@adhdev/daemon-core 0.9.82-rc.464 → 0.9.82-rc.466

package/src/providers/cli-provider-input-prompt.ts

@@ -0,0 +1,133 @@
+/**
+ * CLI provider structured-input helpers — image materialization + prompt build.
+ *
+ * Pure move out of cli-provider-instance.ts (no behavior change): the input
+ * envelope → CLI prompt string construction and its image-materialization
+ * support. cli-provider-instance re-exports buildCliStructuredInputPrompt so
+ * existing importers/tests keep their path.
+ */
+
+import * as os from 'os';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import { type InputEnvelope, type InputPart } from './contracts.js';
+
+const IMAGE_MIME_EXTENSIONS: Record<string, string> = {
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/jpg': '.jpg',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+    'image/bmp': '.bmp',
+    'image/tiff': '.tiff',
+    'image/svg+xml': '.svg',
+};
+
+function filePathFromUri(uri: string): string | null {
+    if (!uri) return null;
+    if (uri.startsWith('file://')) {
+        try {
+            return decodeURIComponent(new URL(uri).pathname);
+        } catch {
+            return uri.slice('file://'.length);
+        }
+    }
+    if (path.isAbsolute(uri)) return uri;
+    return null;
+}
+
+function extensionForImageMime(mimeType: string): string {
+    return IMAGE_MIME_EXTENSIONS[mimeType.toLowerCase()] || '.img';
+}
+
+function safeInputImageBasename(index: number, mimeType: string): string {
+    const extension = extensionForImageMime(mimeType);
+    const suffix = crypto.randomBytes(6).toString('hex');
+    return `adhdev-input-image-${Date.now()}-${index}-${suffix}${extension}`;
+}
+
+function materializeImageDataPart(part: Extract<InputPart, { type: 'image' }>, index: number, dir: string): string | null {
+    if (!part.data) return null;
+    const rawData = part.data.includes(',') ? part.data.split(',').pop() || '' : part.data;
+    if (!rawData) return null;
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, safeInputImageBasename(index, part.mimeType));
+    fs.writeFileSync(filePath, Buffer.from(rawData, 'base64'));
+    cleanupStaleMaterializedImages(dir);
+    return filePath;
+}
+
+const MATERIALIZED_IMAGE_MAX_AGE_MS = 60 * 60 * 1000; // 1 hour
+const MATERIALIZED_IMAGE_CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+let lastMaterializedImageCleanupAt = 0;
+
+function cleanupStaleMaterializedImages(dir: string): void {
+    const now = Date.now();
+    if (now - lastMaterializedImageCleanupAt < MATERIALIZED_IMAGE_CLEANUP_INTERVAL_MS) return;
+    lastMaterializedImageCleanupAt = now;
+    try {
+        const entries = fs.readdirSync(dir);
+        for (const entry of entries) {
+            if (!entry.startsWith('adhdev-input-image-')) continue;
+            const fullPath = path.join(dir, entry);
+            try {
+                const stat = fs.statSync(fullPath);
+                if (now - stat.mtimeMs > MATERIALIZED_IMAGE_MAX_AGE_MS) {
+                    fs.unlinkSync(fullPath);
+                }
+            } catch { /* file may have been removed concurrently */ }
+        }
+    } catch { /* dir may not exist or be inaccessible */ }
+}
+
+export function buildCliStructuredInputPrompt(
+    input: InputEnvelope,
+    options: { materializeDir?: string } = {},
+): string {
+    const promptParts: string[] = [];
+    const imageRefs: string[] = [];
+    const resourceRefs: string[] = [];
+    const materializeDir = options.materializeDir || path.join(os.tmpdir(), 'adhdev-input-media');
+
+    input.parts.forEach((part, index) => {
+        if (part.type === 'text' && part.text.trim()) {
+            promptParts.push(part.text.trim());
+            return;
+        }
+
+        if (part.type === 'image') {
+            const localPath = typeof part.uri === 'string' ? filePathFromUri(part.uri) : null;
+            const materializedPath = !localPath && part.data ? materializeImageDataPart(part, index, materializeDir) : null;
+            const ref = localPath || materializedPath || part.uri || '';
+            if (ref) imageRefs.push(ref);
+            if (part.alt?.trim()) promptParts.push(part.alt.trim());
+            return;
+        }
+
+        if (part.type === 'resource_link') {
+            resourceRefs.push([part.title, part.name, part.description, part.uri].filter(Boolean).join('\n'));
+            return;
+        }
+
+        if (part.type === 'resource') {
+            resourceRefs.push([part.name, part.text, part.uri].filter(Boolean).join('\n'));
+        }
+    });
+
+    // Only use textFallback when no explicit text parts were collected — it is
+    // the flattened version of the same parts, so appending it alongside them
+    // would duplicate the content for multipart inputs.
+    const hasExplicitTextParts = input.parts.some((part) => part.type === 'text' && part.text.trim());
+    if (!hasExplicitTextParts && input.textFallback.trim()) {
+        promptParts.push(input.textFallback.trim());
+    }
+
+    const ordered = [
+        ...imageRefs,
+        ...promptParts,
+        ...resourceRefs,
+    ].filter((value, index, values) => value.trim().length > 0 && values.indexOf(value) === index);
+
+    return ordered.join('\n');
+}

package/src/providers/cli-provider-instance.ts

@@ -9,8 +9,7 @@ import * as os from 'os';
 import * as path from 'path';
 import * as crypto from 'crypto';
 import * as fs from 'fs';
-import { createRequire } from 'node:module';
-import { normalizeInputEnvelope, type ProviderModule, flattenContent, type InputEnvelope, type InputPart } from './contracts.js';
+import { normalizeInputEnvelope, type ProviderModule, flattenContent, type InputEnvelope } from './contracts.js';
 import { assertProviderSupportsDeclaredInput, getEffectiveMessageInputSupport } from './provider-input-support.js';
 import type { ProviderInstance, ProviderState, ProviderEvent, InstanceContext, ProviderErrorReason, HotChatSessionState, SessionModalState } from './provider-instance.js';
 import { normalizeInteractivePrompt, normalizeInteractivePromptResponse, type InteractivePrompt } from './types/interactive-prompt.js';
@@ -39,14 +38,28 @@ import {
 import { buildChatMessage, buildRuntimeSystemChatMessage, isUserFacingChatMessage, normalizeChatMessages, resolveChatMessageKind, extractFinalSummaryFromMessages, extractFinalSummaryFromMessagesAfter, readChatMessageTimestampMs } from './chat-message-normalization.js';
 import { workingDirBasename } from './working-dir.js';
 import { ManualAttendanceTracker } from './manual-attendance.js';
-
-type PersistableCliHistoryMessage = {
-    role: string;
-    content: string;
-    kind?: string;
-    senderName?: string;
-    receivedAt?: number;
-};
+import { buildCliStructuredInputPrompt } from './cli-provider-input-prompt.js';
+import { type PersistableCliHistoryMessage, buildIncrementalHistoryAppendMessages } from './cli-provider-history-dedup.js';
+import {
+    isIdleStatus,
+    getMessageTime,
+    hasNonEmptyCliModalButtons,
+    isCliGeneratingLikeStatus,
+    computeTurnAnchoredDurationMs,
+    getDatabaseSync,
+    getForcedNewSessionScriptName,
+    waitForCliAdapterReady,
+} from './cli-provider-status-helpers.js';
+
+// Re-export moved public symbols so existing importers (index.ts, tests) keep
+// their `./cli-provider-instance.js` path. Pure move — no behavior change.
+export { buildCliStructuredInputPrompt } from './cli-provider-input-prompt.js';
+export { buildIncrementalHistoryAppendMessages } from './cli-provider-history-dedup.js';
+export {
+    computeTurnAnchoredDurationMs,
+    getForcedNewSessionScriptName,
+    waitForCliAdapterReady,
+} from './cli-provider-status-helpers.js';
 
 // Status snapshots only ever surface the newest messages: the cloud 'live'
 // profile drops chat messages entirely (loaded lazily via read_chat on
@@ -94,19 +107,6 @@ type CompletedDebouncePending = {
     lastOutputAtArm?: number;
 };
 
-function isIdleStatus(value: unknown): boolean {
-    const status = typeof value === 'string' ? value.trim().toLowerCase() : '';
-    return !status || status === 'idle' || status === 'ready';
-}
-
-
-function getMessageTime(message: unknown): number {
-    if (!message || typeof message !== 'object') return 0;
-    const record = message as { receivedAt?: unknown; timestamp?: unknown };
-    const value = Number(record.receivedAt ?? record.timestamp ?? 0);
-    return Number.isFinite(value) ? value : 0;
-}
-
 type CompletedFinalizationBlock = {
     reason: string;
     terminal?: boolean;
@@ -189,278 +189,6 @@ const TERMINAL_MESH_EVENTS = new Set([
     'agent:ready',
 ]);
 
-const IMAGE_MIME_EXTENSIONS: Record<string, string> = {
-    'image/png': '.png',
-    'image/jpeg': '.jpg',
-    'image/jpg': '.jpg',
-    'image/gif': '.gif',
-    'image/webp': '.webp',
-    'image/bmp': '.bmp',
-    'image/tiff': '.tiff',
-    'image/svg+xml': '.svg',
-};
-
-function filePathFromUri(uri: string): string | null {
-    if (!uri) return null;
-    if (uri.startsWith('file://')) {
-        try {
-            return decodeURIComponent(new URL(uri).pathname);
-        } catch {
-            return uri.slice('file://'.length);
-        }
-    }
-    if (path.isAbsolute(uri)) return uri;
-    return null;
-}
-
-function extensionForImageMime(mimeType: string): string {
-    return IMAGE_MIME_EXTENSIONS[mimeType.toLowerCase()] || '.img';
-}
-
-function safeInputImageBasename(index: number, mimeType: string): string {
-    const extension = extensionForImageMime(mimeType);
-    const suffix = crypto.randomBytes(6).toString('hex');
-    return `adhdev-input-image-${Date.now()}-${index}-${suffix}${extension}`;
-}
-
-function materializeImageDataPart(part: Extract<InputPart, { type: 'image' }>, index: number, dir: string): string | null {
-    if (!part.data) return null;
-    const rawData = part.data.includes(',') ? part.data.split(',').pop() || '' : part.data;
-    if (!rawData) return null;
-    fs.mkdirSync(dir, { recursive: true });
-    const filePath = path.join(dir, safeInputImageBasename(index, part.mimeType));
-    fs.writeFileSync(filePath, Buffer.from(rawData, 'base64'));
-    cleanupStaleMaterializedImages(dir);
-    return filePath;
-}
-
-const MATERIALIZED_IMAGE_MAX_AGE_MS = 60 * 60 * 1000; // 1 hour
-const MATERIALIZED_IMAGE_CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
-let lastMaterializedImageCleanupAt = 0;
-
-function cleanupStaleMaterializedImages(dir: string): void {
-    const now = Date.now();
-    if (now - lastMaterializedImageCleanupAt < MATERIALIZED_IMAGE_CLEANUP_INTERVAL_MS) return;
-    lastMaterializedImageCleanupAt = now;
-    try {
-        const entries = fs.readdirSync(dir);
-        for (const entry of entries) {
-            if (!entry.startsWith('adhdev-input-image-')) continue;
-            const fullPath = path.join(dir, entry);
-            try {
-                const stat = fs.statSync(fullPath);
-                if (now - stat.mtimeMs > MATERIALIZED_IMAGE_MAX_AGE_MS) {
-                    fs.unlinkSync(fullPath);
-                }
-            } catch { /* file may have been removed concurrently */ }
-        }
-    } catch { /* dir may not exist or be inaccessible */ }
-}
-
-function hasNonEmptyCliModalButtons(activeModal: unknown): boolean {
-    const buttons = (activeModal as any)?.buttons;
-    return Array.isArray(buttons) && buttons.some((button) => String(button || '').trim().length > 0);
-}
-
-function isCliGeneratingLikeStatus(status: unknown): boolean {
-    return status === 'generating' || status === 'streaming' || status === 'no_progress' || status === 'long_generating' || status === 'starting';
-}
-
-/**
- * NOTIF Defect-2a: the REPORTED short-generating duration, anchored on the IMMUTABLE turn
- * start. generatingStartedAt is reset to 0 on every mid-turn waiting_approval/idle blip and
- * re-armed on the next →generating, so a long turn that blips would otherwise measure only the
- * final 1.5-2.5s sliver. engine.currentTurnStartedAt (set once at onTurnStarted, surviving
- * mid-turn blips until the next turn starts) is preferred; generatingStartedAt is the fallback
- * for turns that never recorded an engine turn start. Returns 0 when neither anchor is set.
- * Pure / unit-testable.
- */
-export function computeTurnAnchoredDurationMs(
-    engineTurnStartedAt: number | undefined,
-    generatingStartedAt: number,
-    now: number,
-): { durationMs: number; anchor: 'turn-start' | 'generatingStartedAt' | 'none' } {
-    const engineStart = typeof engineTurnStartedAt === 'number' && Number.isFinite(engineTurnStartedAt)
-        ? engineTurnStartedAt
-        : 0;
-    if (engineStart > 0) return { durationMs: now - engineStart, anchor: 'turn-start' };
-    if (generatingStartedAt > 0) return { durationMs: now - generatingStartedAt, anchor: 'generatingStartedAt' };
-    return { durationMs: 0, anchor: 'none' };
-}
-
-export function buildCliStructuredInputPrompt(
-    input: InputEnvelope,
-    options: { materializeDir?: string } = {},
-): string {
-    const promptParts: string[] = [];
-    const imageRefs: string[] = [];
-    const resourceRefs: string[] = [];
-    const materializeDir = options.materializeDir || path.join(os.tmpdir(), 'adhdev-input-media');
-
-    input.parts.forEach((part, index) => {
-        if (part.type === 'text' && part.text.trim()) {
-            promptParts.push(part.text.trim());
-            return;
-        }
-
-        if (part.type === 'image') {
-            const localPath = typeof part.uri === 'string' ? filePathFromUri(part.uri) : null;
-            const materializedPath = !localPath && part.data ? materializeImageDataPart(part, index, materializeDir) : null;
-            const ref = localPath || materializedPath || part.uri || '';
-            if (ref) imageRefs.push(ref);
-            if (part.alt?.trim()) promptParts.push(part.alt.trim());
-            return;
-        }
-
-        if (part.type === 'resource_link') {
-            resourceRefs.push([part.title, part.name, part.description, part.uri].filter(Boolean).join('\n'));
-            return;
-        }
-
-        if (part.type === 'resource') {
-            resourceRefs.push([part.name, part.text, part.uri].filter(Boolean).join('\n'));
-        }
-    });
-
-    // Only use textFallback when no explicit text parts were collected — it is
-    // the flattened version of the same parts, so appending it alongside them
-    // would duplicate the content for multipart inputs.
-    const hasExplicitTextParts = input.parts.some((part) => part.type === 'text' && part.text.trim());
-    if (!hasExplicitTextParts && input.textFallback.trim()) {
-        promptParts.push(input.textFallback.trim());
-    }
-
-    const ordered = [
-        ...imageRefs,
-        ...promptParts,
-        ...resourceRefs,
-    ].filter((value, index, values) => value.trim().length > 0 && values.indexOf(value) === index);
-
-    return ordered.join('\n');
-}
-
-function normalizePersistableCliHistoryContent(content: unknown): string {
-    return flattenContent(content as any).replace(/\s+/g, ' ').trim();
-}
-
-function buildPersistableCliHistorySignature(message: PersistableCliHistoryMessage): string {
-    return [
-        String(message.role || ''),
-        String(message.kind || ''),
-        String(message.senderName || ''),
-        normalizePersistableCliHistoryContent(message.content),
-    ].join('|');
-}
-
-function hasSamePersistableCliHistoryIdentity(a: PersistableCliHistoryMessage, b: PersistableCliHistoryMessage): boolean {
-    return String(a?.role || '') === String(b?.role || '')
-        && String(a?.kind || '') === String(b?.kind || '')
-        && String(a?.senderName || '') === String(b?.senderName || '')
-        && String(a?.content || '') === String(b?.content || '');
-}
-
-export function buildIncrementalHistoryAppendMessages(
-    previousMessages: PersistableCliHistoryMessage[],
-    currentMessages: PersistableCliHistoryMessage[],
-): PersistableCliHistoryMessage[] {
-    if (!Array.isArray(currentMessages) || currentMessages.length === 0) return [];
-    if (!Array.isArray(previousMessages) || previousMessages.length === 0) return currentMessages;
-
-    const comparableLength = Math.min(previousMessages.length, currentMessages.length);
-    let sharedPrefixLength = 0;
-    while (
-        sharedPrefixLength < comparableLength
-        && hasSamePersistableCliHistoryIdentity(previousMessages[sharedPrefixLength], currentMessages[sharedPrefixLength])
-    ) {
-        sharedPrefixLength += 1;
-    }
-
-    if (sharedPrefixLength === currentMessages.length) return [];
-    if (sharedPrefixLength === previousMessages.length) return currentMessages.slice(sharedPrefixLength);
-
-    // Rare fallback: preserve the older whitespace-normalized behavior only when
-    // the cheap identity check detects a changed prefix. Recomputing normalized
-    // signatures for the full transcript on every idle status poll was a CPU
-    // hot path for long CLI sessions.
-    while (
-        sharedPrefixLength < comparableLength
-        && buildPersistableCliHistorySignature(previousMessages[sharedPrefixLength])
-            === buildPersistableCliHistorySignature(currentMessages[sharedPrefixLength])
-    ) {
-        sharedPrefixLength += 1;
-    }
-
-    if (sharedPrefixLength === currentMessages.length) return [];
-    if (sharedPrefixLength === previousMessages.length) return currentMessages.slice(sharedPrefixLength);
-    return currentMessages;
-}
-
-let CachedDatabaseSync: (new (path: string, options?: { readOnly?: boolean }) => {
-    prepare(sql: string): { get(...params: Array<string | number>): unknown };
-    close(): void;
-}) | null = null;
-
-function getDatabaseSync() {
-    if (CachedDatabaseSync) return CachedDatabaseSync;
-    const requireFn = typeof require === 'function'
-        ? require
-        : createRequire(path.join(process.cwd(), '__adhdev_sqlite_loader__.js'));
-    const sqliteModule = requireFn(`node:${'sqlite'}`) as {
-        DatabaseSync: typeof CachedDatabaseSync;
-    };
-    CachedDatabaseSync = sqliteModule.DatabaseSync;
-    if (!CachedDatabaseSync) {
-        throw new Error('node:sqlite DatabaseSync unavailable');
-    }
-    return CachedDatabaseSync;
-}
-
-export function getForcedNewSessionScriptName(
-    provider: ProviderModule | undefined,
-    launchMode: 'new' | 'resume' | 'manual',
-): string | null {
-    if (!provider || launchMode !== 'new') return null;
-    const resume = provider.resume;
-    if (!resume?.supported) return null;
-    if (Array.isArray(resume.newSessionArgs) && resume.newSessionArgs.length > 0) return null;
-
-    const controls = Array.isArray((provider as any).controls) ? (provider as any).controls : [];
-    for (const control of controls) {
-        if (control?.type !== 'action') continue;
-        if (typeof control?.confirmTitle === 'string' && control.confirmTitle.trim()) continue;
-        if (typeof control?.confirmMessage === 'string' && control.confirmMessage.trim()) continue;
-        if (typeof control?.confirmLabel === 'string' && control.confirmLabel.trim()) continue;
-        const invokeScript = typeof control?.invokeScript === 'string' ? control.invokeScript.trim() : '';
-        if (!invokeScript) continue;
-        const controlId = typeof control?.id === 'string' ? control.id.trim() : '';
-        if (controlId === 'new_session' || /^new.?session$/i.test(invokeScript)) {
-            return invokeScript;
-        }
-    }
-
-    return null;
-}
-
-export async function waitForCliAdapterReady(
-    adapter: { isReady?: () => boolean; getStatus?: () => { status?: string } },
-    options?: { timeoutMs?: number; pollMs?: number },
-): Promise<void> {
-    const timeoutMs = Math.max(100, options?.timeoutMs ?? 15_000);
-    const pollMs = Math.max(10, options?.pollMs ?? 50);
-    const deadline = Date.now() + timeoutMs;
-
-    while (Date.now() < deadline) {
-        if (adapter?.isReady?.()) return;
-        const status = adapter?.getStatus?.()?.status;
-        if (status === 'stopped') {
-            throw new Error('CLI runtime stopped before it became ready');
-        }
-        await new Promise((resolve) => setTimeout(resolve, pollMs));
-    }
-
-    throw new Error(`CLI runtime did not become ready within ${timeoutMs}ms`);
-}
-
 export class CliProviderInstance implements ProviderInstance {
     readonly type: string;
     readonly category = 'cli' as const;
@@ -493,6 +221,34 @@ export class CliProviderInstance implements ProviderInstance {
      */
     private static readonly AUTO_APPROVE_GATE_HYSTERESIS_MS = 1500;
 
+    /**
+     * AUTOAPPROVE-FLAP-RECUR (Fix B): extended busy-side continuity window for a
+     * DELEGATED-WORKER auto-approve episode that is genuinely still cycling.
+     *
+     * The default AUTO_APPROVE_GATE_HYSTERESIS_MS (1500) absorbs a *momentary*
+     * `generating` blip. But a delegated worker running a Bash approval observed
+     * the FSM cycle the FULL state waiting_approval → busy → waiting_approval on a
+     * 2–5s period (the button set scrolls in/out AND the modal question repaints,
+     * so the adapter genuinely reports status=generating for whole seconds between
+     * approval frames). Each busy phase outran the 1500ms hysteresis, so the
+     * settle clock was WIPED (the genuine-resolution branch), the 600ms settle
+     * window never accumulated across the flap, resolveModal never fired
+     * (resolveModal count 0), and the mask-stall clock instead tripped at 4500ms →
+     * coordinator nudge → the flap the coordinator observed.
+     *
+     * A genuine resolution and a flap both start with a busy phase; they diverge
+     * only in whether waiting_approval RETURNS. So we cannot simply lengthen the
+     * blanket hysteresis (that would make every real resolution hold the gate
+     * open for seconds). Instead this longer window applies ONLY while an active
+     * mask episode is alive (autoApproveMaskSince > 0) AND the session is a
+     * delegated worker — i.e. exactly the never-resolving-flap case. A foreground
+     * / attended session keeps the tight 1500ms window unchanged. The mask-stall
+     * bound below still caps the episode, so a worker whose approval truly never
+     * returns is surfaced to the coordinator within AUTO_APPROVE_MASK_STALL_MS
+     * rather than held forever.
+     */
+    private static readonly AUTO_APPROVE_FLAP_CONTINUITY_MS = 4000;
+
     /**
      * STATUS-MISMATCH: upper bound on how long the auto-approve→`generating` SURFACE
      * mask may hide a worker's `waiting_approval` (status + activeModal) before we give
@@ -568,9 +324,22 @@ export class CliProviderInstance implements ProviderInstance {
     private pendingAutoApprovalSince = 0;
     private autoApproveSettleTimer: NodeJS.Timeout | null = null;
     // Wall-clock when auto-approve first observed status!=waiting_approval while
-    // a settle gate was in progress. Drives AUTO_APPROVE_GATE_HYSTERESIS_MS so a
+    // a settle gate was in progress. Drives AUTO_APPROVE_GATE_HYSTERESIS_MS (or,
+    // for a delegated-worker flap episode, AUTO_APPROVE_FLAP_CONTINUITY_MS) so a
     // brief generating flip does not immediately wipe the settle clock.
     private autoApproveInactiveSince = 0;
+    // AUTOAPPROVE-FLAP-RECUR (Fix A): wall-clock when the CURRENT waiting_approval
+    // episode last presented a concrete, captured modal (buttons.length > 0). The
+    // Claude TUI momentarily reports status=waiting_approval with activeModal=null
+    // / an empty button block while the button block scrolls out of the captured
+    // frame; the raw guard below (buttons.length===0) used to bail on that frame,
+    // never advancing the settle gate and leaving no re-check armed — so a modal
+    // that flapped modal=none ↔ N-buttons around the settle boundary never
+    // accumulated its 600ms. This tracks the last GOOD-modal frame so a short
+    // scroll-out blip is absorbed (settle keeps running against the last captured
+    // signature) while a genuinely closed modal — buttons empty continuously past
+    // the continuity window — is still recognised and resets the gate.
+    private autoApproveLastModalSeenAt = 0;
     // STATUS-MISMATCH: wall-clock when the CURRENT auto-approve episode (waiting_approval
     // + shouldAutoApprove) first began wanting to mask. Unlike pendingAutoApprovalSince it
     // is NOT reset when the modal signature changes (a still-streaming/flapping prompt) and
@@ -1912,6 +1681,23 @@ export class CliProviderInstance implements ProviderInstance {
             || this.settings.meshNodeId || this.settings.launchedByCoordinator);
     }
 
+    /**
+     * AUTOAPPROVE-FLAP-RECUR (Fix A+B): how long a busy blip / modal scroll-out may
+     * persist before the in-progress settle gate is torn down. For a delegated
+     * worker whose auto-approve episode is genuinely still cycling (mask clock
+     * alive), the FSM's full waiting_approval → busy → waiting_approval flap runs
+     * on a multi-second period, so the settle continuity window is extended to
+     * AUTO_APPROVE_FLAP_CONTINUITY_MS to bridge it (still bounded, and still capped
+     * by AUTO_APPROVE_MASK_STALL_MS). Every other case — foreground/attended
+     * session, or no active mask episode — keeps the tight default hysteresis so a
+     * genuine resolution frees the gate promptly.
+     */
+    private autoApproveContinuityWindowMs(): number {
+        return this.autoApproveMaskSince > 0 && this.isMeshWorkerSession()
+            ? CliProviderInstance.AUTO_APPROVE_FLAP_CONTINUITY_MS
+            : CliProviderInstance.AUTO_APPROVE_GATE_HYSTERESIS_MS;
+    }
+
     // FALSE-IDLE (self-coordinator settle): an autonomously-progressing mesh session
     // is either a delegated worker (isMeshWorkerSession) OR the coordinator's OWN
     // claude-cli session (meshCoordinatorFor). Both run auto-approved tool turns whose
@@ -2218,6 +2004,7 @@ export class CliProviderInstance implements ProviderInstance {
             // returns false), so end the mask episode.
             this.autoApproveMaskSince = 0;
             this.stalledApprovalNudgeEpisode = 0;
+            this.autoApproveLastModalSeenAt = 0;
             if (this.autoApproveSettleTimer) clearTimeout(this.autoApproveSettleTimer);
             this.autoApproveSettleTimer = setTimeout(() => {
                 this.autoApproveSettleTimer = null;
@@ -2245,12 +2032,20 @@ export class CliProviderInstance implements ProviderInstance {
             if (this.pendingAutoApprovalSince) {
                 if (!this.autoApproveInactiveSince) this.autoApproveInactiveSince = now;
                 const goneForMs = now - this.autoApproveInactiveSince;
-                if (goneForMs < CliProviderInstance.AUTO_APPROVE_GATE_HYSTERESIS_MS) {
+                // AUTOAPPROVE-FLAP-RECUR (Fix B): a delegated-worker flap cycles the
+                // FULL waiting_approval → busy → waiting_approval state on a
+                // multi-second period, outrunning the tight default hysteresis and
+                // wiping the settle clock before 600ms ever accumulates. For an
+                // active worker mask episode the continuity window is widened (still
+                // capped by AUTO_APPROVE_MASK_STALL_MS) so the settle clock survives
+                // the busy phase and the returning approval keeps accruing settle time.
+                const continuityMs = this.autoApproveContinuityWindowMs();
+                if (goneForMs < continuityMs) {
                     if (this.autoApproveSettleTimer) clearTimeout(this.autoApproveSettleTimer);
                     this.autoApproveSettleTimer = setTimeout(() => {
                         this.autoApproveSettleTimer = null;
                         this.recheckAutoApproveSettled();
-                    }, CliProviderInstance.AUTO_APPROVE_GATE_HYSTERESIS_MS - goneForMs + 20);
+                    }, continuityMs - goneForMs + 20);
                     return autoApproveActive;
                 }
             }
@@ -2263,6 +2058,7 @@ export class CliProviderInstance implements ProviderInstance {
             // end the mask episode too (a later approval starts a fresh stall clock).
             this.autoApproveMaskSince = 0;
             this.stalledApprovalNudgeEpisode = 0;
+            this.autoApproveLastModalSeenAt = 0;
             if (this.autoApproveSettleTimer) { clearTimeout(this.autoApproveSettleTimer); this.autoApproveSettleTimer = null; }
             return autoApproveActive;
         }
@@ -2290,8 +2086,40 @@ export class CliProviderInstance implements ProviderInstance {
             ? modal.buttons.map((b: any) => String(b || '').trim()).filter(Boolean)
             : [];
         if (!modal || buttons.length === 0) {
+            // AUTOAPPROVE-FLAP-RECUR (Fix A): the button block momentarily scrolled
+            // out of the captured frame (status is still waiting_approval — we are
+            // on the active path). Do NOT tear the settle gate down on this frame:
+            // if a concrete modal was captured within the continuity window and a
+            // settle gate is in progress, this is a short scroll-out blip — keep the
+            // gate warm against the last-captured signature and arm a re-check so a
+            // silent PTY still re-drives the decision when the buttons repaint. Only
+            // once the modal has stayed empty PAST the continuity window is it a
+            // genuine close, and the gate is cleared here so a later approval
+            // re-settles from scratch (never fires on a stale timestamp).
+            const blipForMs = this.autoApproveLastModalSeenAt ? now - this.autoApproveLastModalSeenAt : Infinity;
+            if (this.pendingAutoApprovalSince && blipForMs < this.autoApproveContinuityWindowMs()) {
+                if (this.autoApproveSettleTimer) clearTimeout(this.autoApproveSettleTimer);
+                this.autoApproveSettleTimer = setTimeout(() => {
+                    this.autoApproveSettleTimer = null;
+                    this.recheckAutoApproveSettled();
+                }, this.autoApproveContinuityWindowMs() - blipForMs + 20);
+                return autoApproveActive;
+            }
+            if (blipForMs >= this.autoApproveContinuityWindowMs()) {
+                // Buttons empty continuously past the window → the modal genuinely
+                // closed (or never captured). Reset the per-signature settle gate so
+                // a later approval re-settles cleanly. The mask-stall clock keeps
+                // running underneath so a never-captured worker modal still surfaces
+                // to the coordinator within AUTO_APPROVE_MASK_STALL_MS.
+                this.pendingAutoApprovalSignature = '';
+                this.pendingAutoApprovalSince = 0;
+            }
             return autoApproveActive;
         }
+        // Concrete modal captured this frame — mark the last-good-modal timestamp so
+        // a subsequent scroll-out blip (buttons.length===0) can be told apart from a
+        // genuine close by how long it persists (Fix A above).
+        this.autoApproveLastModalSeenAt = now;
         // Picker/confirm exclusion (provider-common). A /model or /mode picker is
         // surfaced with status=waiting_approval so the dashboard shows it, but it
         // has no "correct" answer to auto-pick — blindly selecting the first
@@ -2409,6 +2237,7 @@ export class CliProviderInstance implements ProviderInstance {
         // Fired (resolveModal in flight) — the episode resolved; end the mask-stall clock.
         this.autoApproveMaskSince = 0;
         this.stalledApprovalNudgeEpisode = 0;
+        this.autoApproveLastModalSeenAt = 0;
         if (this.autoApproveBusyTimer) clearTimeout(this.autoApproveBusyTimer);
         this.autoApproveBusyTimer = setTimeout(() => {
             this.autoApproveBusy = false;
@@ -3434,6 +3263,18 @@ export class CliProviderInstance implements ProviderInstance {
         if (!this.isMeshWorkerSession()) return;
         if (adapterStatus?.status !== 'waiting_approval') return;
         if (!this.autoApproveMaskStalled(now)) return;
+        // AUTOAPPROVE-FLAP-RECUR (Fix C): the mask-stall bound tripped, but if a
+        // concrete approvable modal is on screen RIGHT NOW and the settle gate is
+        // already in progress, auto-approve is about to fire on its own (the same
+        // call runs the settle evaluation just below this nudge). Defer to the fire
+        // rather than paging the coordinator — the nudge would race a resolveModal
+        // that lands milliseconds later, producing the coordinator flap this fix
+        // targets. A genuinely stuck episode (no captured modal, or settle never
+        // engaged) still has pendingAutoApprovalSince === 0 here and pages normally.
+        const modalButtons = Array.isArray(adapterStatus.activeModal?.buttons)
+            ? adapterStatus.activeModal.buttons.map((b: any) => String(b || '').trim()).filter(Boolean)
+            : [];
+        if (this.pendingAutoApprovalSince && modalButtons.length > 0) return;
         // Exactly once per stalled episode (autoApproveMaskSince uniquely identifies it).
         if (this.stalledApprovalNudgeEpisode === this.autoApproveMaskSince) return;
         this.stalledApprovalNudgeEpisode = this.autoApproveMaskSince;