@adhdev/daemon-core 0.9.82-rc.45 → 0.9.82-rc.451

package/src/runtime-defaults.ts

@@ -14,3 +14,42 @@ export const DEFAULT_SESSION_HOST_DIAGNOSTICS_SUBSCRIPTION_INTERVAL_MS = 10_000;
 export const DEFAULT_SESSION_HOST_READY_TIMEOUT_MS = 15_000;
 
 export const STANDALONE_CDP_SCAN_INTERVAL_MS = 15_000;
+
+// ---------------------------------------------------------------------------
+// Mesh P2P timeout windows (env-overridable)
+// ---------------------------------------------------------------------------
+
+// Reads a mesh timeout (ms) from the first non-empty env var in `names`, clamped
+// to [1_000, 120_000]; falls back to `defaultMs` when none is set or the value is
+// out of range. The clamp lets a slow real link be tuned up (TURN-relayed peers
+// whose RTT is many seconds) and lets the test harness shrink the window to its
+// 1s minimum, without ever degenerating to 0 or an absurd value. Multiple names
+// are accepted so a renamed constant can keep honoring a legacy alias.
+export function readMeshTimeoutEnvMs(names: string | string[], defaultMs: number): number {
+    const candidates = Array.isArray(names) ? names : [names];
+    for (const name of candidates) {
+        const raw = process.env[name]?.trim();
+        if (!raw) continue;
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isFinite(parsed) && parsed >= 1_000 && parsed <= 120_000) return parsed;
+        return defaultMs;
+    }
+    return defaultMs;
+}
+
+// SINGLE source of truth for the mesh cold-open *connect* budget — the time a
+// caller grants a peer whose mesh DataChannel is not open yet to drive the
+// cross-machine (often TURN-relayed) ICE/DTLS handshake before the response
+// deadline takes over. Two call sites share this so an env override tunes BOTH:
+//   - commands/router.ts direct-peer git_status probe (requireDirectPeerTruth)
+//   - mesh/mesh-events-coordinator.ts remote task-dispatch (deliverTaskToSession)
+// Before unification the coordinator hard-coded 45_000 while the router was
+// env-overridable, so setting the env tuned the probe path but silently left the
+// dispatch path at 45s — the same nominal 45s, but divergent the moment the env
+// was set. Matches the daemon-cloud DaemonMeshManager CONNECT_TIMEOUT_MS (45s).
+// `MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS` is honored as a backward-compat alias so
+// environments already tuned under the old name keep working.
+export const MESH_CONNECT_TIMEOUT_MS = readMeshTimeoutEnvMs(
+    ['MESH_CONNECT_TIMEOUT_MS', 'MESH_DIRECT_PROBE_CONNECT_TIMEOUT_MS'],
+    45_000,
+);

package/src/session-host/managed-host.ts

@@ -0,0 +1,218 @@
+import { execFileSync, spawn, type StdioOptions } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import {
+    getDefaultSessionHostEndpoint,
+    sanitizeSpawnEnv,
+    type SessionHostEndpoint,
+    type SessionHostRequestType,
+} from '@adhdev/session-host-core';
+import { ensureSessionHostReady as ensureSharedSessionHostReady } from './runtime-support.js';
+import { DEFAULT_SESSION_HOST_READY_TIMEOUT_MS } from '../runtime-defaults.js';
+
+/**
+ * Shared managed-session-host process helpers.
+ *
+ * The cloud (`packages/daemon-cloud`) and standalone (`oss/packages/daemon-standalone`)
+ * daemons carried byte-for-byte copies of `buildSessionHostEnv`, `resolveSessionHostEntry`,
+ * `getSessionHostPidFile`, `killPid`, a base `stopManagedSessionHostProcess`, and the
+ * `ensureSessionHostReady` retry-wrapper. Those live here now. The pieces that genuinely
+ * differ between the two daemons (kill windowsHide, quarantine preamble, spawn stdio,
+ * required request types, cloud's socket-owner sweep) are injected via options so the
+ * observable behavior of each daemon is preserved exactly.
+ */
+export interface ManagedSessionHostOptions {
+    /** Session-host namespace (app name). Drives the socket endpoint and pidfile path. */
+    appName: string;
+    /** Capability probe: request types the host must advertise before it's considered ready. */
+    requiredRequestTypes: readonly SessionHostRequestType[];
+    /** Ready timeout for the spawn/poll loop. Defaults to the shared runtime default. */
+    timeoutMs?: number;
+    /**
+     * `killPid` on win32 uses `taskkill /T /F`. Cloud passes `windowsHide: true`; standalone
+     * historically did not. Kept as a flag to preserve each daemon's exact spawn options.
+     */
+    killWindowsHide?: boolean;
+    /**
+     * How the detached host child's stdio is wired. 'ignore' matches standalone; 'logfile'
+     * matches cloud (append to `~/.adhdev/logs/session-host.log`).
+     */
+    spawnStdio?: 'ignore' | 'logfile';
+    /**
+     * Optional preamble run at the start of `ensureReady` (before the first connect probe).
+     * Cloud uses this to quarantine legacy standalone runtime files.
+     */
+    beforeEnsureReady?: () => void;
+    /**
+     * Optional extra stop pass appended to `stopManagedSessionHostProcess`. Cloud sweeps
+     * managed session-host processes that own the default socket but predate pidfile tracking.
+     * Returns true if it stopped anything.
+     */
+    extraStop?: (endpoint: SessionHostEndpoint) => boolean;
+    /**
+     * Optional guard applied to a pidfile-tracked pid before killing it in
+     * `stopManagedSessionHostProcess`. Cloud verifies the command line is an ADHDev
+     * session-host daemon; standalone kills unconditionally (returns true here).
+     */
+    isManagedPid?: (pid: number) => boolean;
+}
+
+export interface ManagedSessionHost {
+    readonly appName: string;
+    readonly endpoint: SessionHostEndpoint;
+    getPidFile(): string;
+    getPid(): number | null;
+    buildEnv(baseEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    resolveEntry(): string;
+    killPid(pid: number): boolean;
+    spawnHost(): void;
+    stopManagedSessionHostProcess(): boolean;
+    ensureReady(): Promise<SessionHostEndpoint>;
+    getStatusPaths(): { pidFile: string; endpoint: SessionHostEndpoint };
+}
+
+export function createManagedSessionHost(options: ManagedSessionHostOptions): ManagedSessionHost {
+    const appName = options.appName;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SESSION_HOST_READY_TIMEOUT_MS;
+    const endpoint = getDefaultSessionHostEndpoint(appName);
+    const isManagedPid = options.isManagedPid ?? (() => true);
+
+    function buildEnv(baseEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+        const env = sanitizeSpawnEnv(baseEnv) as NodeJS.ProcessEnv;
+        env.ADHDEV_SESSION_HOST_NAME = appName;
+        return env;
+    }
+
+    function resolveEntry(): string {
+        const packagedCandidates = [
+            path.resolve(__dirname, '../vendor/session-host-daemon/index.js'),
+            path.resolve(__dirname, '../../vendor/session-host-daemon/index.js'),
+        ];
+        for (const candidate of packagedCandidates) {
+            if (fs.existsSync(candidate)) {
+                return candidate;
+            }
+        }
+        return require.resolve('@adhdev/session-host-daemon');
+    }
+
+    function getPidFile(): string {
+        return path.join(os.homedir(), '.adhdev', `${appName}-session-host.pid`);
+    }
+
+    function getPid(): number | null {
+        try {
+            const pidFile = getPidFile();
+            if (!fs.existsSync(pidFile)) return null;
+            const pid = Number.parseInt(fs.readFileSync(pidFile, 'utf8').trim(), 10);
+            return Number.isFinite(pid) ? pid : null;
+        } catch {
+            return null;
+        }
+    }
+
+    function killPid(pid: number): boolean {
+        try {
+            if (process.platform === 'win32') {
+                const spawnOpts: { stdio: 'ignore'; windowsHide?: boolean } = { stdio: 'ignore' };
+                if (options.killWindowsHide) spawnOpts.windowsHide = true;
+                execFileSync('taskkill', ['/PID', String(pid), '/T', '/F'], spawnOpts);
+            } else {
+                process.kill(pid, 'SIGTERM');
+            }
+            return true;
+        } catch {
+            return false;
+        }
+    }
+
+    function spawnHost(): void {
+        const entry = resolveEntry();
+        let stdio: StdioOptions = 'ignore';
+        let logFd: number | null = null;
+        if (options.spawnStdio === 'logfile') {
+            const logDir = path.join(os.homedir(), '.adhdev', 'logs');
+            fs.mkdirSync(logDir, { recursive: true });
+            logFd = fs.openSync(path.join(logDir, 'session-host.log'), 'a');
+            stdio = ['ignore', logFd, logFd];
+        }
+        const child = spawn(process.execPath, [entry], {
+            detached: true,
+            stdio,
+            windowsHide: true,
+            env: buildEnv(process.env),
+        });
+        child.unref();
+        if (logFd !== null) {
+            try { fs.closeSync(logFd); } catch { /* noop */ }
+        }
+    }
+
+    function stopManagedSessionHostProcess(): boolean {
+        let stopped = false;
+        const pidFile = getPidFile();
+        try {
+            if (fs.existsSync(pidFile)) {
+                const pid = Number.parseInt(fs.readFileSync(pidFile, 'utf8').trim(), 10);
+                if (Number.isFinite(pid) && pid !== process.pid && isManagedPid(pid)) {
+                    stopped = killPid(pid) || stopped;
+                }
+            }
+        } catch {
+            // noop
+        } finally {
+            try {
+                fs.unlinkSync(pidFile);
+            } catch {
+                // noop
+            }
+        }
+
+        if (options.extraStop) {
+            stopped = options.extraStop(endpoint) || stopped;
+        }
+
+        return stopped;
+    }
+
+    async function ensureReady(): Promise<SessionHostEndpoint> {
+        options.beforeEnsureReady?.();
+        try {
+            return await ensureSharedSessionHostReady({
+                appName,
+                spawnHost,
+                timeoutMs,
+                requiredRequestTypes: options.requiredRequestTypes,
+            });
+        } catch (error) {
+            stopManagedSessionHostProcess();
+            return ensureSharedSessionHostReady({
+                appName,
+                spawnHost,
+                timeoutMs,
+                requiredRequestTypes: options.requiredRequestTypes,
+            }).catch((retryError) => {
+                const initialMessage = error instanceof Error ? error.message : String(error);
+                const retryMessage = retryError instanceof Error ? retryError.message : String(retryError);
+                throw new Error(`Session host failed to start after retry (${initialMessage}; retry: ${retryMessage})`);
+            });
+        }
+    }
+
+    return {
+        appName,
+        endpoint,
+        getPidFile,
+        getPid,
+        buildEnv,
+        resolveEntry,
+        killPid,
+        spawnHost,
+        stopManagedSessionHostProcess,
+        ensureReady,
+        getStatusPaths() {
+            return { pidFile: getPidFile(), endpoint };
+        },
+    };
+}

package/src/session-host/runtime-surface.ts

@@ -1,80 +1,20 @@
-import type { SessionHostRecord } from '../shared-types.js';
-
-export type SessionHostSurfaceKind = 'live_runtime' | 'recovery_snapshot' | 'inactive_record';
-
-export interface SessionHostSurfaceRecordLike {
-    lifecycle?: string | null;
-    meta?: Record<string, unknown> | null;
-}
-
-const LIVE_LIFECYCLES = new Set(['starting', 'running', 'stopping', 'interrupted']);
-
-export function isSessionHostLiveRuntime(record: SessionHostSurfaceRecordLike | null | undefined): boolean {
-    const lifecycle = String(record?.lifecycle || '').trim();
-    return LIVE_LIFECYCLES.has(lifecycle);
-}
-
-export function getSessionHostRecoveryLabel(meta: Record<string, unknown> | null | undefined): string | null {
-    const recoveryState = typeof meta?.runtimeRecoveryState === 'string'
-        ? String(meta.runtimeRecoveryState).trim()
-        : '';
-    if (!recoveryState) return null;
-    if (recoveryState === 'auto_resumed') return 'restored after restart';
-    if (recoveryState === 'resume_failed') return 'restore failed';
-    if (recoveryState === 'host_restart_interrupted') return 'host restart interrupted';
-    if (recoveryState === 'orphan_snapshot') return 'snapshot recovered';
-    return recoveryState.replace(/_/g, ' ');
-}
-
-export function isSessionHostRecoverySnapshot(record: SessionHostSurfaceRecordLike | null | undefined): boolean {
-    if (!record) return false;
-    if (isSessionHostLiveRuntime(record)) return false;
-
-    const lifecycle = String(record.lifecycle || '').trim();
-    if (lifecycle && lifecycle !== 'stopped' && lifecycle !== 'failed') {
-        return false;
-    }
-
-    const meta = record.meta || undefined;
-    if (meta?.restoredFromStorage === true) return true;
-    return getSessionHostRecoveryLabel(meta) !== null;
-}
-
-export function getSessionHostSurfaceKind(record: SessionHostSurfaceRecordLike | null | undefined): SessionHostSurfaceKind {
-    if (isSessionHostLiveRuntime(record)) return 'live_runtime';
-    if (isSessionHostRecoverySnapshot(record)) return 'recovery_snapshot';
-    return 'inactive_record';
-}
-
-export function partitionSessionHostRecords<T extends SessionHostSurfaceRecordLike>(records: T[]): {
-    liveRuntimes: T[];
-    recoverySnapshots: T[];
-    inactiveRecords: T[];
-} {
-    const liveRuntimes: T[] = [];
-    const recoverySnapshots: T[] = [];
-    const inactiveRecords: T[] = [];
-
-    for (const record of records) {
-        const kind = getSessionHostSurfaceKind(record);
-        if (kind === 'live_runtime') {
-            liveRuntimes.push(record);
-        } else if (kind === 'recovery_snapshot') {
-            recoverySnapshots.push(record);
-        } else {
-            inactiveRecords.push(record);
-        }
-    }
-
-    return {
-        liveRuntimes,
-        recoverySnapshots,
-        inactiveRecords,
-    };
-}
-
-export function partitionSessionHostDiagnosticsSessions(
-    records: SessionHostRecord[] | null | undefined,
-): ReturnType<typeof partitionSessionHostRecords<SessionHostRecord>> {
-    return partitionSessionHostRecords(records || []);
-}
+/**
+ * Session-host runtime-surface helpers.
+ *
+ * These classification helpers (live_runtime / recovery_snapshot / inactive_record)
+ * are owned by @adhdev/session-host-core as the single source of truth. daemon-core
+ * re-exports them so consumers can keep importing from this path while the behavior
+ * (including the `record.surfaceKind` short-circuit) stays identical across packages.
+ */
+export {
+    getSessionHostRecoveryLabel,
+    getSessionHostSurfaceKind,
+    isSessionHostLiveRuntime,
+    isSessionHostRecoverySnapshot,
+    partitionSessionHostDiagnosticsSessions,
+    partitionSessionHostRecords,
+} from '@adhdev/session-host-core';
+export type {
+    SessionHostSurfaceKind,
+    SessionHostSurfaceRecordLike,
+} from '@adhdev/session-host-core';

package/src/sessions/registry.ts

@@ -8,6 +8,12 @@ export interface SessionRuntimeTarget {
     cdpManagerKey?: string;
     adapterKey?: string;
     instanceKey?: string;
+    /** Working directory for CLI/ACP sessions. Used by read_chat to resolve
+     *  native history when there is no live adapter (e.g. subscription path). */
+    workspace?: string;
+    /** Wall clock at register time. native-history readers use it as a
+     *  cutoff so a fresh session can't show records from a prior one. */
+    spawnedAtMs?: number;
 }
 
 export class SessionRegistry {

package/src/shared-types-extra.ts

@@ -21,14 +21,12 @@ export interface RuntimeAttachedClient {
 }
 
 /** Session status union (used by SessionEntry.status, legacy recent-launch metadata, etc.) */
-export type SessionStatus = 'idle' | 'generating' | 'waiting_approval' | 'error' | 'stopped' | 'starting' | 'panel_hidden' | 'not_monitored' | 'disconnected';
+export type SessionStatus = 'idle' | 'generating' | 'waiting_approval' | 'waiting_choice' | 'error' | 'stopped' | 'starting' | 'panel_hidden' | 'not_monitored' | 'disconnected';
 
 /** Inbox bucket categories for recent sessions */
 export type RecentSessionBucket = 'needs_attention' | 'working' | 'task_complete' | 'idle';
 
 /** Terminal backend status */
 export interface TerminalBackendStatus {
-    backend: 'xterm' | 'ghostty-vt';
-    preference: 'auto' | 'xterm' | 'ghostty-vt';
-    ghosttyAvailable: boolean;
+    backend: 'ghostty-vt';
 }

package/src/shared-types.d.ts

@@ -206,6 +206,14 @@ export interface SessionEntry {
     completionMarker?: string;
     seenCompletionMarker?: string;
     surfaceHidden?: boolean;
+    /**
+     * True owning-daemon id for a session a coordinator synthesises into its own
+     * status snapshot (mesh delegated sessions), so the dashboard attributes it to the
+     * worker node instead of the coordinator daemon hosting the snapshot.
+     */
+    ownerDaemonId?: string;
+    /** True owning-machine display name fallback when the owning daemon is not aggregated. */
+    ownerMachineName?: string;
 }
 /**
  * Compact session metadata stored in UserSessionDO and reused by server-side

package/src/shared-types.ts

@@ -15,6 +15,15 @@ import type {
     DetectedIde,
     AgentEntry,
 } from './types.js';
+import type {
+    SessionAttachedClient as CoreSessionAttachedClient,
+    SessionWriteOwner as CoreSessionWriteOwner,
+    SessionHostRecord as CoreSessionHostRecord,
+    SessionHostLogEntry as CoreSessionHostLogEntry,
+    SessionHostRequestTrace as CoreSessionHostRequestTrace,
+    SessionHostRuntimeTransition as CoreSessionHostRuntimeTransition,
+    SessionHostDiagnostics as CoreSessionHostDiagnostics,
+} from '@adhdev/session-host-core';
 
 export type {
     StatusResponse,
@@ -56,6 +65,7 @@ import type {
     GitWorkspaceUpdate,
     WorkspaceGitSubscriptionParams,
 } from './git/git-types.js';
+import type { InteractivePrompt } from './providers/types/interactive-prompt.js';
 
 export type {
     GitCommandName,
@@ -110,6 +120,14 @@ export interface ReadChatSyncResult {
     status: string;
     title?: string;
     activeModal?: { message: string; buttons: string[] } | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
+    /**
+     * Chat source provenance from ChatSourceMachine (A2). Carries the
+     * selected source, transition cause, lock state, and legacy
+     * fallbackReason — opaque to the daemon-core, consumed by web-core
+     * for the source debug badge and SourceTimeline (A3).
+     */
+    messageSource?: Record<string, unknown>;
 }
 
 export interface ProviderSummaryItem {
@@ -125,70 +143,67 @@ export interface ProviderSummaryMetadata {
     items: ProviderSummaryItem[];
 }
 
-export interface SessionHostAttachedClient {
-    clientId: string;
+/**
+ * Wire-subset session-host types.
+ *
+ * These are the shapes daemon-core / web-core see over the wire — a subset of the
+ * authoritative types owned by @adhdev/session-host-core (which additionally carry
+ * transport / category / launchCommand / buffer and stricter union typing on wire
+ * scalars). They are DERIVED from the SSOT via Pick/Omit so shared fields cannot
+ * drift; only the deliberate wire looseness (string-typed `type`/`lifecycle`,
+ * optional `meta`) is re-applied here.
+ */
+export type SessionHostAttachedClient = Omit<CoreSessionAttachedClient, 'type'> & {
+    /** Widened over the wire — the raw client-type string is not re-validated here. */
     type: string;
-    readOnly: boolean;
-    attachedAt: number;
-    lastSeenAt: number;
-}
-
-export interface SessionHostWriteOwner {
-    clientId: string;
-    ownerType: 'agent' | 'user';
-    acquiredAt: number;
-}
+};
 
-export interface SessionHostRecord {
-    sessionId: string;
-    runtimeKey: string;
-    displayName: string;
-    workspaceLabel: string;
-    providerType: string;
-    workspace: string;
-    lifecycle: 'starting' | 'running' | 'stopping' | 'stopped' | 'failed' | 'interrupted';
-    surfaceKind?: 'live_runtime' | 'recovery_snapshot' | 'inactive_record';
+export type SessionHostWriteOwner = CoreSessionWriteOwner;
+
+export type SessionHostRecord = Pick<
+    CoreSessionHostRecord,
+    | 'sessionId'
+    | 'runtimeKey'
+    | 'displayName'
+    | 'workspaceLabel'
+    | 'providerType'
+    | 'workspace'
+    | 'lifecycle'
+    | 'surfaceKind'
+    | 'osPid'
+    | 'lastActivityAt'
+    | 'createdAt'
+    | 'startedAt'
+> & {
     writeOwner: SessionHostWriteOwner | null;
     attachedClients: SessionHostAttachedClient[];
-    osPid?: number;
-    lastActivityAt: number;
-    createdAt: number;
-    startedAt?: number;
+    /** Optional over the wire — omitted when the record carries no metadata. */
     meta?: Record<string, unknown>;
-}
+};
 
-export interface SessionHostLogEntry {
-    timestamp: number;
-    level: 'debug' | 'info' | 'warn' | 'error';
-    message: string;
-    sessionId?: string;
-}
+export type SessionHostLogEntry = Omit<CoreSessionHostLogEntry, 'data'>;
 
-export interface SessionHostRequestTrace {
-    timestamp: number;
-    requestId: string;
+export type SessionHostRequestTrace = Omit<CoreSessionHostRequestTrace, 'type'> & {
+    /** Widened over the wire — the request-type union is not re-validated here. */
     type: string;
-    sessionId?: string;
-    clientId?: string;
-    success: boolean;
-    durationMs: number;
-    error?: string;
-}
+};
 
-export interface SessionHostRuntimeTransition {
-    timestamp: number;
-    sessionId: string;
-    action: string;
+export type SessionHostRuntimeTransition = Omit<CoreSessionHostRuntimeTransition, 'lifecycle'> & {
+    /** Widened over the wire — the lifecycle union is not re-validated here. */
     lifecycle?: string;
-    detail?: string;
-    success?: boolean;
-    error?: string;
-}
+};
 
-export interface SessionHostDiagnosticsSnapshot {
-    hostStartedAt: number;
-    endpoint: string;
-    runtimeCount: number;
+export type SessionHostDiagnosticsSnapshot = Omit<
+    CoreSessionHostDiagnostics,
+    | 'supportedRequestTypes'
+    | 'sessions'
+    | 'liveRuntimes'
+    | 'recoverySnapshots'
+    | 'inactiveRecords'
+    | 'recentLogs'
+    | 'recentRequests'
+    | 'recentTransitions'
+> & {
     sessions?: SessionHostRecord[];
     liveRuntimes?: SessionHostRecord[];
     recoverySnapshots?: SessionHostRecord[];
@@ -196,7 +211,7 @@ export interface SessionHostDiagnosticsSnapshot {
     recentLogs: SessionHostLogEntry[];
     recentRequests: SessionHostRequestTrace[];
     recentTransitions: SessionHostRuntimeTransition[];
-}
+};
 
 export type TransportTopic = 'session.chat_tail' | 'session.runtime_output' | 'machine.runtime' | 'session_host.diagnostics' | 'session.modal' | 'daemon.metadata' | 'workspace.git';
 
@@ -365,6 +380,7 @@ export interface SessionEntry {
     runtimeRecoveryState?: string | null;
     resume?: ProviderResumeCapability;
     activeChat: SessionActiveChatData | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
     capabilities?: SessionCapability[];
     /** Effective message input/media support for this session. Defaults fail-closed to text-only. */
     messageInput?: MessageInputSupport;
@@ -389,6 +405,17 @@ export interface SessionEntry {
     seenCompletionMarker?: string;
     surfaceHidden?: boolean;
     settings?: Record<string, any>;
+    /**
+     * True owning-daemon id for a session a coordinator synthesises into its own
+     * status snapshot (mesh delegated sessions). The dashboard attributes the session
+     * to this daemon instead of the snapshot daemon so the worker node — not the
+     * coordinator — is shown as its machine.
+     */
+    ownerDaemonId?: string;
+    /** True owning-machine display name fallback when the owning daemon is not aggregated. */
+    ownerMachineName?: string;
+    /** Set when this session is acting as a mesh coordinator for the given mesh. */
+    coordinator?: { meshId: string; role: 'coordinator' };
     meshQueueStats?: {
         total?: number;
         active?: number;
@@ -516,7 +543,39 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
-}
+    /**
+     * Provider trust classification — derived from the on-disk layer the
+     * manifest came from and the shape of the manifest. Dashboards use
+     * this to render a trust badge and gate activation of
+     * `external-untrusted` providers behind a confirm modal.
+     */
+    trust?: ProviderTrust;
+    /** Daemon-side human-readable description of the trust value. */
+    trustDescription?: string;
+    /** True when activation needs a user-side confirmation step. */
+    requiresConfirmation?: boolean;
+    /** Which on-disk layer the manifest lives in. */
+    sourceLayer?: 'user' | 'upstream' | 'external';
+    /** For external providers, the source-name namespace it came from. */
+    sourceName?: string | null;
+    /** Manifest-declared version, e.g. "1.2.1". */
+    providerVersion?: string;
+    /** Underlying executable name (CLI/binary providers). */
+    binary?: string;
+    /** Lifecycle label from the manifest: "Stable", "Beta", … */
+    status?: string;
+    /** One-line provider description from the manifest. */
+    details?: string;
+    /** Manifest-declared links: homepage, docs, repo, … */
+    links?: Record<string, string>;
+}
+
+export type ProviderTrust =
+    | 'user-custom'
+    | 'trusted'
+    | 'trusted-with-scripts'
+    | 'external-safe'
+    | 'external-untrusted';
 
 export interface MachineProviderCheckResult {
     ok: boolean;
@@ -582,6 +641,13 @@ export interface ProviderControlSchema {
     order?: number;
     /** Hide this control even if it would otherwise render */
     hidden?: boolean;
+    /**
+     * FSM state ids in which this control should be visible. When omitted the
+     * control is always visible. Mirrors the daemon's click-time enforcement so
+     * the bar hides controls the daemon would silently drop. Uses raw FSM state
+     * ids (e.g. 'idle', 'busy'), not the derived dashboard status.
+     */
+    visibleWhenState?: string[];
 }
 
 // ─── Common Sub-Types (used across StatusReportPayload, BaseDaemonData, etc.) ──
@@ -687,6 +753,9 @@ export type DaemonStatusEventName =
     | 'agent:waiting_approval'
     | 'agent:generating_completed'
     | 'agent:stopped'
+    | 'monitor:no_progress'
+    // Legacy alias for 'monitor:no_progress' — kept so older daemons that still
+    // emit it remain type-compatible with consumers during rollout.
     | 'monitor:long_generating';
 
 /** Minimal daemon-originated event payload relayed through the server. */