@adhdev/daemon-core 0.9.82-rc.438 → 0.9.82-rc.439

package/dist/mesh/mesh-init.d.ts

@@ -4,7 +4,13 @@
  * One-shot helper that onboards an existing git project into Repo Mesh:
  *   1. suggest + write `.adhdev/refine.json`           (Refinery validation config)
  *   2. suggest + write `.adhdev/worktree_bootstrap.json` (worktree bootstrap config)
- *   3. recommend a node providerPriority from the installed CLI providers
+ *   3. suggest + write `.adhdev/change-impact.json`     (change-impact classification)
+ *   4. recommend a node providerPriority from the installed CLI providers
+ *
+ * mesh_init now covers all THREE repo-committed `.adhdev/*` config families that
+ * carry a suggest→validate→write engine (refine + worktree_bootstrap +
+ * change-impact). `.adhdev/mesh.json` (coordinator prompt + operating notes) has
+ * its own dedicated export/write path (export_mesh_json_config / write_mesh_json_config).
  *
  * Design contract (matches the rest of the mesh tooling):
  *   - Heuristics are suggestion/scaffold only. The written files are the
@@ -19,17 +25,20 @@
  */
 import { type RepoMeshRefineConfig, type RepoMeshRefineValidationCommandConfig } from './refine-config.js';
 import { type RepoMeshWorktreeBootstrapConfig } from './worktree-bootstrap-config.js';
+import { type ChangeImpactConfig } from '../git/change-impact-config.js';
+import type { MagiKindPanelMap } from '@adhdev/mesh-shared';
 import type { CLIInfo } from '../detection/cli-detector.js';
 /** Canonical write targets — the first/preferred location for each config family. */
 export declare const MESH_INIT_REFINE_CONFIG_PATH: string;
 export declare const MESH_INIT_WORKTREE_BOOTSTRAP_CONFIG_PATH: string;
+export declare const MESH_INIT_CHANGE_IMPACT_CONFIG_PATH: string;
 export interface MeshInitConfigFileResult {
     path: string;
     relativePath: string;
     written: boolean;
     /** Why it was not written (already_exists / not_suggested / no change). */
     skippedReason?: 'already_exists' | 'no_suggestion';
-    config?: RepoMeshRefineConfig | RepoMeshWorktreeBootstrapConfig;
+    config?: RepoMeshRefineConfig | RepoMeshWorktreeBootstrapConfig | ChangeImpactConfig;
 }
 /**
  * Build a worktree_bootstrap scaffold from package scripts. Mirrors
@@ -58,12 +67,39 @@ export interface RunMeshInitOptions {
     /** When true, overwrite an existing config file. Defaults to false (never clobber). */
     overwrite?: boolean;
 }
+/**
+ * A snapshot of the currently-saved config for each domain, so the coordinator can
+ * render a current-vs-suggested diff to the user before an init/reinit overwrite.
+ * This is READ-ONLY echo — every field is what is on disk / machine-local right now,
+ * never a suggestion. Absent domains are reported as `undefined` config.
+ */
+export interface MeshInitCurrentConfigEcho {
+    /** Currently-saved `.adhdev/refine.json` (repo-committed) — undefined when absent/invalid. */
+    refine?: RepoMeshRefineConfig;
+    /** Currently-saved `.adhdev/worktree_bootstrap.json` (repo-committed). */
+    worktreeBootstrap?: RepoMeshWorktreeBootstrapConfig;
+    /** Currently-saved `.adhdev/change-impact.json` (repo-committed). */
+    changeImpact?: ChangeImpactConfig;
+    /** Per-domain source type so the coordinator can tell "absent" from "invalid". */
+    sourceTypes: {
+        refine: string;
+        worktreeBootstrap: string;
+        changeImpact: string;
+    };
+    /**
+     * Currently-configured MAGI kind→panel slot bindings (machine-local
+     * ~/.adhdev/meshes.json). Empty object when none configured. This is a
+     * machine-local echo — the coordinator labels it as such vs. the repo files.
+     */
+    magiKindPanels: MagiKindPanelMap;
+}
 export interface RunMeshInitResult {
     success: true;
     workspace: string;
     dryRun: boolean;
     refine: MeshInitConfigFileResult;
     worktreeBootstrap: MeshInitConfigFileResult;
+    changeImpact: MeshInitConfigFileResult;
     providers: {
         providerPriority: string[];
         installedProviders: Array<{
@@ -72,6 +108,12 @@ export interface RunMeshInitResult {
             version?: string;
         }>;
     };
+    /**
+     * Read-only snapshot of the currently-saved config per domain (repo files +
+     * machine-local kind panels). Lets the coordinator present a current-vs-suggested
+     * diff to the user before any overwrite. Always populated (dry-run and write).
+     */
+    currentConfig: MeshInitCurrentConfigEcho;
     note: string;
 }
 /**

package/dist/providers/native-history/hermes-cli-transcript.d.ts

@@ -26,5 +26,5 @@ export interface NativeHistorySessionMeta {
     preview?: string;
     workspace?: string;
 }
-export declare function readSession(sessionPath: string): NativeHistorySession | null;
+export declare function readSession(sessionPath: string, requestedSessionId?: string): NativeHistorySession | null;
 export declare function listSessions(_watchPath: string): Promise<NativeHistorySessionMeta[]>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.438",
+  "version": "0.9.82-rc.439",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.438",
+    "@adhdev/mesh-shared": "0.9.82-rc.439",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/med-family/mesh-crud.ts

@@ -232,6 +232,95 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
         }
     },
 
+    // Gated WRITE path for `.adhdev/mesh.json` — the sibling of export_mesh_json_config
+    // (which only DRAFTS). Same write/overwrite/dry-run contract as mesh_init's config
+    // writer: defaults to dry-run (no write), never clobbers an existing repo mesh.json
+    // unless overwrite=true, and validates the scaffold before persisting. The scaffold
+    // is built from the machine-local mesh entry (coordinator prompt override/append);
+    // policy/operating-notes are intentionally NOT exported (see buildMeshJsonConfigScaffold).
+    write_mesh_json_config: async (_ctx: MedFamilyContext, args: any) => {
+        const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
+        if (!meshId) return { success: false, error: 'meshId required' };
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        const write = args?.write === true;
+        const overwrite = args?.overwrite === true;
+        try {
+            const { getMesh } = await import('../../config/mesh-config.js');
+            const mesh = getMesh(meshId);
+            if (!mesh) return { success: false, error: 'Mesh not found' };
+            const {
+                buildMeshJsonConfigScaffold,
+                serializeMeshJsonConfigScaffold,
+                loadRepoMeshJsonConfig,
+                normalizeRepoMeshDeclarativeConfig,
+                MESH_JSON_CONFIG_LOCATIONS,
+            } = await import('../../config/mesh-json-config.js');
+            const { mkdirSync, writeFileSync } = await import('fs');
+            const { dirname, join } = await import('path');
+
+            const scaffold = buildMeshJsonConfigScaffold(mesh);
+            const scaffoldJson = serializeMeshJsonConfigScaffold(scaffold);
+            const relativePath = MESH_JSON_CONFIG_LOCATIONS[0];
+            const absolutePath = join(workspace, relativePath);
+
+            // Validate before we ever touch disk — never write an unusable mesh.json.
+            const validation = normalizeRepoMeshDeclarativeConfig(scaffold);
+            if (!validation.valid) {
+                return { success: false, meshId, error: `invalid mesh.json scaffold: ${validation.errors.join('; ')}` };
+            }
+
+            // existing-wins: a repo mesh.json already present is kept unless overwrite=true.
+            const existing = loadRepoMeshJsonConfig(workspace);
+            const existingPresent = existing.sourceType === 'repo_file' || existing.sourceType === 'invalid';
+            if (existingPresent && !overwrite) {
+                return {
+                    success: true,
+                    meshId,
+                    written: false,
+                    dryRun: !write,
+                    skippedReason: 'already_exists',
+                    path: absolutePath,
+                    relativePath,
+                    existing: existing.config,
+                    existingSourceType: existing.sourceType,
+                    scaffold,
+                    scaffoldJson,
+                    note: 'A repo mesh.json already exists — kept as-is. Re-run with overwrite=true to replace it (this silently drops operator hand-edits, so present a current-vs-suggested diff first).',
+                };
+            }
+
+            if (!write) {
+                return {
+                    success: true,
+                    meshId,
+                    written: false,
+                    dryRun: true,
+                    path: absolutePath,
+                    relativePath,
+                    scaffold,
+                    scaffoldJson,
+                    note: 'Dry-run: nothing written. Re-run with write=true to persist to the repo (commit target). meshes.json is untouched.',
+                };
+            }
+
+            mkdirSync(dirname(absolutePath), { recursive: true });
+            writeFileSync(absolutePath, `${scaffoldJson}\n`, 'utf-8');
+            return {
+                success: true,
+                meshId,
+                written: true,
+                dryRun: false,
+                path: absolutePath,
+                relativePath,
+                scaffold,
+                scaffoldJson,
+                note: 'Wrote .adhdev/mesh.json (repo commit target). Commit it to the repo; meshes.json (machine-local) is unchanged.',
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
     delete_mesh: async (_ctx: MedFamilyContext, args: any) => {
         const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
         if (!meshId) return { success: false, error: 'meshId required' };

package/src/config/chat-history.ts

@@ -1820,6 +1820,16 @@ function callProviderNativeHistoryRead(
     const result = fn({
         agentType,
         sessionId: normalizedSessionId,
+        // Arm the native-history executor's session pin guard. When the
+        // instance is already bound to a provider session, pass that id as
+        // `providerSessionId` so the executor rejects any *other* newest
+        // session it would otherwise pick (hermes ≥0.14 creates a fresh
+        // `sessions` row per internal sub-session, so an unpinned
+        // newest-wins query drifts to a different id on every read →
+        // re-bind churn + unbounded history re-hydration). When there is no
+        // bound id yet (first-bind / workspace-only discovery) this is '',
+        // which leaves the guard disarmed so discovery still works.
+        providerSessionId: normalizedSessionId,
         historySessionId: normalizedSessionId,
         workspace,
         format: canonicalHistory?.format,

package/src/index.ts

@@ -204,6 +204,7 @@ export type { CreateMeshOptions, UpdateMeshOptions, AddNodeOptions } from './con
 // them without taking a direct @adhdev/mesh-shared dependency).
 export type {
   MagiPanel, MagiPanelMember, MagiPanelMap, MagiMode, MagiTaskKind, MagiPanelDefaultKind,
+  MagiSlot, MagiKindPanelMap,
   MagiClaim, MagiClaimStance, MagiAgentResponse,
   MagiResponseSource, MagiReplicaGitRef, MagiGitSkew, MagiSynthesizedResponse,
   MagiClusterCategory, MagiClusterMember, MagiClaimCluster, MagiSynthesis,

package/src/mesh/coordinator-prompt.ts

@@ -207,6 +207,9 @@ Repository: \`${mesh.repoIdentity}\`${mesh.defaultBranch ? `\nDefault branch: \`
     // ── Workflow ──
     sections.push(WORKFLOW_SECTION);
 
+    // ── Onboarding / Reinit ──
+    sections.push(ONBOARDING_SECTION);
+
     // ── Rules ──
     sections.push(buildRulesSection(coordinatorCliType));
 
@@ -255,6 +258,7 @@ function readUserPromptFile(cliType: string | undefined, suffix: string): string
  *   {{policy}}          — full policy section
  *   {{tools}}           — the canonical tools table
  *   {{workflow}}        — the canonical orchestration workflow
+ *   {{onboarding}}      — the guided init/reinit onboarding section
  *   {{rules}}           — the canonical rules section (with coordinatorNote)
  *   {{toolExposurePreflight}} — the MCP-missing preflight reminder
  *
@@ -281,6 +285,7 @@ function expandPromptPlaceholders(template: string, ctx: CoordinatorPromptContex
         policy: buildPolicySection(mergeAndNormalizePolicy(undefined, mesh.policy)),
         tools: TOOLS_SECTION,
         workflow: WORKFLOW_SECTION,
+        onboarding: ONBOARDING_SECTION,
         rules: buildRulesSection(coordinatorCliType),
         toolExposurePreflight: TOOL_EXPOSURE_PREFLIGHT_SECTION,
     };
@@ -493,7 +498,12 @@ const TOOLS_SECTION = `## Available Tools
 | \`mesh_clone_node\` | Create a worktree node for isolated parallel branch work |
 | \`mesh_refine_node\` | Validate and merge a completed worktree node back into its base branch |
 | \`mesh_remove_node\` | Remove a node (cleans up worktree if applicable) |
-| \`mesh_cleanup_sessions\` | Manually clean up delegated session records for a node |`;
+| \`mesh_cleanup_sessions\` | Manually clean up delegated session records for a node |
+| \`mesh_init\` | Guided onboarding for a fresh repo: dry-run scan → suggest \`.adhdev/*\` configs (refine/bootstrap/change-impact) + providerPriority + current-config echo; gated write on approval |
+| \`mesh_reinit\` | Re-onboard an already-configured repo: re-suggest with overwrite semantics + current-vs-suggested diff; dry-run preview first, per-section approval before write |
+| \`mesh_write_mesh_json_config\` | Gated write of \`.adhdev/mesh.json\` (repo coordinator-prompt config) from the mesh entry — dry-run/overwrite like mesh_init |
+| \`mesh_magi_kind_panel_set\` | Bind a task_kind → MAGI kind-panel slots (machine-local, wholesale replacement — approve current-vs-new first) |
+| \`mesh_magi_kind_panel_list\` | List configured task_kind → MAGI kind-panel slot bindings (machine-local, read-only) |`;
 
 const TOOL_EXPOSURE_PREFLIGHT_SECTION = `## Tool Exposure Preflight
 
@@ -529,6 +539,29 @@ Follow these recovery rules:
 3. **If no recovery context**: The stop may be intentional (normal completion). Use \`mesh_read_chat\` once to verify, then move on.
 4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.`;
 
+const ONBOARDING_SECTION = `## Onboarding / Reinit
+
+When the user asks to **set up / configure / onboard** this repo for Repo Mesh (or to **re-init / reconfigure** an already-onboarded repo), run ONE guided, approval-gated conversation. You draft, the user approves, the daemon writes. Never auto-write a heuristic suggestion without an explicit user approval turn.
+
+**Save scopes — label every draft with its scope before asking for approval:**
+- **repo-file (commit target)** — \`.adhdev/refine.json\`, \`.adhdev/worktree_bootstrap.json\`, \`.adhdev/change-impact.json\`, \`.adhdev/mesh.json\`. These are committed to the repository and shared with every machine/contributor.
+- **machine-local** — MAGI kind→panel bindings and named MAGI panels, node providerPriority (\`~/.adhdev/meshes.json\`). These stay on this machine and are NOT committed.
+
+**Guided sequence:**
+1. **Scan (dry-run)** — Call \`mesh_init\` (write=false, the default). It returns per-domain suggested configs for refine / worktree_bootstrap / change-impact, a recommended providerPriority, AND \`currentConfig\` — the currently-saved config per domain (repo files + machine-local \`magiKindPanels\`). Nothing is written.
+2. **Present drafts** — For each domain, show the user the suggested config with its **save scope label** (repo-file vs machine-local). When \`currentConfig\` already has a saved value for a domain (init on a partially-onboarded repo, or any reinit), present a **current-vs-suggested diff**, not just the suggestion.
+3. **Approve → gated write** — Only after the user approves, call the matching gated-write tool:
+   - repo \`.adhdev/*\` config files → \`mesh_init\` with \`write=true\` (and \`overwrite=true\` ONLY for domains the user approved replacing).
+   - \`.adhdev/mesh.json\` (coordinator prompt / operating notes) → \`mesh_write_mesh_json_config\` (write=true, overwrite only if approved).
+   - machine-local MAGI kind→panel slots → \`mesh_magi_kind_panel_set\` (write=true). NOTE: a kind binding is a **wholesale replacement** of that kind's slot list — present the current-vs-new slots first.
+   - machine-local named MAGI panels → \`mesh_magi_panel_set\`. providerPriority → apply via node policy update.
+
+**init vs reinit:**
+- **\`mesh_init\`** — for a fresh, never-onboarded repo. Existing config files are kept (existing-wins) unless the user explicitly approves overwrite. Use for first-time setup.
+- **\`mesh_reinit\`** — for a repo that is already onboarded and needs its config refreshed. It re-suggests with OVERWRITE semantics and returns the current-vs-suggested \`currentConfig\` echo. Its first call is a DRY-RUN preview: you MUST present the per-section current-vs-suggested diff and get EXPLICIT per-section approval before re-invoking with write=true. Overwrite is a wholesale replacement, so it silently drops operator hand-edits if you skip the diff — never do that.
+
+`;
+
 function buildRulesSection(coordinatorCliType?: string): string {
     const coordinatorNote = coordinatorCliType
         ? `\n- **Coordinator runtime is not a delegation default.** This coordinator is running as \`${coordinatorCliType}\`, but delegated node sessions must follow the user's requested provider, not the coordinator's own runtime.`

package/src/mesh/mesh-init.ts

@@ -4,7 +4,13 @@
  * One-shot helper that onboards an existing git project into Repo Mesh:
  *   1. suggest + write `.adhdev/refine.json`           (Refinery validation config)
  *   2. suggest + write `.adhdev/worktree_bootstrap.json` (worktree bootstrap config)
- *   3. recommend a node providerPriority from the installed CLI providers
+ *   3. suggest + write `.adhdev/change-impact.json`     (change-impact classification)
+ *   4. recommend a node providerPriority from the installed CLI providers
+ *
+ * mesh_init now covers all THREE repo-committed `.adhdev/*` config families that
+ * carry a suggest→validate→write engine (refine + worktree_bootstrap +
+ * change-impact). `.adhdev/mesh.json` (coordinator prompt + operating notes) has
+ * its own dedicated export/write path (export_mesh_json_config / write_mesh_json_config).
  *
  * Design contract (matches the rest of the mesh tooling):
  *   - Heuristics are suggestion/scaffold only. The written files are the
@@ -34,11 +40,21 @@ import {
     validateMeshWorktreeBootstrapConfig,
     type RepoMeshWorktreeBootstrapConfig,
 } from './worktree-bootstrap-config.js';
+import {
+    CHANGE_IMPACT_CONFIG_LOCATIONS,
+    loadChangeImpactConfig,
+    suggestChangeImpactConfig,
+    validateChangeImpactConfig,
+    type ChangeImpactConfig,
+} from '../git/change-impact-config.js';
+import { listMagiKindPanels } from '../config/mesh-config.js';
+import type { MagiKindPanelMap } from '@adhdev/mesh-shared';
 import type { CLIInfo } from '../detection/cli-detector.js';
 
 /** Canonical write targets — the first/preferred location for each config family. */
 export const MESH_INIT_REFINE_CONFIG_PATH = MESH_REFINE_CONFIG_LOCATIONS[0];
 export const MESH_INIT_WORKTREE_BOOTSTRAP_CONFIG_PATH = MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS[0];
+export const MESH_INIT_CHANGE_IMPACT_CONFIG_PATH = CHANGE_IMPACT_CONFIG_LOCATIONS[0];
 
 /**
  * Default lockfiles whose change should invalidate a 'ready' bootstrap.
@@ -61,7 +77,7 @@ export interface MeshInitConfigFileResult {
     written: boolean;
     /** Why it was not written (already_exists / not_suggested / no change). */
     skippedReason?: 'already_exists' | 'no_suggestion';
-    config?: RepoMeshRefineConfig | RepoMeshWorktreeBootstrapConfig;
+    config?: RepoMeshRefineConfig | RepoMeshWorktreeBootstrapConfig | ChangeImpactConfig;
 }
 
 /**
@@ -158,16 +174,50 @@ export interface RunMeshInitOptions {
     overwrite?: boolean;
 }
 
+/**
+ * A snapshot of the currently-saved config for each domain, so the coordinator can
+ * render a current-vs-suggested diff to the user before an init/reinit overwrite.
+ * This is READ-ONLY echo — every field is what is on disk / machine-local right now,
+ * never a suggestion. Absent domains are reported as `undefined` config.
+ */
+export interface MeshInitCurrentConfigEcho {
+    /** Currently-saved `.adhdev/refine.json` (repo-committed) — undefined when absent/invalid. */
+    refine?: RepoMeshRefineConfig;
+    /** Currently-saved `.adhdev/worktree_bootstrap.json` (repo-committed). */
+    worktreeBootstrap?: RepoMeshWorktreeBootstrapConfig;
+    /** Currently-saved `.adhdev/change-impact.json` (repo-committed). */
+    changeImpact?: ChangeImpactConfig;
+    /** Per-domain source type so the coordinator can tell "absent" from "invalid". */
+    sourceTypes: {
+        refine: string;
+        worktreeBootstrap: string;
+        changeImpact: string;
+    };
+    /**
+     * Currently-configured MAGI kind→panel slot bindings (machine-local
+     * ~/.adhdev/meshes.json). Empty object when none configured. This is a
+     * machine-local echo — the coordinator labels it as such vs. the repo files.
+     */
+    magiKindPanels: MagiKindPanelMap;
+}
+
 export interface RunMeshInitResult {
     success: true;
     workspace: string;
     dryRun: boolean;
     refine: MeshInitConfigFileResult;
     worktreeBootstrap: MeshInitConfigFileResult;
+    changeImpact: MeshInitConfigFileResult;
     providers: {
         providerPriority: string[];
         installedProviders: Array<{ id: string; displayName: string; version?: string }>;
     };
+    /**
+     * Read-only snapshot of the currently-saved config per domain (repo files +
+     * machine-local kind panels). Lets the coordinator present a current-vs-suggested
+     * diff to the user before any overwrite. Always populated (dry-run and write).
+     */
+    currentConfig: MeshInitCurrentConfigEcho;
     note: string;
 }
 
@@ -210,18 +260,58 @@ export function runMeshInit(
         overwrite,
     });
 
+    // change-impact classification (.adhdev/change-impact.json). suggest/validate/save
+    // mirror refine's engine exactly, so it drops into the same applyConfigSuggestion
+    // gate: existing-wins unless overwrite, dry-run by default, validated before write.
+    const changeImpactLoaded = loadChangeImpactConfig(workspace);
+    const changeImpact = applyConfigSuggestion({
+        workspace,
+        relativePath: MESH_INIT_CHANGE_IMPACT_CONFIG_PATH,
+        existing: changeImpactLoaded.sourceType === 'repo_file' ? changeImpactLoaded.config : undefined,
+        suggestedConfig: suggestChangeImpactConfig(workspace).suggestedConfig,
+        validate: (config) => validateChangeImpactConfig(config, MESH_INIT_CHANGE_IMPACT_CONFIG_PATH).valid,
+        write,
+        overwrite,
+    });
+
     const providers = suggestNodeProviderPriority(detected);
 
+    // Read-only echo of the currently-saved config per domain so the coordinator can
+    // present a current-vs-suggested diff before any overwrite (init vs reinit). This
+    // never suggests — it reports what is on disk / machine-local right now.
+    const refineLoaded = loadMeshRefineConfig(mesh, workspace);
+    const bootstrapLoaded = loadMeshWorktreeBootstrapConfig(mesh, workspace);
+    let magiKindPanels: MagiKindPanelMap = {};
+    try {
+        magiKindPanels = listMagiKindPanels();
+    } catch {
+        // Machine-local config unreadable — echo an empty binding rather than failing init.
+        magiKindPanels = {};
+    }
+    const currentConfig: MeshInitCurrentConfigEcho = {
+        refine: refineLoaded.config,
+        worktreeBootstrap: bootstrapLoaded.config,
+        changeImpact: changeImpactLoaded.sourceType === 'repo_file' ? changeImpactLoaded.config : undefined,
+        sourceTypes: {
+            refine: refineLoaded.sourceType,
+            worktreeBootstrap: bootstrapLoaded.sourceType,
+            changeImpact: changeImpactLoaded.sourceType,
+        },
+        magiKindPanels,
+    };
+
     return {
         success: true,
         workspace,
         dryRun: !write,
         refine,
         worktreeBootstrap,
+        changeImpact,
         providers,
+        currentConfig,
         note: write
-            ? 'Configs written to disk are the execution source of truth; suggestions are scaffold and only take effect once saved. providerPriority is a recommendation — apply it to node policy via clone/policy update.'
-            : 'Dry-run: no files written. Re-run with write=true to persist the suggested configs. Heuristic suggestions never execute until saved as repo config.',
+            ? 'Configs written to disk are the execution source of truth; suggestions are scaffold and only take effect once saved. providerPriority is a recommendation — apply it to node policy via clone/policy update. currentConfig echoes what was on disk before this run.'
+            : 'Dry-run: no files written. Re-run with write=true to persist the suggested configs. Heuristic suggestions never execute until saved as repo config. Use currentConfig to diff current-vs-suggested before overwriting.',
     };
 }
 
@@ -234,7 +324,7 @@ function applyConfigSuggestion(input: {
     workspace: string;
     relativePath: string;
     existing?: unknown;
-    suggestedConfig?: RepoMeshRefineConfig | RepoMeshWorktreeBootstrapConfig;
+    suggestedConfig?: RepoMeshRefineConfig | RepoMeshWorktreeBootstrapConfig | ChangeImpactConfig;
     validate: (config: unknown) => boolean;
     write: boolean;
     overwrite: boolean;

package/src/providers/cli-provider-instance.ts

@@ -2813,7 +2813,13 @@ export class CliProviderInstance implements ProviderInstance {
             typeof data.providerSessionId === 'string' ? data.providerSessionId : '',
         );
         if (patchedProviderSessionId) {
-            this.promoteProviderSessionId(patchedProviderSessionId);
+            // A provider-response id is authoritative when it carries an
+            // explicit `new_session` marker (the CLI genuinely started a new
+            // conversation). Without that marker it's just an observed id and
+            // must not hijack an existing binding (see promoteProviderSessionId).
+            this.promoteProviderSessionId(patchedProviderSessionId, {
+                authoritative: data.sessionEvent === 'new_session',
+            });
         }
 
         if (data.sessionEvent === 'new_session') {
@@ -3167,10 +3173,26 @@ export class CliProviderInstance implements ProviderInstance {
         return lines.join('\n');
     }
 
-    private promoteProviderSessionId(sessionId: string): void {
+    private promoteProviderSessionId(sessionId: string, opts: { authoritative?: boolean } = {}): void {
         const nextSessionId = String(sessionId || '').trim();
         if (!nextSessionId || nextSessionId === this.providerSessionId) return;
 
+        // Sticky binding: once this instance is bound to a provider session,
+        // an *observed* id (one discovered from a status parse or the native
+        // history reader) must NOT hijack the live binding. hermes ≥0.14
+        // spawns a fresh `sessions` row per internal sub-session, so a
+        // newest-wins native read surfaces a different id mid-turn on every
+        // poll; accepting it would re-bind the instance, re-hydrate unbounded
+        // history (daemon saturation) and reset completion detection so the
+        // turn never finalizes. Only an *authoritative* change — the first
+        // bind (no id yet) or an explicit provider `new_session`/resume — may
+        // replace an existing binding. Legitimate resume/new-session paths
+        // pass authoritative:true and are unaffected.
+        if (this.providerSessionId && !opts.authoritative) {
+            LOG.debug('CLI', `[${this.type}] ignoring non-authoritative session id ${nextSessionId} (bound to ${this.providerSessionId})`);
+            return;
+        }
+
         const previousHistorySessionId = this.providerSessionId || this.instanceId;
         const previousProviderSessionId = this.providerSessionId;
         this.providerSessionId = nextSessionId;

package/src/providers/native-history/dispatcher.ts

@@ -66,7 +66,7 @@ export function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeH
             try { fs.statSync(sourcePath); } catch { /* best-effort metadata refresh */ }
         }
 
-        const session = readByReader(reader, sourcePath, sessionId, workspace);
+        const session = readByReader(reader, sourcePath, sessionId, workspace, requestedProviderSid);
         if (!session) return null;
 
         if (requestedProviderSid && session.providerSessionId && session.providerSessionId !== requestedProviderSid) {
@@ -265,12 +265,18 @@ function readByReader(
     sourcePath: string,
     sessionId: string,
     workspace: string,
+    requestedProviderSid: string,
 ): any | null {
     switch (reader) {
         case 'claude-cli':      return readClaudeCliSession(sourcePath);
         case 'codex-cli':       return readCodexCliSession(sourcePath);
         case 'antigravity-cli': return readAntigravityCliSession(sourcePath, sessionId || undefined, workspace || undefined);
-        case 'hermes-cli':      return readHermesCliSession(sourcePath);
+        // hermes reads a *shared* state.db and would otherwise pick the newest
+        // source='cli' session, which drifts every read (hermes ≥0.14 writes a
+        // fresh row per internal sub-session). Pass the bound id so it reads
+        // THAT session directly instead of newest-wins. claude/codex resolve a
+        // per-session file upstream, so they need no equivalent pin here.
+        case 'hermes-cli':      return readHermesCliSession(sourcePath, requestedProviderSid || undefined);
     }
 }
 

package/src/providers/native-history/hermes-cli-transcript.ts

@@ -93,26 +93,42 @@ function loadMessagesForSession(db: any, sessionId: string): NativeHistoryMessag
     return out;
 }
 
-export function readSession(sessionPath: string): NativeHistorySession | null {
+export function readSession(sessionPath: string, requestedSessionId?: string): NativeHistorySession | null {
     if (!sessionPath) return null;
 
-    // Path mode A: SQLite — sourcePath is the state.db path. Pick the
-    // newest source='cli' session that has at least one persisted message.
+    // Path mode A: SQLite — sourcePath is the state.db path.
     if (sessionPath === HERMES_STATE_DB) {
         const db = openDb();
         if (!db) return null;
         try {
-            const row: any = db.prepare(
-                `SELECT id, started_at FROM sessions
-                 WHERE source = 'cli' AND message_count > 0
-                 ORDER BY started_at DESC LIMIT 1`,
-            ).get();
-            if (!row) return null;
-            const messages = loadMessagesForSession(db, row.id);
+            const pinned = String(requestedSessionId || '').trim();
+            let sessionId: string;
+            if (pinned) {
+                // Session pin: the caller is already bound to a specific
+                // provider session, so read THAT session directly instead of
+                // the newest-wins pick below. hermes ≥0.14 writes a fresh
+                // `sessions` row per internal sub-session, so an unpinned
+                // `ORDER BY started_at DESC LIMIT 1` drifts to a different id
+                // on every read → re-bind churn + reading completion evidence
+                // from the wrong session. loadMessagesForSession returning
+                // rows validates the id exists.
+                sessionId = pinned;
+            } else {
+                // No bound id yet (discovery): pick the newest source='cli'
+                // session that has at least one persisted message.
+                const row: any = db.prepare(
+                    `SELECT id, started_at FROM sessions
+                     WHERE source = 'cli' AND message_count > 0
+                     ORDER BY started_at DESC LIMIT 1`,
+                ).get();
+                if (!row) return null;
+                sessionId = String(row.id);
+            }
+            const messages = loadMessagesForSession(db, sessionId);
             if (messages.length === 0) return null;
             return {
                 messages,
-                providerSessionId: String(row.id),
+                providerSessionId: sessionId,
                 source: 'provider-native',
                 sourcePath: sessionPath,
                 sourceMtimeMs: statMtimeMs(sessionPath),