@adhdev/daemon-core 0.9.82-rc.45 → 0.9.82-rc.451

package/dist/providers/manual-attendance.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ManualAttendanceTracker — provider-agnostic "is a human driving this session
+ * right now" signal, used to suppress auto-approve while the user is taking
+ * manual control of a session from the dashboard.
+ *
+ * Why this exists
+ * ---------------
+ * When `autoApprove` is on, an approval modal is auto-dismissed within a few
+ * hundred ms of appearing. For a background mesh worker that is exactly the
+ * desired delegated behavior. But for a session the user is actively watching
+ * and operating (a base-node / foreground session), the auto-fire closes the
+ * modal before the human can pick a button — and likewise fights their use of
+ * the controlbar. The fix is to give the human a short quiet window: while they
+ * are attending the session by hand, auto-approve holds; once they go idle it
+ * resumes.
+ *
+ * The tracker holds only a timestamp. The *signal* — which commands count as
+ * "a human attending" — is decided by the caller (the command handler), and is
+ * the same set for every provider: foreground tab selection (select_session /
+ * open_panel), controlbar use (invoke_provider_script / set_mode / change_model
+ * / set_thought_level), manual approval (resolve_action) and manual terminal
+ * input (pty_input). Notably NOT send_chat, which is also how a coordinator
+ * delegates a task to a worker — counting it would wrongly suppress the
+ * worker's delegated auto-approve.
+ *
+ * Because a background worker never receives any of those attending commands,
+ * it is never "attended", so its delegated auto-approve is unaffected. The
+ * mechanism is therefore provider-common AND preserves worker auto-approve
+ * without any per-provider branching.
+ */
+/**
+ * How long after the last manual interaction auto-approve stays suppressed.
+ *
+ * Trade-off: long enough that after foregrounding a session's tab the user has
+ * a realistic chance to act on an incoming approval (the auto-approve settle
+ * window is only ~600ms, so a human cannot out-race it), yet short enough that
+ * a session left unattended — e.g. a worker tab the user briefly peeked at —
+ * resumes auto-approving within about a minute. Re-armed on every attending
+ * command, so a user who keeps interacting keeps the window fresh.
+ */
+export declare const AUTO_APPROVE_MANUAL_ATTENDANCE_SUPPRESS_MS = 60000;
+export declare class ManualAttendanceTracker {
+    private readonly suppressMs;
+    private lastInteractionAt;
+    constructor(suppressMs?: number);
+    /** Record that a human just drove this session by hand. */
+    note(now?: number): void;
+    /** True while a manual interaction is recent enough to suppress auto-approve. */
+    isAttended(now?: number): boolean;
+    /**
+     * Milliseconds remaining in the current suppression window, or 0 when not
+     * attended. Used to re-arm a re-check timer so auto-approve fires the moment
+     * the window lapses even if the PTY/agent has since gone silent.
+     */
+    remainingMs(now?: number): number;
+}
+/**
+ * The session-scoped commands that count as "a human is attending this session
+ * by hand". Shared so the command handler and any forward path agree on one
+ * definition. Deliberately excludes send_chat (coordinator task delegation) and
+ * pure read commands (read_chat / list_chats — passive polling, not driving).
+ */
+export declare const MANUAL_ATTENDANCE_COMMANDS: ReadonlySet<string>;

package/dist/providers/native-history/antigravity-cli-transcript.d.ts

@@ -0,0 +1,126 @@
+/**
+ * antigravity-cli-transcript — Daemon-side built-in native history adapter for antigravity-cli.
+ *
+ * Antigravity CLI stores conversations in multiple complementary locations:
+ *
+ *   1. ~/.gemini/antigravity-cli/history.jsonl
+ *      Lightweight index of user prompts, one row per turn:
+ *        { conversationId: string, display: string, workspace: string, timestamp: number }
+ *
+ *   2. ~/.gemini/antigravity-cli/brain/<uuid>/.system_generated/logs/transcript*.jsonl
+ *      Per-session full transcript, one row per agent step:
+ *        { source: 'USER_EXPLICIT'|'MODEL', type: string, content: string, status: 'DONE'|..., created_at: number }
+ *
+ *   3. ~/.gemini/antigravity-cli/conversations/<uuid>.pb
+ *      Legacy protobuf binary — schema not publicly documented. Adapter extracts
+ *      printable UTF-8 text runs as best-effort content (no proto library needed).
+ *
+ *   4. ~/.gemini/antigravity-cli/conversations/<uuid>.db  ← current format
+ *      Per-session SQLite database. Recent antigravity migrated conversation
+ *      storage from .pb (+ brain/*.jsonl) to a per-session SQLite db. The
+ *      schema is a trajectory of `steps`, NOT a simple messages(role,content)
+ *      table:
+ *        steps(idx INTEGER PK, step_type INTEGER, status INTEGER,
+ *              step_payload BLOB [protobuf], ...)
+ *      Each `step_payload` is a protobuf message. Empirically (introspected
+ *      from real stores):
+ *        - step_type 14 → a USER turn. The prompt text is the largest
+ *          contiguous UTF-8 run inside the payload (field 19 subtree).
+ *        - step_type 15 → a MODEL/assistant turn. The assistant's final
+ *          natural-language answer lives at payload field 20 → field 1
+ *          (identical to field 8). Field 20 → field 3 is the internal
+ *          reasoning summary and is intentionally NOT surfaced.
+ *        - other step types are tool calls / ephemeral system context.
+ *      We read the blobs with a tiny dependency-free protobuf field walker
+ *      (no proto schema / codegen needed) and map the two message step types.
+ *      Because the daemon does NOT read this db, native history previously
+ *      returned 0 rows for these sessions and read_chat fell back to the
+ *      pty parser (which only echoes the user's own input) — assistant
+ *      answers appeared lost even though they were on disk.
+ *
+ * This adapter provides:
+ *   - Full coverage from a per-session .db (current format) — preferred.
+ *   - Full coverage when a brain transcript exists (legacy authoritative source).
+ *   - Partial coverage (user prompts only) from history.jsonl as fallback.
+ *   - Best-effort raw-string extraction from .pb files when no other source exists.
+ *
+ * watchPath (from provider.v1.json):
+ *   ~/.gemini/antigravity-cli/history.jsonl
+ *   ~/.gemini/antigravity-cli/brain/{uuid}/.system_generated/logs/transcript*.jsonl
+ *   ~/.gemini/antigravity-cli/conversations/{uuid}.pb
+ *   ~/.gemini/antigravity-cli/conversations/{uuid}.db
+ *
+ * OSS code (AGPL-3.0). Must not import from packages/ (proprietary).
+ */
+export type NativeHistoryRole = 'user' | 'assistant' | 'system';
+export type NativeHistoryKind = 'standard' | 'tool' | 'session_start';
+export interface NativeHistoryMessage {
+    ts: string;
+    receivedAt: number;
+    role: NativeHistoryRole;
+    content: string;
+    kind: NativeHistoryKind;
+    senderName?: string;
+    agent: 'antigravity-cli';
+    historySessionId: string;
+    workspace?: string;
+    /** Stable per-message identity (v2 contract). */
+    providerUnitKey?: string;
+}
+export interface NativeHistorySession {
+    messages: NativeHistoryMessage[];
+    providerSessionId: string;
+    source: 'provider-native';
+    sourcePath: string;
+    sourceMtimeMs: number;
+    /**
+     * 'full' — brain transcript was available and parsed.
+     * 'partial' — only history.jsonl user-prompts are available.
+     * 'best-effort' — .pb file bytes were used for raw text extraction.
+     */
+    nativeHistoryCoverage: 'full' | 'partial' | 'best-effort';
+    workspace?: string;
+    partialReason?: string;
+}
+export interface NativeHistorySessionMeta {
+    historySessionId: string;
+    sessionId: string;
+    sourcePath: string;
+    sourceMtimeMs: number;
+    messageCount: number;
+    firstMessageAt: number;
+    lastMessageAt: number;
+    sessionTitle?: string;
+    preview?: string;
+    workspace?: string;
+    agent: 'antigravity-cli';
+    source: 'provider-native';
+    nativeHistoryCoverage: 'full' | 'partial' | 'best-effort';
+    partialReason?: string;
+}
+/**
+ * Read a single Antigravity CLI session by its source file path.
+ *
+ * `sessionPath` is the absolute path to one of:
+ *   - A brain transcript JSONL: ~/.gemini/antigravity-cli/brain/<uuid>/.system_generated/logs/transcript*.jsonl
+ *   - The shared history.jsonl: ~/.gemini/antigravity-cli/history.jsonl
+ *   - A conversation SQLite db: ~/.gemini/antigravity-cli/conversations/<uuid>.db
+ *   - A conversation protobuf: ~/.gemini/antigravity-cli/conversations/<uuid>.pb
+ *
+ * The session UUID is inferred from the directory name (brain), filename (pb), or
+ * must be provided explicitly via `sessionId` for history.jsonl paths.
+ *
+ * Returns `null` when the file is missing, empty, or yields no parseable messages.
+ */
+export declare function readSession(sessionPath: string, sessionId?: string, workspace?: string): NativeHistorySession | null;
+/**
+ * List all Antigravity CLI sessions found across all watchPath locations.
+ *
+ * Priority:
+ *   1. Brain transcript sessions (full coverage) — preferred source.
+ *   2. History JSONL entries without a brain transcript (partial coverage).
+ *   3. .pb conversation files without any other source (best-effort).
+ *
+ * Returns summary metadata sorted by most recently updated first.
+ */
+export declare function listSessions(_watchPath: string): Promise<NativeHistorySessionMeta[]>;

package/dist/providers/native-history/claude-cli-transcript.d.ts

@@ -0,0 +1,70 @@
+/**
+ * claude-cli-transcript — Daemon-side built-in native history adapter for claude-cli.
+ *
+ * Reads Claude Code JSONL transcript files directly without shelling out to a JS override.
+ * The transcript format is one JSON object per line, where each line has:
+ *   - type: 'user' | 'assistant'
+ *   - message: { content: string | ContentBlock[] }
+ *   - timestamp: number (ms epoch) | string (ISO)
+ *   - sessionId?: string
+ *   - cwd?: string
+ *
+ * OSS code (AGPL-3.0). Must not import from packages/ (proprietary).
+ */
+export type NativeHistoryRole = 'user' | 'assistant' | 'system';
+export type NativeHistoryKind = 'standard' | 'tool' | 'session_start';
+export interface NativeHistoryMessage {
+    ts: string;
+    receivedAt: number;
+    role: NativeHistoryRole;
+    content: string;
+    kind: NativeHistoryKind;
+    senderName?: string;
+    agent: 'claude-cli';
+    historySessionId: string;
+    workspace?: string;
+    /** Stable per-message identity (v2 contract). */
+    providerUnitKey?: string;
+}
+export interface NativeHistorySession {
+    messages: NativeHistoryMessage[];
+    providerSessionId: string;
+    source: 'provider-native';
+    sourcePath: string;
+    sourceMtimeMs: number;
+    nativeHistoryCoverage: 'full';
+    workspace?: string;
+}
+export interface NativeHistorySessionMeta {
+    historySessionId: string;
+    sessionId: string;
+    sourcePath: string;
+    sourceMtimeMs: number;
+    messageCount: number;
+    firstMessageAt: number;
+    lastMessageAt: number;
+    sessionTitle?: string;
+    preview?: string;
+    workspace?: string;
+    agent: 'claude-cli';
+    source: 'provider-native';
+    nativeHistoryCoverage: 'full';
+}
+/**
+ * Read a single Claude Code session by its transcript file path.
+ *
+ * `sessionPath` is the absolute path to a `<uuid>.jsonl` file.
+ * Returns `null` when the file is missing, empty, or yields no parseable messages.
+ */
+export declare function readSession(sessionPath: string): NativeHistorySession | null;
+/**
+ * List all Claude Code sessions under the given glob-style watchPath base dir.
+ *
+ * `watchPath` is the pattern from provider.v1.json (`~/.claude/projects/**\/*.jsonl`).
+ * This implementation expands the home directory and scans `~/.claude/projects/`
+ * recursively, collecting all `.jsonl` files.
+ *
+ * Returns summary metadata for each session (no full message reads on this hot path;
+ * each file is opened only for lightweight scanning).
+ */
+export declare function listSessions(watchPath: string): Promise<NativeHistorySessionMeta[]>;

package/dist/providers/native-history/codex-cli-transcript.d.ts

@@ -0,0 +1,73 @@
+/**
+ * codex-cli-transcript — Daemon-side built-in native history adapter for codex-cli.
+ *
+ * Reads Codex CLI rollout JSONL session files directly without shelling out to a JS override.
+ * Files are stored at ~/.codex/sessions/<uuid>[-<slug>].jsonl.
+ *
+ * Format — each line is a JSON object of one of these types:
+ *   { type: 'session_meta', timestamp: number, payload: { id: string, cwd: string, ... } }
+ *   { type: 'response_item', timestamp: number, payload: { type: 'message', role: 'user'|'assistant', content: ... } }
+ *   { type: 'response_item', timestamp: number, payload: { type: 'function_call' | 'custom_tool_call', name?: string, arguments?: string, input?: unknown } }
+ *   { type: 'response_item', timestamp: number, payload: { type: 'function_call_output' | 'custom_tool_call_output', output?: string, result?: string } }
+ *
+ * watchPath (from provider.v1.json): ~/.codex/sessions
+ *
+ * OSS code (AGPL-3.0). Must not import from packages/ (proprietary).
+ */
+export type NativeHistoryRole = 'user' | 'assistant' | 'system';
+export type NativeHistoryKind = 'standard' | 'tool' | 'session_start';
+export interface NativeHistoryMessage {
+    ts: string;
+    receivedAt: number;
+    role: NativeHistoryRole;
+    content: string;
+    kind: NativeHistoryKind;
+    senderName?: string;
+    agent: 'codex-cli';
+    historySessionId: string;
+    workspace?: string;
+    /** Stable per-message identity (v2 contract). */
+    providerUnitKey?: string;
+}
+export interface NativeHistorySession {
+    messages: NativeHistoryMessage[];
+    providerSessionId: string;
+    source: 'provider-native';
+    sourcePath: string;
+    sourceMtimeMs: number;
+    nativeHistoryCoverage: 'full';
+    workspace?: string;
+}
+export interface NativeHistorySessionMeta {
+    historySessionId: string;
+    sessionId: string;
+    sourcePath: string;
+    sourceMtimeMs: number;
+    messageCount: number;
+    firstMessageAt: number;
+    lastMessageAt: number;
+    sessionTitle?: string;
+    preview?: string;
+    workspace?: string;
+    agent: 'codex-cli';
+    source: 'provider-native';
+    nativeHistoryCoverage: 'full';
+}
+/**
+ * Read a single Codex CLI session by its JSONL file path.
+ *
+ * `sessionPath` is the absolute path to a `<uuid>[-<slug>].jsonl` file
+ * under ~/.codex/sessions/.
+ * Returns `null` when the file is missing, empty, or yields no parseable messages.
+ */
+export declare function readSession(sessionPath: string): NativeHistorySession | null;
+/**
+ * List all Codex CLI sessions under the given watchPath base dir.
+ *
+ * `watchPath` is the value from provider.v1.json (`~/.codex/sessions`).
+ * Expands the home directory and scans the directory recursively,
+ * collecting all `.jsonl` files.
+ *
+ * Returns summary metadata for each session, sorted by most recently updated first.
+ */
+export declare function listSessions(watchPath: string): Promise<NativeHistorySessionMeta[]>;

package/dist/providers/native-history/constants.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Spawn-bind grace window: an on-disk rollout whose session_meta.timestamp
+ * lands within ±SPAWN_BIND_GRACE_MS of the daemon's spawnedAtMs is treated
+ * as belonging to that daemon session. 10s is long enough to absorb codex
+ * binary startup latency on cold caches and short enough that two
+ * back-to-back launches don't both fall inside the same window.
+ *
+ * Shared by the declarative executor (providers/spec/native-history-executor.ts)
+ * and the codex runtime disambiguator (providers/native-history/dispatcher.ts) —
+ * both apply the identical ±10s session-binding window.
+ */
+export declare const SPAWN_BIND_GRACE_MS = 10000;

package/dist/providers/native-history/dispatcher.d.ts

@@ -0,0 +1,27 @@
+export type ReaderId = 'claude-cli' | 'codex-cli' | 'antigravity-cli' | 'hermes-cli';
+export interface NativeHistoryInput {
+    agentType?: string;
+    sessionId?: string;
+    providerSessionId?: string;
+    historySessionId?: string;
+    workspace?: string;
+    sessionStartedAtMs?: number;
+    format?: string;
+    watchPath?: string;
+    forceRefresh?: boolean;
+    args?: Record<string, unknown>;
+}
+export interface NativeHistoryResult {
+    messages: Array<{
+        role: string;
+        content: string;
+        receivedAt?: number;
+        kind?: string;
+        workspace?: string;
+    }>;
+    providerSessionId?: string;
+    sourcePath: string;
+    sourceMtimeMs: number;
+    nativeHistoryCoverage?: 'full' | 'partial' | 'best-effort';
+}
+export declare function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeHistoryInput) => NativeHistoryResult | null;

package/dist/providers/native-history/hermes-cli-transcript.d.ts

@@ -0,0 +1,30 @@
+export interface NativeHistoryMessage {
+    id: string;
+    role: 'user' | 'assistant' | 'system';
+    content: string;
+    receivedAt: number;
+    kind?: string;
+}
+export interface NativeHistorySession {
+    messages: NativeHistoryMessage[];
+    providerSessionId: string;
+    source: 'provider-native';
+    sourcePath: string;
+    sourceMtimeMs: number;
+    nativeHistoryCoverage: 'full';
+    workspace?: string;
+}
+export interface NativeHistorySessionMeta {
+    historySessionId: string;
+    sessionId: string;
+    sourcePath: string;
+    sourceMtimeMs: number;
+    messageCount: number;
+    firstMessageAt: number;
+    lastMessageAt: number;
+    sessionTitle?: string;
+    preview?: string;
+    workspace?: string;
+}
+export declare function readSession(sessionPath: string, requestedSessionId?: string): NativeHistorySession | null;
+export declare function listSessions(_watchPath: string): Promise<NativeHistorySessionMeta[]>;

package/dist/providers/native-history/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * native-history — Daemon-side built-in adapters for CLI provider native history.
+ *
+ * Each adapter reads conversation history directly from the CLI tool's on-disk
+ * storage without shelling out to a provider JS override script.
+ *
+ * OSS code (AGPL-3.0). Must not import from packages/ (proprietary).
+ */
+export { readSession as readClaudeCliSession, listSessions as listClaudeCliSessions, } from './claude-cli-transcript.js';
+export { readSession as readCodexCliSession, listSessions as listCodexCliSessions, } from './codex-cli-transcript.js';
+export { readSession as readAntigravityCliSession, listSessions as listAntigravityCliSessions, } from './antigravity-cli-transcript.js';
+export { readSession as readHermesCliSession, listSessions as listHermesCliSessions, } from './hermes-cli-transcript.js';
+export { createNativeHistoryDispatcher, type ReaderId } from './dispatcher.js';

package/dist/providers/provider-instance-manager.d.ts

@@ -82,6 +82,35 @@ export declare class ProviderInstanceManager {
      * Called when user changes settings from dashboard.
      */
     updateInstanceSettings(providerType: string, settings: Record<string, any>): number;
+    /** Stamp a mesh assignment on a single instance (used by mesh_send_task
+     *  --direct so the worker's completion event has a coordinator routing
+     *  marker in state.settings). Returns `{ stamped: true }` when the stamp was
+     *  applied, or `{ stamped: false, reason }` when it was refused — the instance
+     *  was missing / has no attach method, or the DOUBLE-DISPATCH idempotence guard
+     *  fired (the same task is already running on another live session here). */
+    attachMeshAssignmentToInstance(instanceId: string, assignment: {
+        meshId: string;
+        nodeId?: string;
+        taskId?: string;
+        coordinatorDaemonId?: string;
+        coordinatorSessionId?: string;
+    }): {
+        stamped: boolean;
+        reason?: string;
+    };
+    /**
+     * DOUBLE-DISPATCH support: the id of another LIVE, actively-working instance that already
+     * holds (meshId, taskId), or null. "Live working" = stamped with this exact mesh+task AND
+     * currently mid-turn / booting toward it (generating / waiting on approval-or-choice /
+     * starting) — NOT idle, stopped, or errored. A stale/dead/idle holder is deliberately
+     * ignored so a legitimate re-dispatch (e.g. after a dispatch failure) is never blocked.
+     * The instance being stamped (excludeInstanceId) is skipped so re-stamping the same
+     * session stays idempotent. O(n) over instances — the count is small.
+     */
+    private findLiveWorkingTaskHolder;
+    /** Clear a mesh assignment after the dispatched task reaches a terminal
+     *  state (generating_completed / stopped / failed). */
+    detachMeshAssignmentFromInstance(instanceId: string): boolean;
     refreshProviderDefinitions(resolveProvider: (providerType: string) => unknown): number;
     /**
     * All terminate

package/dist/providers/provider-instance.d.ts

@@ -11,7 +11,8 @@ import type { ProviderModule, ProviderResumeCapability } from './contracts.js';
 import type { AcpConfigOption, AcpMode, ProviderControlSchema, ProviderSummaryMetadata, SessionCapability } from '../shared-types.js';
 import type { MessageInputSupport } from './provider-input-support.js';
 import type { ChatMessage } from '../types.js';
-export type ProviderStatus = 'idle' | 'generating' | 'waiting_approval' | 'error' | 'stopped' | 'starting';
+import type { InteractivePrompt } from './types/interactive-prompt.js';
+export type ProviderStatus = 'idle' | 'generating' | 'waiting_approval' | 'waiting_choice' | 'error' | 'stopped' | 'starting';
 export interface ProviderRuntimeWriteOwner {
     clientId: string;
     ownerType: 'agent' | 'user';
@@ -42,6 +43,7 @@ export interface ActiveChatData {
         message: string;
         buttons: string[];
     } | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
     inputContent?: string;
 }
 /** Standardized error reasons across all provider categories */
@@ -56,6 +58,7 @@ interface ProviderStateBase {
     status: ProviderStatus;
     /** chat data */
     activeChat: ActiveChatData | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
     /** Workspace — project path or name (all categories) */
     workspace?: string | null;
     /** Runtime info (real-time detection) */
@@ -178,8 +181,27 @@ export interface ProviderInstance {
     onEvent(event: string, data?: any): void;
     /** Update settings at runtime (called when user changes settings from dashboard) */
     updateSettings?(newSettings: Record<string, any>): void;
+    /** Stamp a direct-dispatch mesh task assignment so generating_completed
+     *  events route back to the originating coordinator. Cleared by
+     *  detachMeshAssignment when the task reaches a terminal state. */
+    attachMeshAssignment?(assignment: {
+        meshId: string;
+        nodeId?: string;
+        taskId?: string;
+        coordinatorDaemonId?: string;
+        coordinatorSessionId?: string;
+    }): void;
+    detachMeshAssignment?(): void;
     /** Refresh static provider definition/scripts without restarting the live runtime. */
     refreshProviderDefinition?(provider: ProviderModule): void;
+    /**
+     * Record that a human is actively attending this session by hand right now
+     * (foreground tab selection, controlbar use, manual approval, terminal
+     * input). Provider-common signal that suppresses auto-approve for a short
+     * window so the user can drive the session manually; background mesh worker
+     * sessions never receive it, so their delegated auto-approve is unaffected.
+     */
+    noteManualInteraction?(now?: number): void;
     /** cleanup */
     dispose(): void;
 }

package/dist/providers/provider-loader.d.ts

@@ -58,7 +58,9 @@ export declare class ProviderLoader {
     /** Inject VersionArchive so resolve() can auto-detect installed versions */
     setVersionArchive(archive: VersionArchive): void;
     private static readonly GITHUB_TARBALL_URL;
+    private static readonly REGISTRY_BASE_URL;
     private static readonly META_FILE;
+    private static readonly REGISTRY_META_FILE;
     private static readonly REPO_PROVIDER_DIRNAME;
     private static readonly SIBLING_MARKER_FILE;
     private static readonly SIBLING_ENV_VAR;
@@ -84,6 +86,7 @@ export declare class ProviderLoader {
          */
         probeStarts?: string[];
     });
+    private migrateMarketplaceDirToExternal;
     private log;
     private debugLog;
     /**
@@ -128,9 +131,12 @@ export declare class ProviderLoader {
     resolveProviderFile(type: string, ...segments: string[]): string | null;
     /**
     * Load all providers (3-tier priority)
-    * 1. .upstream/ (GitHub auto-download — primary source)
-    * 2. User custom (~/.adhdev/providers/ excluding .upstream)
-    * User custom always wins (highest priority).
+    * 1. ~/.adhdev/providers/.upstream/ — official git, auto-synced
+    * 2. ~/.adhdev/external/ — 3rd-party git sources, user-added,
+    *    bundled providers may include arbitrary JS (untrusted by default)
+    * 3. ~/.adhdev/providers/ (excluding .upstream) — user-authored customs,
+    *    always wins
+    * Highest priority listed last (overwrites earlier loads).
     * If .upstream/ is empty, call fetchLatest() before loadAll().
     */
     loadAll(): void;
@@ -295,6 +301,22 @@ export declare class ProviderLoader {
     *
     * @returns Whether an update occurred
     */
+    /**
+     * Sync providers from the ADHDev registry (registry.adhf.dev).
+     *
+     * Downloads only providers whose server checksum differs from the locally
+     * cached checksum. Falls back gracefully to the GitHub tarball path if the
+     * registry is unreachable or returns an unexpected response.
+     *
+     * Returns `{ updated: true }` when at least one provider file changed on disk,
+     * `{ updated: false }` when everything is already current, or
+     * `{ updated: false, error }` when the registry couldn't be reached and we
+     * should proceed to the GitHub tarball fallback.
+     */
+    fetchFromRegistry(): Promise<{
+        updated: boolean;
+        error?: string;
+    }>;
     fetchLatest(): Promise<{
         updated: boolean;
         error?: string;
@@ -305,7 +327,7 @@ export declare class ProviderLoader {
     private copyDirRecursive;
     /** .meta.json save */
     private writeMeta;
-    /** Count provider files (provider.js or provider.json) */
+    /** Count provider files (provider.v1.json or provider.json — at most one per dir). */
     private countProviders;
     /**
     * Get public settings schema for a provider (for dashboard UI rendering)

package/dist/providers/provider-trust.d.ts

@@ -0,0 +1,31 @@
+export type ProviderTrust = 'user-custom' | 'trusted' | 'trusted-with-scripts' | 'external-safe' | 'external-untrusted';
+export type ProviderLayer = 'user' | 'upstream' | 'external';
+export interface ProviderManifestShape {
+    /** Has a `tui` block — SDK builders consume it as code paths. */
+    hasTui: boolean;
+    /** Has a non-empty `overrides` object — JS override paths. */
+    hasOverrides: boolean;
+    /** compatibility[].scriptDir or defaultScriptDir is set — JS scripts dir. */
+    hasScriptDir: boolean;
+}
+/**
+ * Inspect a manifest to decide whether it ships JavaScript hooks.
+ * Cheap; pure; safe to call on every provider load.
+ */
+export declare function inspectManifestShape(manifest: Record<string, unknown>): ProviderManifestShape;
+/**
+ * Classify trust given the layer the provider was loaded from + the
+ * manifest's JS-hook footprint.
+ */
+export declare function classifyTrust(layer: ProviderLayer, shape: ProviderManifestShape): ProviderTrust;
+/**
+ * Returns true when activation should require an explicit user confirm.
+ * Today only `external-untrusted` qualifies; future trust levels may
+ * fold in here.
+ */
+export declare function requiresConfirmation(trust: ProviderTrust): boolean;
+/**
+ * Render a short human-readable rationale for the trust tag. Used by
+ * the dashboard's confirmation modal and the provider catalog tooltip.
+ */
+export declare function describeTrust(trust: ProviderTrust): string;

package/dist/providers/read-chat-contract.d.ts

@@ -1,2 +1,31 @@
 import type { ReadChatResult } from './contracts.js';
+import { CHAT_CONTRACT_VERSION_V1, CHAT_CONTRACT_VERSION_V2, type ChatContractVersion, type ReadChatResultV2 } from './transcript-v2.js';
+/**
+ * Read the producer-declared contract version from a raw read_chat payload.
+ * Returns v1 when absent or unrecognised, so legacy producers keep working
+ * through A1. A2 will tighten this to throw when an unsupported version is
+ * declared.
+ */
+export declare function readPayloadContractVersion(raw: unknown): ChatContractVersion;
+/**
+ * Validate a v2 payload. Thin wrapper around assertReadChatResultV2Payload
+ * that prefixes the contract violation with the caller's source label.
+ */
+export declare function validateReadChatResultV2Payload(raw: unknown, source?: string): ReadChatResultV2;
+/**
+ * Versioned entry point. Routes on the producer-declared contractVersion:
+ *   - v2 → strict v2 validation (transcript-v2.ts invariants)
+ *   - v1 (or absent) → legacy permissive validation
+ *
+ * Callers that have not yet been audited to handle v2 outputs should use
+ * validateReadChatResultPayload directly; that path stays bound to v1 shape
+ * during the A1 transition.
+ */
+export declare function validateReadChatResultPayloadVersioned(raw: unknown, source?: string): {
+    version: typeof CHAT_CONTRACT_VERSION_V1;
+    payload: ReadChatResult & Record<string, unknown>;
+} | {
+    version: typeof CHAT_CONTRACT_VERSION_V2;
+    payload: ReadChatResultV2;
+};
 export declare function validateReadChatResultPayload(raw: unknown, source?: string): ReadChatResult & Record<string, unknown>;