRawBuffer() as { text: string; droppedChars: number };
+                const maxBytes = Number(args?.maxBytes) > 0 ? Number(args.maxBytes) : 262144;
+                const truncated = buffer.text.length > maxBytes;
+                const ptyBytes = truncated ? buffer.text.slice(-maxBytes) : buffer.text;
+                return {
+                    success: true,
+                    cliType,
+                    sessionId: found.key,
+                    ptyBytes,
+                    bytes: ptyBytes.length,
+                    truncated,
+                    droppedChars: buffer.droppedChars,
+                    capturedAt: Date.now(),
+                };
+            }
             case 'restart_session': {
                 const cliType = args?.cliType || args?.agentType || args?.ideType;
                 const cfg = loadConfig();
@@ -1065,14 +1503,64 @@ export class DaemonCliManager {
                 const action = args?.action;
                 if (!agentType || !action) throw new Error('agentType and action required');
 
-                const found = this.findAdapter(agentType, {
-                    dir: args?.dir,
-                    instanceKey: args?.targetSessionId,
-                });
+                // WTCLAIM (B): a mesh dispatch that named a node (meshContext.nodeId)
+                // but resolved no explicit session must be scoped to THAT node's
+                // session — never routed by findAdapter's provider-only fuzzy fallback,
+                // which on a daemon hosting both a base node and a cloned worktree node
+                // (same daemonId) could land a worktree task on the base session. Fail
+                // closed when no session is bound to the node so the coordinator
+                // launches/retries instead of mis-landing the work.
+                const meshScopeNodeId = (() => {
+                    const mc = (args as any)?.meshContext;
+                    return mc && typeof mc === 'object' && typeof mc.nodeId === 'string' ? mc.nodeId.trim() : '';
+                })();
+                let found: { adapter: CliAdapter; key: string } | null;
+                if (meshScopeNodeId && !args?.targetSessionId) {
+                    found = this.findMeshNodeAdapter(agentType, meshScopeNodeId, args?.dir);
+                    if (!found) {
+                        throw new Error(`No mesh worker session bound to node '${meshScopeNodeId}' for agent '${agentType}' on this daemon; refusing provider-only fuzzy match to avoid cross-node dispatch`);
+                    }
+                } else {
+                    found = this.findAdapter(agentType, {
+                        dir: args?.dir,
+                        instanceKey: args?.targetSessionId,
+                    });
+                }
                 if (!found) throw new Error(`CLI agent not running: ${agentType}`);
                 const { adapter, key } = found;
 
                 if (action === 'send_chat') {
+                    let currentStatus = getEffectiveAgentSendStatus(adapter);
+                    if (currentStatus === 'starting' && await waitForZeroMessageStartingLaunch(adapter)) {
+                        currentStatus = 'idle';
+                    } else if (currentStatus === 'starting') {
+                        currentStatus = getEffectiveAgentSendStatus(adapter);
+                    }
+                    // Stamp mesh direct-dispatch assignment on the target
+                    // instance BEFORE sending the prompt so the completion
+                    // event has a routing marker by the time it fires.
+                    // mesh_send_task --direct ships meshContext for plain CLI
+                    // sessions that were never launched as mesh delegates.
+                    const meshContext = (args as any)?.meshContext;
+                    if (meshContext && typeof meshContext === 'object' && typeof meshContext.meshId === 'string' && meshContext.meshId) {
+                        const targetInstanceId = key;
+                        let stampResult: { stamped: boolean; reason?: string } | undefined;
+                        try {
+                            stampResult = this.deps.getInstanceManager()?.attachMeshAssignmentToInstance(targetInstanceId, {
+                                meshId: meshContext.meshId,
+                                ...(typeof meshContext.nodeId === 'string' && meshContext.nodeId ? { nodeId: meshContext.nodeId } : {}),
+                                ...(typeof meshContext.taskId === 'string' && meshContext.taskId ? { taskId: meshContext.taskId } : {}),
+                                ...(typeof meshContext.coordinatorDaemonId === 'string' && meshContext.coordinatorDaemonId ? { coordinatorDaemonId: meshContext.coordinatorDaemonId } : {}),
+                            });
+                        } catch { /* best-effort — stamping is a routing aid, not a hard requirement */ }
+                        // DOUBLE-DISPATCH stamp guard: the instance manager refused this stamp because
+                        // the SAME task is already running on another live session on this daemon.
+                        // Sending the prompt anyway would double-execute the task — fail closed so the
+                        // coordinator does not duplicate the work onto a second session.
+                        if (stampResult && stampResult.stamped === false && stampResult.reason === 'task_already_stamped_on_live_instance') {
+                            throw new Error(`Refusing duplicate mesh dispatch: task ${meshContext.taskId} is already being worked by a live session on this daemon`);
+                        }
+                    }
                     const input = normalizeInputEnvelope(args?.input ? { input: args.input } : args);
                     const provider = this.providerLoader.resolve(agentType) || this.providerLoader.getMeta(agentType);
                     if (provider?.category === 'acp') {
@@ -1082,8 +1570,38 @@ export class DaemonCliManager {
                     }
                     const message = input.textFallback;
                     if (!message) throw new Error('message required for send_chat');
-                    await adapter.sendMessage(message);
-                    return { success: true, status: 'generating' };
+                    // ARCH-REFACTOR R1: thread the dispatched task's id into the turn so the
+                    // worker's completion event is bound to THIS task (per-turn identity),
+                    // not the last-write-wins session scalar. Carried for both local and
+                    // remote (P2P-echoed meshContext) dispatch; absent for plain ad-hoc chat.
+                    const meshTaskId = (meshContext && typeof meshContext === 'object'
+                        && typeof (meshContext as any).taskId === 'string' && (meshContext as any).taskId.trim())
+                        ? (meshContext as any).taskId as string
+                        : undefined;
+                    const forceSend = args?.force === true || args?.forceSend === true;
+                    // Preserve the exact prior call shape when there is no taskId (plain
+                    // ad-hoc chat / non-mesh dispatch); only thread the per-turn taskId when
+                    // present, so existing non-mesh callers and their contracts are unchanged.
+                    if (forceSend && typeof (adapter as any).forceSendMessage === 'function') {
+                        if (meshTaskId) await (adapter as any).forceSendMessage(message, meshTaskId);
+                        else await (adapter as any).forceSendMessage(message);
+                    } else if (forceSend) {
+                        await adapter.sendMessage(message, meshTaskId ? { force: true, meshTaskId } : { force: true });
+                    } else if (meshTaskId) {
+                        await adapter.sendMessage(message, { meshTaskId });
+                    } else {
+                        await adapter.sendMessage(message);
+                    }
+                    const targetInstance = this.deps.getInstanceManager()?.getInstance(key) as
+                        | { recordAcknowledgedUserInput?: (input: unknown) => void }
+                        | undefined;
+                    targetInstance?.recordAcknowledgedUserInput?.(input);
+                    return {
+                        success: true,
+                        status: BUSY_AGENT_STATUSES.has(currentStatus) ? currentStatus : 'generating',
+                        ...(BUSY_AGENT_STATUSES.has(currentStatus) ? { queued: true, queuedReason: 'agent_runtime_busy' } : {}),
+                        ...(forceSend ? { forceSent: true, queued: false } : {}),
+                    };
                 } else if (action === 'clear_history') {
                     if (typeof adapter.clearHistory === 'function') adapter.clearHistory();
                     return { success: true, cleared: true };