@adhdev/daemon-core 0.9.82-rc.461 → 0.9.82-rc.463

package/src/providers/cli-provider-instance.ts

@@ -27,7 +27,7 @@ import { shouldCollectTraceCategory } from '../logging/debug-config.js';
 import { traceMeshEventStage, traceMeshEventDrop } from '../mesh/mesh-event-trace.js';
 import type { ChatMessage } from '../types.js';
 import { buildPersistedProviderEffectMessage, normalizeProviderEffects } from './control-effects.js';
-import { formatAutoApprovalMessage, pickApprovalButton, hasNegativeApprovalOption, hasReliableApprovalAffirmative, looksLikeActiveApprovalPromptText } from './approval-utils.js';
+import { formatAutoApprovalMessage, pickApprovalButton, hasNegativeApprovalOption, hasReliableApprovalAffirmative, looksLikeActiveApprovalPromptText, normalizeApprovalLabel } from './approval-utils.js';
 import { getCliScriptCommand, parseCliScriptResult } from './cli-script-results.js';
 import { mergeProviderPatchState, resolveProviderStateSurface } from './provider-patch-state.js';
 import { normalizeProviderSessionId } from './provider-session-id.js';
@@ -1517,6 +1517,22 @@ export class CliProviderInstance implements ProviderInstance {
         return probe;
     }
 
+    /**
+     * The spawned CLI's env overrides (e.g. the mesh coordinator points hermes
+     * at a per-coordinator HERMES_HOME so its state.db lives in a tmpdir instead
+     * of ~/.hermes). The native-history executor expands `${HERMES_HOME:-~/.hermes}`
+     * from this map, so the completion gate MUST pass it through — otherwise the
+     * gate reads ~/.hermes, finds no coordinator-session transcript, and
+     * false-fires missing_final_assistant on every coordinator turn.
+     */
+    private spawnedEnvOverrides(): Record<string, string> | undefined {
+        const meta = typeof (this.adapter as any)?.getRuntimeMetadata === 'function'
+            ? (this.adapter as any).getRuntimeMetadata()
+            : undefined;
+        const env = meta && typeof meta === 'object' ? (meta as Record<string, unknown>).spawnedEnv : undefined;
+        return env && typeof env === 'object' ? env as Record<string, string> : undefined;
+    }
+
     private readExternalCompletionMessages(): unknown[] | null {
         const adapterOwnsMessagesElsewhere = (this.adapter as any)?.chatMessagesOwnedExternally === true;
         if (!adapterOwnsMessagesElsewhere) return null;
@@ -1535,6 +1551,7 @@ export class CliProviderInstance implements ProviderInstance {
             historyBehavior: this.provider.historyBehavior,
             scripts: this.provider.scripts as any,
             sessionStartedAtMs: this.startedAt,
+            envOverrides: this.spawnedEnvOverrides(),
             forceRefresh: true,
         });
         if (restoredHistory.source !== 'provider-native') {
@@ -2317,19 +2334,31 @@ export class CliProviderInstance implements ProviderInstance {
             // kind gate). Surface the modal so the user decides; never pick blindly.
             return autoApproveActive;
         }
-        // Modal *identity* signature — the question/button set only, NO volatile
-        // counters. This is what the settle gate tracks: the FSM bumps
-        // approvalEntrySeq on every fresh waiting_approval entry, and a
-        // modal→generating→modal flap (the question line scrolled out of the
-        // captured frame while the button block stays) re-enters and bumps it
-        // again. Folding that seq into the settle signature made the 600ms
-        // settle clock restart on every flap, so the modal never stayed stable
-        // long enough to fire — the gate was never satisfied. Identity excludes
-        // the seq so button/seq flap of the SAME modal keeps one settle clock.
+        // Modal *identity* signature — the question plus the STABLE affirmative
+        // anchor only, NO volatile counters and NO raw button set. This is what
+        // the settle gate tracks: the FSM bumps approvalEntrySeq on every fresh
+        // waiting_approval entry, and a modal→generating→modal flap (the question
+        // line scrolled out of the captured frame while the button block stays)
+        // re-enters and bumps it again. Folding that seq into the settle signature
+        // made the 600ms settle clock restart on every flap, so the modal never
+        // stayed stable long enough to fire — the gate was never satisfied.
+        // Identity excludes the seq so seq flap of the SAME modal keeps one clock.
+        //
+        // The raw button set is also excluded: on a TALL Write/Edit diff claude's
+        // TUI repaints the button block 3↔5↔none between frames (buttons scroll in
+        // and out of the captured region), which flipped both buttons.join('|') and
+        // the positional buttonIndex every frame → signature flap → the settle
+        // clock reset 4–9s and only mask-stalled episodes leaked to the coordinator
+        // (AUTOAPPROVE-SETTLE-FLAP). The affirmative the auto-approve will actually
+        // press is the invariant across those repaints, so we anchor on its
+        // NORMALIZED label (numbers/bullets/punctuation stripped, so "1. Yes" and
+        // "3. Yes" collapse to "yes"). Message + affirmative label uniquely
+        // identifies the consent question without tracking the volatile button
+        // positions.
+        const affirmativeAnchor = normalizeApprovalLabel(buttonLabel);
         const modalSignature = [
             typeof modal?.message === 'string' ? modal.message.trim() : '',
-            buttons.join('|'),
-            buttonIndex,
+            affirmativeAnchor,
         ].join('::');
         // Busy-window re-entry guard still needs the seq: two DISTINCT
         // back-to-back approvals can carry identical message/buttons (common

package/src/providers/native-history/hermes-cli-transcript.ts

@@ -69,7 +69,59 @@ function openDb(): any | null {
     }
 }
 
+/**
+ * Expand an anchor session id to every session id in its logical cluster.
+ *
+ * hermes ≥0.14 splits a SINGLE logical turn across several `sessions` rows
+ * linked by `parent_session_id` (a 0-message intermediate row is common), and
+ * the turn's final assistant message lands in a DIFFERENT row than the one the
+ * daemon pins. A bidirectional walk — up the parent chain to the cluster root,
+ * then down through every descendant — returns the complete set from ANY anchor
+ * (root, middle, or leaf), mirroring the declarative executor's
+ * `session_cluster_query`. Falls back to the anchor alone if the schema has no
+ * `parent_session_id` column (older hermes) or the walk fails.
+ */
+function resolveClusterSessionIds(db: any, anchorId: string): string[] {
+    if (!anchorId) return [];
+    try {
+        const rows: any[] = db.prepare(
+            `WITH RECURSIVE
+               up(id) AS (
+                 SELECT id FROM sessions WHERE id = ?
+                 UNION
+                 SELECT s.parent_session_id FROM sessions s JOIN up ON s.id = up.id
+                   WHERE s.parent_session_id IS NOT NULL
+               ),
+               cluster(id) AS (
+                 SELECT id FROM up
+                 UNION
+                 SELECT s.id FROM sessions s JOIN cluster ON s.parent_session_id = cluster.id
+               )
+             SELECT id FROM cluster`,
+        ).all(anchorId);
+        const ids = new Set<string>([anchorId]);
+        for (const r of rows) {
+            if (r && r.id != null && String(r.id)) ids.add(String(r.id));
+        }
+        return Array.from(ids);
+    } catch {
+        // No parent_session_id column (older hermes) or a walk failure — the
+        // single anchor is still a valid (degenerate) cluster.
+        return [anchorId];
+    }
+}
+
 function loadMessagesForSession(db: any, sessionId: string): NativeHistoryMessage[] {
+    // Read the WHOLE sub-session cluster, not just the pinned anchor. hermes
+    // ≥0.14 writes a turn's final assistant into a descendant sub-session row,
+    // so an anchor-only read misses it → read_chat shows zero assistant bubbles
+    // and the completion gate false-fires missing_final_assistant. Gather every
+    // cluster member (parent-chain walk) and merge; the SQL `ORDER BY timestamp`
+    // re-interleaves bubbles from different sub-sessions into true chronological
+    // order so the final assistant lands last.
+    const clusterIds = resolveClusterSessionIds(db, sessionId);
+    if (clusterIds.length === 0) return [];
+    const placeholders = clusterIds.map(() => '?').join(', ');
     // Assistant turns whose finish_reason='tool_calls' persist an EMPTY
     // `content` — their payload lives in the `tool_calls` column. Filtering on
     // `content != ''` alone drops those rows, so a turn whose terminal message
@@ -79,10 +131,10 @@ function loadMessagesForSession(db: any, sessionId: string): NativeHistoryMessag
     const rows: any[] = db.prepare(
         `SELECT id, role, COALESCE(NULLIF(content, ''), tool_calls) AS content, timestamp
          FROM messages
-         WHERE session_id = ?
+         WHERE session_id IN (${placeholders})
            AND ((content IS NOT NULL AND content != '') OR (tool_calls IS NOT NULL AND tool_calls != ''))
          ORDER BY timestamp ASC, id ASC`,
-    ).all(sessionId);
+    ).all(...clusterIds);
     const out: NativeHistoryMessage[] = [];
     for (const r of rows) {
         const role = normalizeHermesRole(r.role);

package/src/providers/spec/native-history-executor.ts

@@ -279,12 +279,53 @@ function executeSqlite(src: NativeHistorySqliteSource, input: NativeHistoryInput
         // this schema-agnostic and only rescues the mis-bound-id case: a genuine
         // discovered pin (codex/claude use jsonl sources and never reach here;
         // any real sqlite pin has rows) still short-circuits on its own rows.
-        const resolveMessagesFor = (sessionId: string): any[] | null => {
-            if (!sessionId) return null;
-            let rows: any[];
-            try { rows = db.prepare(src.message_query).all(sessionId); }
-            catch { return null; }
-            return rows && rows.length > 0 ? rows : null;
+        // Expand an anchor session id to every session id in its logical
+        // cluster. When the spec declares `session_cluster_query` the anchor is
+        // run through it (bound `?`) and each returned row's FIRST column is a
+        // cluster member id — typically a WITH RECURSIVE walk up to the cluster
+        // root and back down through all descendants, so passing a root, middle,
+        // or leaf anchor all resolve the same complete set. The anchor is always
+        // included even if the query omits it (defensive) so a spec with no
+        // cluster query, or a query that returns nothing, still reads the anchor
+        // itself. Absent query → just the anchor (single-session behaviour).
+        const resolveClusterIds = (anchorId: string): string[] => {
+            const ids = new Set<string>();
+            if (anchorId) ids.add(anchorId);
+            if (src.session_cluster_query && anchorId) {
+                try {
+                    const rows: any[] = db.prepare(src.session_cluster_query).all(anchorId);
+                    for (const row of rows) {
+                        const idRaw = Object.values(row)[0];
+                        if (idRaw != null && String(idRaw)) ids.add(String(idRaw));
+                    }
+                } catch { /* fall back to anchor-only on a malformed cluster query */ }
+            }
+            return Array.from(ids);
+        };
+
+        // Read messages for an anchor's WHOLE cluster, merged and re-sorted by
+        // their mapped timestamp so bubbles from different sub-sessions interleave
+        // in true chronological order (the turn's final assistant — written into a
+        // descendant sub-session in the split-turn case — lands last). No per-session
+        // short-circuit: an anchor whose OWN row has zero messages (hermes writes a
+        // 0-message intermediate `sessions` row) still yields the cluster's rows,
+        // and the whole cluster is scanned rather than stopping at the first
+        // non-empty session. Returns null only when the ENTIRE cluster is empty,
+        // preserving the pin-validation contract below (a pin that resolves no rows
+        // anywhere is a mis-bound id and falls through to newest-session recovery).
+        const resolveMessagesFor = (anchorId: string): any[] | null => {
+            if (!anchorId) return null;
+            const clusterIds = resolveClusterIds(anchorId);
+            const merged: any[] = [];
+            for (const id of clusterIds) {
+                let rows: any[];
+                try { rows = db.prepare(src.message_query).all(id); }
+                catch { continue; }
+                if (rows && rows.length > 0) merged.push(...rows);
+            }
+            if (merged.length === 0) return null;
+            if (clusterIds.length > 1) sortRowsByMappedTimestamp(merged, src.message_map);
+            return merged;
         };
 
         const resolveNewestSessionId = (): string => {
@@ -362,6 +403,32 @@ function executeSqlite(src: NativeHistorySqliteSource, input: NativeHistoryInput
     }
 }
 
+/**
+ * Stable-sort merged cluster rows by their mapped timestamp so bubbles read
+ * from different sub-sessions interleave in true chronological order. Uses the
+ * same `message_map.timestamp_ms` jsonpath + `parseTimestamp` heuristic the
+ * projection uses, so the sort key agrees with the receivedAt each row will be
+ * given. Rows with no resolvable timestamp keep their pre-sort relative order
+ * (stable), and equal timestamps preserve insertion order — both matter because
+ * a turn's terminal bubbles can share a sub-second timestamp.
+ */
+function sortRowsByMappedTimestamp(rows: any[], map: NativeHistoryMessageMap): void {
+    if (!map.timestamp_ms) return;
+    const keyed = rows.map((row, index) => {
+        const parsed = parseTimestamp(jsonPathGet(row, map.timestamp_ms as string));
+        return { row, index, ts: parsed == null ? Number.NaN : parsed };
+    });
+    keyed.sort((a, b) => {
+        const aHas = !Number.isNaN(a.ts);
+        const bHas = !Number.isNaN(b.ts);
+        if (aHas && bHas && a.ts !== b.ts) return a.ts - b.ts;
+        // Missing-timestamp rows and ties fall back to original insertion order
+        // so the sort stays stable.
+        return a.index - b.index;
+    });
+    for (let i = 0; i < keyed.length; i += 1) rows[i] = keyed[i].row;
+}
+
 // ────────────────────────────────────────────────────────────────────────────
 // Path expansion + globbing
 // ────────────────────────────────────────────────────────────────────────────

package/src/providers/spec/types.ts

@@ -103,6 +103,28 @@ export interface NativeHistorySqliteSource {
     path: string;
     session_query: string;
     message_query: string;
+    /**
+     * Optional sub-session cluster expansion. Some agents (hermes ≥0.14) split
+     * a SINGLE logical turn across several `sessions` rows linked by a parent
+     * pointer, and the turn's final assistant message lands in a DIFFERENT row
+     * than the one `session_query` / the daemon's pin resolves. Reading only
+     * the anchor session then surfaces zero (or stale) assistant bubbles even
+     * though the answer is physically present in a sibling/descendant row —
+     * `read_chat` returns no final assistant and the completion gate false-fires
+     * `missing_final_assistant`.
+     *
+     * When present, the executor treats the resolved session id as an ANCHOR
+     * and runs this query (bound `?` = anchor id) to expand it to every session
+     * id in the same logical cluster (typically a `WITH RECURSIVE` walk over the
+     * parent pointer, up to the root and back down through all descendants).
+     * `message_query` is then run once per cluster id and the rows merged and
+     * re-sorted by their mapped timestamp, so the turn's final assistant — in
+     * whichever sub-session it was written — is always included. Each returned
+     * row's first column is a cluster session id.
+     *
+     * Absent → single-session behaviour is unchanged (anchor session only).
+     */
+    session_cluster_query?: string;
     message_map: NativeHistoryMessageMap;
 }
 

package/src/repo-mesh-types.ts

@@ -1020,6 +1020,38 @@ export interface RepoMeshStatus {
      * Omitted when nothing was drained. Mirrors the MCP tool's meshProtocolMetrics.
      */
     meshProtocolMetrics?: MeshProtocolMetrics;
+    /**
+     * T6 (B3c): live process-lifetime mesh-protocol-v2 enforce counters from THIS
+     * daemon — the enforce flag state, drain-routing tallies (deliver / route-away /
+     * dedup / quarantine), and the last-resort backstop fire counts (PHASE-4 synth,
+     * acked-hold fast-track / death-deadline). Diagnostic-only and never cached (a
+     * live snapshot). Under enforce, non-zero quarantine or backstop counts are the
+     * rollout-health signal (target 0). Omitted when unavailable.
+     */
+    meshProtocolV2Counters?: MeshProtocolV2Counters;
+}
+
+/** T6 (B3c) live v2 enforce/observability counters (see RepoMeshStatus.meshProtocolV2Counters). */
+export interface MeshProtocolV2Counters {
+    /** True when MESH_PROTOCOL_V2_ENFORCE is active on this daemon. */
+    enforce: boolean;
+    /** Drain-path routing tallies (accept + enforce). Process-lifetime totals. */
+    drain: {
+        v2Delivered: number;
+        v2RoutedAway: number;
+        v2DedupSkipped: number;
+        v2ValidationFailedAccepted: number;
+        v2ReattributedToDrainer: number;
+        v1BroadcastAccepted: number;
+        v2ValidationFailedQuarantined: number;
+        v1UnversionedQuarantined: number;
+    };
+    /** Last-resort backstop fire counts. Target 0 under a healthy v2 contract. */
+    backstop: {
+        phase4SynthesisFired: number;
+        ackedHoldFastTrackFired: number;
+        ackedHoldDeathDeadlineFired: number;
+    };
 }
 
 /** One provider's version skew across mesh nodes (see RepoMeshStatus.providerVersionSkew). */