@adhdev/daemon-core 0.9.82-rc.448 → 0.9.82-rc.449

package/dist/providers/spec/adapter.d.ts

@@ -80,6 +80,13 @@ export declare class TerminalAdapter {
         col: number;
     };
     send_keys(text: string): void;
+    /** Forward runtime metadata (meshNodeId, workspaceLabel, lifecycle, …) to
+     *  the underlying transport so it reaches the session registry. The spec
+     *  path previously dropped everything but providerSessionId here, which
+     *  left autoLaunch's meshNodeId stamp unbound on the record (see
+     *  SESSION-ACCUMULATION-LEAK). No-op when the transport does not support
+     *  metadata updates (e.g. plain node-pty). */
+    updateMeta(meta: Record<string, unknown>, replace?: boolean): void;
     /** Debug-only: most-recent PTY input/output/resize/cursor events, oldest
      *  first. Pure observation — never consulted by the FSM. */
     getEventTimeline(limit?: number): SpecPtyEvent[];

package/dist/providers/spec/fsm-driver.d.ts

@@ -119,6 +119,7 @@ export interface ISpecDriver {
     subscribe(listener: (ev: DashboardEvent) => void): () => void;
     start(): void;
     dispatch(cmd: DashboardCommand): void;
+    updateMeta(meta: Record<string, unknown>, replace?: boolean): void;
     snapshot(): string;
     getCursorPosition(): {
         row: number;
@@ -232,6 +233,11 @@ export declare class FsmDriver implements ISpecDriver {
      *  declares no prime, so non-focus-gated CLIs are never poked. */
     private sendSpawnPrime;
     dispatch(cmd: DashboardCommand): void;
+    /** Forward runtime metadata to the terminal transport so mesh binding
+     *  fields (meshNodeId / meshNodeFor / workspaceLabel / lifecycle) reach
+     *  the session registry. Not a DashboardCommand — this is a control-plane
+     *  update, not user input. */
+    updateMeta(meta: Record<string, unknown>, replace?: boolean): void;
     snapshot(): string;
     getCursorPosition(): {
         row: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.448",
+  "version": "0.9.82-rc.449",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,7 +46,7 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.448",
+    "@adhdev/mesh-shared": "0.9.82-rc.449",
     "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",

package/src/commands/cli-manager.ts

@@ -209,6 +209,16 @@ export interface CliTransportFactoryParams {
     cliArgs?: string[];
     providerSessionId?: string;
     attachExisting?: boolean;
+    /**
+     * Launch-time record meta (meshNodeId / meshNodeFor / launchedByCoordinator /
+     * autoLaunchedForQueueTaskId). Defense-in-depth for SESSION-ACCUMULATION-LEAK:
+     * a session-host factory impl SHOULD seed the create_session record with this
+     * so the node binding is present the instant the record exists, rather than
+     * relying solely on the post-spawn updateRuntimeMeta round-trip. Optional and
+     * additive — factory impls that ignore it keep the prior behavior; the
+     * post-spawn WTDISPATCH stamp in register() still runs as the primary path.
+     */
+    initialMeta?: Record<string, unknown>;
 }
 
 export interface HostedCliRuntimeDescriptor {
@@ -578,6 +588,7 @@ export class DaemonCliManager {
         cliArgs?: string[],
         providerSessionId?: string,
         attachExisting = false,
+        initialMeta?: Record<string, unknown>,
     ): PtyTransportFactory | undefined {
         return this.deps.createPtyTransportFactory?.({
             runtimeId,
@@ -586,6 +597,7 @@ export class DaemonCliManager {
             cliArgs,
             providerSessionId,
             attachExisting,
+            ...(initialMeta && Object.keys(initialMeta).length ? { initialMeta } : {}),
         }) || undefined;
     }
 
@@ -674,6 +686,24 @@ export class DaemonCliManager {
         const instanceManager = this.deps.getInstanceManager();
         const sessionRegistry = this.deps.getSessionRegistry?.() || null;
         if (!instanceManager) throw new Error('InstanceManager not available');
+
+        // Launch-time record meta (mesh node binding) — computed BEFORE the
+        // transport factory so the session-host record can be seeded with the
+        // binding at create_session time (Fix ②, defense-in-depth for
+        // SESSION-ACCUMULATION-LEAK), not only via the post-spawn WTDISPATCH
+        // updateRuntimeMeta round-trip below. See CliTransportFactoryParams.initialMeta.
+        const launchMeshNodeId = typeof settings?.meshNodeId === 'string' ? settings.meshNodeId.trim() : '';
+        const launchMeshNodeFor = typeof settings?.meshNodeFor === 'string' ? settings.meshNodeFor.trim() : '';
+        const launchAutoLaunchedForQueueTaskId = typeof settings?.autoLaunchedForQueueTaskId === 'string'
+            ? settings.autoLaunchedForQueueTaskId.trim()
+            : '';
+        const launchRecordMeta: Record<string, unknown> = {
+            ...(launchMeshNodeId ? { meshNodeId: launchMeshNodeId } : {}),
+            ...(launchMeshNodeFor ? { meshNodeFor: launchMeshNodeFor } : {}),
+            ...(settings?.launchedByCoordinator === true ? { launchedByCoordinator: true } : {}),
+            ...(launchAutoLaunchedForQueueTaskId ? { autoLaunchedForQueueTaskId: launchAutoLaunchedForQueueTaskId } : {}),
+        };
+
         const transportFactory = this.getTransportFactory(
             key,
             normalizedType,
@@ -681,6 +711,9 @@ export class DaemonCliManager {
             cliArgs,
             options?.providerSessionId,
             attachExisting,
+            // Only seed at create time for fresh launches — an attach restores an
+            // existing record whose meta is already stamped; re-seeding could clobber.
+            attachExisting ? undefined : launchRecordMeta,
         );
         const cliInstance = new CliProviderInstance(provider, resolvedDir, cliArgs, key, transportFactory, options);
         try {
@@ -728,24 +761,15 @@ export class DaemonCliManager {
         // sibling worktree nodes cannot tell two co-located clones apart. Push the launch-time node
         // binding to the record meta so the record is 1:1 bound to its node (the spawned pty exists
         // by now, so updateMeta reaches the session-host store). Best-effort; guarded.
-        const launchMeshNodeId = typeof settings?.meshNodeId === 'string' ? settings.meshNodeId.trim() : '';
-        const launchMeshNodeFor = typeof settings?.meshNodeFor === 'string' ? settings.meshNodeFor.trim() : '';
-        // Auto-launch attribution: the queue stamps the task id it auto-launched this
-        // worker FOR (autoLaunchedForQueueTaskId). Mirror it onto the record meta so a
-        // later cleanup (e.g. MAGI post-review auto-cleanup) can verify a session was
-        // auto-launched for a SPECIFIC replica task before stopping/deleting it — a reused
-        // idle session never carries this marker, so it is preserved.
-        const launchAutoLaunchedForQueueTaskId = typeof settings?.autoLaunchedForQueueTaskId === 'string'
-            ? settings.autoLaunchedForQueueTaskId.trim()
-            : '';
-        if (launchMeshNodeId || launchMeshNodeFor || launchAutoLaunchedForQueueTaskId) {
+        //
+        // With the spec-CLI updateRuntimeMeta fix (SpecCliAdapter now forwards the FULL
+        // meta down to the transport, not just providerSessionId), this stamp finally
+        // reaches the session-host record for spec-backed providers too — previously it
+        // was silently dropped, which is what let orphans accumulate. launchRecordMeta
+        // is hoisted above and also seeds the create_session record via initialMeta.
+        if (Object.keys(launchRecordMeta).length) {
             try {
-                cliInstance.getAdapter().updateRuntimeMeta?.({
-                    ...(launchMeshNodeId ? { meshNodeId: launchMeshNodeId } : {}),
-                    ...(launchMeshNodeFor ? { meshNodeFor: launchMeshNodeFor } : {}),
-                    ...(settings?.launchedByCoordinator === true ? { launchedByCoordinator: true } : {}),
-                    ...(launchAutoLaunchedForQueueTaskId ? { autoLaunchedForQueueTaskId: launchAutoLaunchedForQueueTaskId } : {}),
-                });
+                cliInstance.getAdapter().updateRuntimeMeta?.({ ...launchRecordMeta });
             } catch { /* best-effort — record-meta stamp is cleanup hygiene, not on the dispatch path */ }
         }
 

package/src/commands/med-family/mesh-crud.ts

@@ -9,7 +9,7 @@
  * Extracted verbatim from executeDaemonCommand; the inline-cache, session/worktree
  * cleanup and aggregate-status collaborators come from ctx.
  */
-import { daemonIdsEquivalent, meshNodeIdMatches } from '@adhdev/mesh-shared';
+import { daemonIdsEquivalent, meshNodeIdMatches, normalizeMeshNodeId } from '@adhdev/mesh-shared';
 import { resolveMeshHostStatus, normalizeMeshDaemonRole } from '../../mesh/mesh-host-ownership.js';
 import {
     loadMeshWorktreeBootstrapConfig,
@@ -558,6 +558,15 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                 && !Array.isArray(args.requireAutoLaunchedForTaskIds))
                 ? args.requireAutoLaunchedForTaskIds as Record<string, string>
                 : undefined;
+            // Opt-in orphan reclaim (SESSION-ACCUMULATION-LEAK). The live-node id set
+            // is the CURRENT mesh membership; a matched live session bound to a node
+            // still in this set is an active sibling and is never reclaimed. Only when
+            // the caller passes reclaimOrphans:true does the router loosen the
+            // shared-daemon guard for workspace-only / dead-node-bound live sessions.
+            const reclaimOrphans = args?.reclaimOrphans === true;
+            const liveMeshNodeIds = Array.isArray(mesh?.nodes)
+                ? mesh.nodes.map((n: any) => normalizeMeshNodeId(n)).filter(Boolean) as string[]
+                : [];
             const result = await ctx.cleanupMeshSessions({
                 meshId,
                 nodeId,
@@ -567,6 +576,8 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                 dryRun: args?.dryRun === true,
                 source,
                 requireAutoLaunchedForTaskIds,
+                reclaimOrphans,
+                liveMeshNodeIds,
             });
             return result;
         } catch (e: any) {

package/src/commands/med-family/types.ts

@@ -86,6 +86,16 @@ export interface MedFamilyContext {
         dryRun?: boolean;
         source?: 'mesh_cleanup_sessions' | 'mesh_remove_node' | 'magi_session_cleanup';
         requireAutoLaunchedForTaskIds?: Record<string, string>;
+        /**
+         * Opt-in orphan reclaim (default false). When true, a workspace-only live
+         * session (no node binding) OR a session bound to a node that no longer
+         * exists in `liveMeshNodeIds` is stopped instead of skipped — reclaims the
+         * SESSION-ACCUMULATION-LEAK orphans. `liveMeshNodeIds` is the current mesh's
+         * node id set; a session whose meshNodeId is still present is treated as an
+         * active sibling and left alone.
+         */
+        reclaimOrphans?: boolean;
+        liveMeshNodeIds?: string[];
     }) => Promise<{ success: boolean; [key: string]: unknown }>;
 
     /** Bound `DaemonCommandRouter.cleanupLocalWorktreeNode`. */

package/src/commands/router.ts

@@ -1468,6 +1468,16 @@ export class DaemonCommandRouter {
          * didn't itself spawn for this fan-out. Only consulted alongside explicit sessionIds.
          */
         requireAutoLaunchedForTaskIds?: Record<string, string>;
+        /**
+         * Opt-in orphan reclaim (default false). See SESSION-ACCUMULATION-LEAK.
+         * When true, a workspace-only live_runtime session (no node binding) OR a
+         * live_runtime session bound to a node absent from `liveMeshNodeIds` is
+         * stopped instead of skipped by the conservative shared-daemon guard. A
+         * session whose meshNodeId is STILL in `liveMeshNodeIds` (active sibling)
+         * is never reclaimed — that is the shared-daemon safety this preserves.
+         */
+        reclaimOrphans?: boolean;
+        liveMeshNodeIds?: string[];
     }): Promise<{ success: boolean; [key: string]: unknown }> {
         if (args.mode === 'preserve') {
             return { success: true, mode: 'preserve', matchedCount: 0, stoppedSessionIds: [], deletedSessionIds: [], skippedSessionIds: [] };
@@ -1477,6 +1487,23 @@ export class DaemonCommandRouter {
         const requestedSessionIds = Array.isArray(args.sessionIds)
             ? new Set(args.sessionIds.map(id => typeof id === 'string' ? id.trim() : '').filter(Boolean))
             : undefined;
+        // Orphan-reclaim support (opt-in). The live-node id list lets us tell an
+        // orphan (owning node gone from the mesh) apart from a still-active sibling
+        // sharing this daemon. daemonIdsEquivalent (not raw ===) guards against the
+        // canon-identity defect class: daemonId forms (daemon_mach_ vs mach_) and
+        // normalized vs raw meshNodeId must compare equivalent, not literally equal.
+        const reclaimOrphans = args.reclaimOrphans === true;
+        const liveMeshNodeIds = Array.isArray(args.liveMeshNodeIds)
+            ? args.liveMeshNodeIds.map(id => typeof id === 'string' ? id.trim() : '').filter(Boolean)
+            : [];
+        const isNodeStillLive = (candidateNodeId: string): boolean => {
+            if (!candidateNodeId) return false;
+            return liveMeshNodeIds.some(liveId =>
+                liveId === candidateNodeId
+                || meshNodeIdMatches({ id: liveId }, candidateNodeId)
+                || daemonIdsEquivalent(liveId, candidateNodeId));
+        };
+        const reclaimedOrphanSessionIds: string[] = [];
         const sessions = await this.deps.sessionHostControl.listSessions();
         const matched = sessions.filter(record => this.sessionMatchesMeshNode(record, args.node, args.nodeId, requestedSessionIds));
         const hasExplicitSessionIds = !!requestedSessionIds?.size;
@@ -1579,7 +1606,18 @@ export class DaemonCommandRouter {
             const matchedByWorkspaceOnly = !recordNodeId;
             const isWorktreeNodeRemoval = cleanupSource === 'mesh_remove_node' && args.node?.isLocalWorktree === true;
             const cleanWorkspaceOnlyForWorktree = isWorktreeNodeRemoval && matchedByWorkspaceOnly;
-            if (!hasExplicitSessionIds && liveRuntime && !delegateBoundToThisNode && !cleanWorkspaceOnlyForWorktree) {
+            // Opt-in orphan reclaim (SESSION-ACCUMULATION-LEAK): a live_runtime that
+            // is either workspace-only (no node binding — the leaked spec-CLI case)
+            // or bound to a node no longer present in the mesh is an orphan and safe
+            // to stop. A session bound to a node STILL live in the mesh is an active
+            // sibling on this shared daemon and is left to the normal guard. Node
+            // equivalence uses isNodeStillLive (daemonIdsEquivalent under the hood),
+            // never a raw === on the id form.
+            const reclaimableOrphan = reclaimOrphans
+                && liveRuntime
+                && !delegateBoundToThisNode
+                && (matchedByWorkspaceOnly || !isNodeStillLive(recordNodeId));
+            if (!hasExplicitSessionIds && liveRuntime && !delegateBoundToThisNode && !cleanWorkspaceOnlyForWorktree && !reclaimableOrphan) {
                 skippedSessionIds.push(sessionId);
                 skippedLiveSessionIds.push(sessionId);
                 const reason = recordNodeId && recordNodeId !== args.nodeId
@@ -1595,6 +1633,12 @@ export class DaemonCommandRouter {
                 // like a bound delegate for accounting (so callers can see it was acted on).
                 actedLiveDelegateSessionIds.push(sessionId);
             }
+            if (reclaimableOrphan && !cleanWorkspaceOnlyForWorktree && !delegateBoundToThisNode) {
+                // Reclaimed orphan — surface it distinctly so callers can audit what
+                // the opt-in reclaim path stopped that the normal guard would have kept.
+                reclaimedOrphanSessionIds.push(sessionId);
+                actedLiveDelegateSessionIds.push(sessionId);
+            }
             if (!hasExplicitSessionIds && liveRuntime && delegateBoundToThisNode && args.mode === 'delete_stopped') {
                 // delete_stopped never stops live runtimes by contract — even bound delegates.
                 // Surface a clear reason instead of an unexplained skip so callers know to use
@@ -1674,6 +1718,7 @@ export class DaemonCommandRouter {
             skippedCoordinatorSessionIds,
             ...(skippedMarkerMismatchSessionIds.length ? { skippedMarkerMismatchSessionIds } : {}),
             ...(actedLiveDelegateSessionIds.length ? { actedLiveDelegateSessionIds } : {}),
+            ...(reclaimedOrphanSessionIds.length ? { reclaimedOrphanSessionIds } : {}),
             ...(skippedLiveSessionReasons.length ? { skippedLiveSessionReasons } : {}),
             ...(deleteUnsupported ? {
                 deleteUnsupported: true,

package/src/providers/spec/adapter.ts

@@ -180,6 +180,17 @@ export class TerminalAdapter {
         this.pty?.write(text);
     }
 
+    /** Forward runtime metadata (meshNodeId, workspaceLabel, lifecycle, …) to
+     *  the underlying transport so it reaches the session registry. The spec
+     *  path previously dropped everything but providerSessionId here, which
+     *  left autoLaunch's meshNodeId stamp unbound on the record (see
+     *  SESSION-ACCUMULATION-LEAK). No-op when the transport does not support
+     *  metadata updates (e.g. plain node-pty). */
+    updateMeta(meta: Record<string, unknown>, replace = false): void {
+        if (!this.pty || typeof this.pty.updateMeta !== 'function') return;
+        this.pty.updateMeta(meta, replace);
+    }
+
     /** Debug-only: most-recent PTY input/output/resize/cursor events, oldest
      *  first. Pure observation — never consulted by the FSM. */
     getEventTimeline(limit = MAX_PTY_EVENTS): SpecPtyEvent[] {

package/src/providers/spec/cli-adapter.ts

@@ -641,9 +641,17 @@ export class SpecCliAdapter implements CliAdapter {
         };
     }
     updateRuntimeMeta(meta?: Record<string, unknown>): void {
-        if (meta && typeof meta.providerSessionId === 'string') {
+        if (!meta) return;
+        if (typeof meta.providerSessionId === 'string') {
             this.providerSessionId = meta.providerSessionId;
         }
+        // Forward the FULL meta (meshNodeId / meshNodeFor / workspaceLabel /
+        // lifecycle / …) down to the transport so it reaches the session
+        // registry. The legacy ProviderCliAdapter.updateRuntimeMeta does the
+        // same via ptyProcess.updateMeta; the spec path previously dropped
+        // everything but providerSessionId, leaving autoLaunch's meshNodeId
+        // stamp unbound on the record — the root of SESSION-ACCUMULATION-LEAK.
+        try { this.driver.updateMeta(meta); } catch { /* transport may not support meta */ }
     }
     refreshProviderDefinition(): void { /* hot reload handled by SpecDriver fs.watch */ }
 

package/src/providers/spec/fsm-driver.ts

@@ -116,6 +116,7 @@ export interface ISpecDriver {
     subscribe(listener: (ev: DashboardEvent) => void): () => void;
     start(): void;
     dispatch(cmd: DashboardCommand): void;
+    updateMeta(meta: Record<string, unknown>, replace?: boolean): void;
     snapshot(): string;
     getCursorPosition(): { row: number; col: number };
     getScreen(): string;
@@ -422,6 +423,14 @@ export class FsmDriver implements ISpecDriver {
         }
     }
 
+    /** Forward runtime metadata to the terminal transport so mesh binding
+     *  fields (meshNodeId / meshNodeFor / workspaceLabel / lifecycle) reach
+     *  the session registry. Not a DashboardCommand — this is a control-plane
+     *  update, not user input. */
+    updateMeta(meta: Record<string, unknown>, replace = false): void {
+        this.adapter.updateMeta(meta, replace);
+    }
+
     snapshot(): string { return this.adapter.snapshot(); }
     getCursorPosition(): { row: number; col: number } { return this.adapter.getCursorPosition(); }
     getScreen(): string { return this.adapter.snapshot(); }