@adhdev/daemon-core 0.9.82-rc.47 → 0.9.82-rc.470

package/dist/commands/router-refine.d.ts

@@ -0,0 +1,137 @@
+import type { DaemonCommandRouter, CommandRouterResult } from './router.js';
+import { MeshRefineAsyncJobStatus, MeshRefineBatchJobHandle, MeshRefineBatchJobStatus, MeshRefineJobHandle, RefineContext, RefineStageOutcome } from '../mesh/mesh-refine-gates.js';
+export declare function buildRefineJobKey(self: DaemonCommandRouter, meshId: string, nodeId: string): string;
+export declare function buildRefineJobHandle(self: DaemonCommandRouter, args: {
+    meshId: string;
+    nodeId: string;
+    node?: any;
+    status?: MeshRefineAsyncJobStatus;
+    startedAt?: string;
+    completedAt?: string;
+    jobId?: string;
+    interactionId?: string;
+    retryOfJobId?: string;
+    coordinatorDaemonId?: string;
+}): MeshRefineJobHandle;
+export declare function queueRefineJobEvent(self: DaemonCommandRouter, event: 'refine:accepted' | 'refine:completed' | 'refine:failed', handle: MeshRefineJobHandle, result?: Record<string, unknown>): void;
+export declare function appendRefineJobLedger(self: DaemonCommandRouter, kind: 'task_dispatched' | 'task_completed' | 'task_failed', handle: MeshRefineJobHandle, result?: Record<string, unknown>): Promise<void>;
+/**
+ * On daemon restart, scan all mesh ledgers for refine jobs that were dispatched
+ * but never completed/failed (i.e. the daemon died mid-job).  Re-queue each one
+ * so the job runs to completion automatically without coordinator intervention.
+ */
+export declare function resumePendingRefineJobsOnStartup(self: DaemonCommandRouter): Promise<void>;
+/**
+ * Synchronous refinery for a single worktree node — the gate pipeline that
+ * validates, preflights (patch-equivalence / submodule-reachability /
+ * no-op), merges, aligns submodules, cleans up the worktree node and
+ * (optionally) pushes. The body is a flat sequence of stage methods; each
+ * stage either returns a terminal CommandRouterResult (gate failure or a
+ * successful already-merged short-circuit) or `continue` with the extended
+ * context. Behavior — stage order, every early-exit, and every result shape —
+ * is identical to the previous single inlined body.
+ */
+export declare function executeMeshRefineNodeSynchronously(self: DaemonCommandRouter, meshId: string, nodeId: string, args: any): Promise<CommandRouterResult>;
+/**
+ * resolve_refs stage: resolve the mesh / worktree node / source node /
+ * repoRoot, then the worktree branch, base branch, fetched base head and
+ * branch head. Seeds the RefineContext consumed by every later stage.
+ */
+export declare function refineResolveRefsStage(self: DaemonCommandRouter, meshId: string, nodeId: string, args: any, refineStages: Array<Record<string, unknown>>): Promise<RefineStageOutcome>;
+/**
+ * validation stage: run the refinery validation gate (typecheck / test /
+ * lint / build per node config) and block on failure or when no allowlisted
+ * command was available. On pass, stores the summary on the context.
+ */
+export declare function refineValidationStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome>;
+/**
+ * patch_equivalence stage: preflight that the worktree branch's cumulative
+ * patch is equivalent to base+branch. On a "behind base" branch, auto-rebase
+ * once and re-check; on an empty merge-tree with real branch changes, treat as
+ * already-merged-via-another-path and short-circuit to cleanup. Mutates the
+ * context's branchHead (after rebase) and patchEquivalence (rebased gate).
+ */
+export declare function refinePatchEquivalenceStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome>;
+/**
+ * submodule_reachability stage: verify every submodule gitlink commit that
+ * would land via the merge is reachable from its configured remote main
+ * branch (optionally auto-publishing when policy allows). Blocks the merge
+ * when any commit is unreachable. Stores the result on the context.
+ */
+export declare function refineSubmoduleReachabilityStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome>;
+/**
+ * effective_diff stage (no-op guard): block a silent no-op merge where the
+ * branch produces no effective root-tree diff against base — typically a
+ * submodule that has commits but whose root-level gitlink (pointer) bump was
+ * never committed, so the merge would land nothing real on main.
+ */
+export declare function refineEffectiveDiffStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome>;
+/**
+ * merge + finalize stage: perform the --no-ff merge, align submodule
+ * checkouts after merge, clean up (remove) the worktree node per policy,
+ * append the refinery ledger entry, and (unless approval is required) push the
+ * base branch. Always terminal — produces the final CommandRouterResult.
+ */
+export declare function refineMergeAndFinalizeStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome>;
+/**
+ * Batch refinery: converge multiple sibling worktree nodes onto the base branch
+ * in one sequential pipeline, absorbing the rebase + patch-equivalence churn that
+ * arises when several siblings touch the same submodule.
+ *
+ * Reuses executeMeshRefineNodeSynchronously per node — every node goes through the
+ * exact same validation / patch-equivalence / submodule-reachability / merge / cleanup
+ * gates, including its built-in auto-rebase onto fresh origin/<base>. Because each
+ * node fetches origin/<base> at the start of its own refine, a node merged earlier in
+ * the batch advances the base, and the next node's refine auto-rebases onto it before
+ * re-running patch-equivalence. No force-push, no reset — conflicting nodes are
+ * isolated as blocked_review while the rest of the batch proceeds.
+ */
+export declare function batchRefineMeshNodes(self: DaemonCommandRouter, meshId: string, requestedNodeIds: string[] | undefined, args: any): Promise<CommandRouterResult>;
+/**
+ * Convergence core shared by the synchronous batch entry and the async batch job.
+ * Refines each node in order: the per-node refine pipeline fetches origin/<base>
+ * fresh, so each merged sibling advances the base before the next node's auto-rebase
+ * + patch-equivalence re-check. A blocked/failed node is isolated; the batch
+ * continues with the remaining nodes. Does NOT touch the per-node merge logic — it
+ * only sequences calls to executeMeshRefineNodeSynchronously and aggregates outcomes.
+ */
+export declare function runMeshRefineBatchConvergence(self: DaemonCommandRouter, meshId: string, orderedNodes: any[], ordering: {
+    order: string[];
+    rationale?: unknown;
+}, args: any): Promise<CommandRouterResult>;
+export declare function buildRefineBatchJobKey(self: DaemonCommandRouter, meshId: string): string;
+export declare function buildRefineBatchJobHandle(self: DaemonCommandRouter, args: {
+    meshId: string;
+    nodeIds: string[];
+    order: string[];
+    status?: MeshRefineBatchJobStatus;
+    startedAt?: string;
+    completedAt?: string;
+    jobId?: string;
+    interactionId?: string;
+    coordinatorDaemonId?: string;
+}): MeshRefineBatchJobHandle;
+/**
+ * Emit a batch Refinery terminal/accepted event through the SAME pending-event +
+ * forward mechanism single-node refine uses (queueRefineJobEvent), so the
+ * coordinator's existing refine:accepted/completed/failed handling and message
+ * renderer apply unchanged. The aggregate per-node results ride along in `result`.
+ */
+export declare function queueRefineBatchJobEvent(self: DaemonCommandRouter, event: 'refine:accepted' | 'refine:completed' | 'refine:failed', handle: MeshRefineBatchJobHandle, result?: Record<string, unknown>): void;
+export declare function appendRefineBatchJobLedger(self: DaemonCommandRouter, kind: 'task_dispatched' | 'task_completed' | 'task_failed', handle: MeshRefineBatchJobHandle, result?: Record<string, unknown>): Promise<void>;
+export declare function finishMeshRefineBatchJob(self: DaemonCommandRouter, handle: MeshRefineBatchJobHandle, orderedNodes: any[], ordering: {
+    order: string[];
+    rationale?: unknown;
+}, args: any): Promise<void>;
+/**
+ * Async entry for the batch Refinery execute path. Mirrors startMeshRefineJob:
+ * resolves the plan synchronously (so target/ordering errors and the dry-run shape
+ * stay synchronous), then for execute=true registers an in-flight batch job, returns
+ * {async:true, status:'accepted', batch:true, ...plan} immediately, and runs the
+ * convergence loop in the background — emitting the same terminal refine event.
+ * Idempotent: a batch already in flight for this mesh returns the running handle
+ * with duplicate:true rather than spawning a second background job.
+ */
+export declare function startMeshRefineBatchJob(self: DaemonCommandRouter, meshId: string, requestedNodeIds: string[] | undefined, args: any): Promise<CommandRouterResult>;
+export declare function finishMeshRefineJob(self: DaemonCommandRouter, handle: MeshRefineJobHandle, args: any): Promise<void>;
+export declare function startMeshRefineJob(self: DaemonCommandRouter, meshId: string, nodeId: string, args: any): Promise<CommandRouterResult>;

package/dist/commands/router-worktree-cleanup.d.ts

@@ -0,0 +1,133 @@
+import type { DaemonCommandRouter } from './router.js';
+import type { RepoMeshSessionCleanupMode } from '../repo-mesh-types.js';
+export declare function sessionMatchesMeshNode(self: DaemonCommandRouter, record: any, node: any, nodeId: string, sessionIds?: Set<string>): boolean;
+/**
+ * Best-effort recursive removal of a managed worktree directory.
+ *
+ * The git-registry de-registration is the safety-critical step of worktree
+ * teardown; a leftover directory must never gate dropping the node from the
+ * mesh. On Windows, `fs.rmSync` can throw EINVAL/EPERM/EBUSY on submodule
+ * gitlink (`.git`) files, long paths, junctions, or while a just-stopped
+ * delegate session is still releasing a handle/cwd on the directory. This
+ * helper absorbs those errors (never throws), with bounded retries + backoff
+ * to give handles time to release, and reports whether residue remains.
+ */
+export declare function bestEffortRemoveWorktreeDir(self: DaemonCommandRouter, dir: string): Promise<{
+    removed: boolean;
+    residue: boolean;
+    error?: string;
+}>;
+/**
+ * Non-destructive precheck mirroring every REFUSAL condition in
+ * {@link cleanupLocalWorktreeNode} — missing workspace / source-repo / branch
+ * metadata, unexpected (non-managed) path, branch mismatch — PLUS the
+ * dirty-worktree guard that `removeWorktree(requireClean)` enforces
+ * (`git status --porcelain`). It performs ZERO destructive actions: no
+ * `git worktree remove`, no `git worktree prune`, no directory deletion.
+ *
+ * remove_mesh_node calls this BEFORE any session cleanup so that a refusal
+ * (the common one being a dirty worktree) does not first stop/delete the
+ * delegated session and orphan it — the original ordering bug. Success/skip
+ * cases that the real cleanup handles idempotently (worktree path already
+ * gone, git-de-registered residue) are NOT refusals and return `{ ok: true }`.
+ *
+ * `force:true` skips the dirty guard, preserving `removeWorktree`'s
+ * `requireClean: !force` semantics. This is a read-only superset check; the
+ * authoritative `requireClean` guard inside `removeWorktree` is intentionally
+ * kept as a second line of defense against a precheck→execute race.
+ */
+export declare function precheckLocalWorktreeRemovable(self: DaemonCommandRouter, args: {
+    mesh: any;
+    node: any;
+    nodeId: string;
+    force?: boolean;
+}): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    error: string;
+    recoveryHint: string;
+}>;
+export declare function cleanupLocalWorktreeNode(self: DaemonCommandRouter, args: {
+    mesh: any;
+    node: any;
+    nodeId: string;
+    force?: boolean;
+}): Promise<{
+    success: true;
+    skipped?: boolean;
+    removedPath?: string;
+    repoRoot?: string;
+    reason?: string;
+    fallback?: string;
+    forced?: boolean;
+    convergence?: Record<string, unknown>;
+    recovered?: boolean;
+    residue?: boolean;
+    residueWarning?: string;
+    residueError?: string;
+    branchRefDeleted?: boolean;
+    branchRefReason?: string;
+    branchRefForced?: boolean;
+    branchRefWarning?: string;
+} | {
+    success: false;
+    code: string;
+    error: string;
+    recoveryHint: string;
+    convergence?: Record<string, unknown>;
+}>;
+export declare function getWorktreeForceCleanupConvergence(self: DaemonCommandRouter, args: {
+    repoRoot: string;
+    workspace: string;
+    node: any;
+}): Promise<{
+    allow: boolean;
+    status?: string;
+    source?: string;
+    ref?: string;
+    error?: string;
+}>;
+export declare function isCompletedHostedSession(self: DaemonCommandRouter, record: any): boolean;
+export declare function recordIntentionalMeshSessionStop(self: DaemonCommandRouter, args: {
+    meshId: string;
+    nodeId: string;
+    node: any;
+    sessionId: string;
+    mode: RepoMeshSessionCleanupMode;
+    source: 'mesh_cleanup_sessions' | 'mesh_remove_node' | 'magi_session_cleanup';
+    action: 'stop_session' | 'delete_session_force';
+}): Promise<void>;
+export declare function cleanupMeshSessions(self: DaemonCommandRouter, args: {
+    meshId: string;
+    nodeId: string;
+    node: any;
+    mode: RepoMeshSessionCleanupMode;
+    sessionIds?: string[];
+    dryRun?: boolean;
+    source?: 'mesh_cleanup_sessions' | 'mesh_remove_node' | 'magi_session_cleanup';
+    /**
+     * MAGI auto-cleanup safety gate: a map of sessionId → the queue task id that
+     * session must have been AUTO-LAUNCHED for (record meta autoLaunchedForQueueTaskId).
+     * When set, a matched explicit session is only acted on if its record carries that
+     * exact marker. A reused idle session (no marker), the coordinator session, a
+     * re-assigned session, or any session whose marker points at a DIFFERENT task is
+     * skipped (reason 'auto_launch_marker_mismatch') — so MAGI never kills a session it
+     * didn't itself spawn for this fan-out. Only consulted alongside explicit sessionIds.
+     */
+    requireAutoLaunchedForTaskIds?: Record<string, string>;
+    /**
+     * Opt-in orphan reclaim (default false). See SESSION-ACCUMULATION-LEAK.
+     * When true, a workspace-only live_runtime session (no node binding) OR a
+     * live_runtime session bound to a node absent from `liveMeshNodeIds` is
+     * stopped instead of skipped by the conservative shared-daemon guard. A
+     * session whose meshNodeId is STILL in `liveMeshNodeIds` (active sibling)
+     * is never reclaimed — that is the shared-daemon safety this preserves.
+     */
+    reclaimOrphans?: boolean;
+    liveMeshNodeIds?: string[];
+}): Promise<{
+    success: boolean;
+    [key: string]: unknown;
+}>;

package/dist/commands/router.d.ts

@@ -14,6 +14,11 @@ import { DaemonCliManager } from './cli-manager.js';
 import type { ProviderLoader } from '../providers/provider-loader.js';
 import type { ProviderInstanceManager } from '../providers/provider-instance-manager.js';
 import { SessionRegistry } from '../sessions/registry.js';
+import type { RepoMeshSessionCleanupMode } from '../repo-mesh-types.js';
+import { MeshRefineBatchJobHandle, MeshRefineBatchTerminalJob, MeshRefineJobHandle, MeshRefineTerminalJob } from '../mesh/mesh-refine-gates.js';
+export * from '../mesh/mesh-node-identity.js';
+export * from '../mesh/mesh-refine-gates.js';
+export * from '../mesh/mesh-coordinator-config.js';
 export interface SessionHostControlPlane {
     getDiagnostics(payload?: {
         includeSessions?: boolean;
@@ -55,12 +60,14 @@ export interface CommandRouterDeps {
         value: any[];
     };
     sessionRegistry: SessionRegistry;
-    /** Callback for CDP manager creation after launch_ide */
+    /** Callback after CDP manager created (transport-specific extras) */
     onCdpManagerCreated?: (ideType: string, manager: DaemonCdpManager) => void;
     /** Callback after IDE connected (e.g., startAgentStreamPolling) */
     onIdeConnected?: () => void;
     /** Callback after status change (stop_ide, restart) */
     onStatusChange?: () => void;
+    /** Callback when a mesh state is invalidated */
+    onMeshStateChange?: (meshId: string) => void;
     /** Callback after chat-related commands */
     onPostChatCommand?: () => void;
     /** Get a connected CDP manager (for agent stream reset check) */
@@ -81,33 +88,211 @@ export interface CommandRouterResult {
     success: boolean;
     [key: string]: unknown;
 }
+/**
+ * Confine a spec path to ~/.adhdev/providers, defeating both prefix-bypass
+ * (e.g. ".../providers-evil") and symlink escape. Resolves the real path of
+ * the *parent* directory (the file may not exist yet for writes), requires the
+ * basename to be a literal `*.json`, and re-joins under the verified parent so
+ * the returned path can't point outside the tree. Used by get/write_spec_source.
+ */
+export declare function normalizeStandaloneHostCommandUrl(hostAddress: string): string;
+export declare function buildMemberJoinNode(mesh: any, args: any, fallbackDaemonId?: string): Record<string, unknown> | null;
 export declare class DaemonCommandRouter {
-    private deps;
+    /** Public (not private) so the extracted ./router-refine.ts orchestration can reach it via `self`. */
+    deps: CommandRouterDeps;
     /** In-memory cache for cloud-originating meshes passed via inlineMesh.
      *  Allows the MCP server to query mesh data via get_mesh even when
      *  the mesh doesn't exist in the local meshes.json file. */
     private inlineMeshCache;
-    /** Coordinator-owned whole-mesh aggregate status snapshots. Browser callers read this by default. */
-    private aggregateMeshStatusCache;
+    /** Tombstones for inline mesh nodes removed via remove_mesh_node, keyed by
+     *  meshId → set of removed nodeIds. The dashboard keeps echoing the removed
+     *  node in the inlineMesh it attaches to every command; without a tombstone,
+     *  reconcileInlineMeshCache MERGEs it straight back (resurrection). A
+     *  tombstoned node is skipped during reconcile only while its workspace is
+     *  absent from disk — a genuine re-registration (same nodeId, workspace back
+     *  on disk) clears the tombstone and merges normally, preserving clone
+     *  worktree visibility and legitimate node re-creation. */
+    private removedInlineMeshNodeIds;
+    /** Coordinator-owned whole-mesh aggregate status snapshots. Browser callers read this by default.
+     *  Public (not private) so the extracted ./router-aggregate-status.ts orchestration can reach it via `self`. */
+    aggregateMeshStatusCache: Map<string, {
+        builtAt: number;
+        snapshot: any;
+        queueRevision: string;
+    }>;
+    /** Shared per-peer git_status probe dedup + recently-probed reuse gate.
+     *  Spans separate mesh_status/get_mesh calls so the dashboard auto-retry
+     *  loop cannot storm a slow peer with back-to-back refreshUpstream probes. */
+    private meshGitProbeCache;
+    /** Meshes with a background SWR freshen (async mesh_status refresh) already in
+     *  flight — so a burst of interactive detail-opens serves the cached snapshot
+     *  and coalesces onto ONE background refresh instead of storming the peers. */
+    private swrRefreshInFlight;
+    /** In-memory async Refinery jobs keyed by meshId:nodeId to reject/return duplicate in-flight requests.
+     *  Public (not private) so the extracted ./router-refine.ts orchestration can reach it via `self`. */
+    runningRefineJobs: Map<string, MeshRefineJobHandle>;
+    /** Terminal async Refinery jobs preserve a clear answer after the worktree node has been removed. */
+    terminalRefineJobs: Map<string, MeshRefineTerminalJob>;
+    /** In-memory async batch Refinery jobs keyed by meshId (one batch convergence per mesh at a time). */
+    runningRefineBatchJobs: Map<string, MeshRefineBatchJobHandle>;
+    /** Terminal async batch Refinery jobs preserve the last batch outcome for late readers. */
+    terminalRefineBatchJobs: Map<string, MeshRefineBatchTerminalJob>;
     constructor(deps: CommandRouterDeps);
-    private cloneJsonValue;
     private hydrateCachedAggregateMeshStatusFromInline;
     private getCachedAggregateMeshStatus;
     private rememberAggregateMeshStatus;
+    getCachedInlineMeshNodes(): any[];
+    resolveRemoteMeshSessionOwnerDaemonId(sessionId: string, ownerNodeIdHint?: string): string | undefined;
     getCachedInlineMesh(meshId: string, inlineMesh?: unknown): any | undefined;
     private warmInlineMeshCache;
-    private getMeshForCommand;
-    private invalidateAggregateMeshStatus;
+    getMeshForCommand(meshId: string, inlineMesh?: unknown, options?: {
+        preferInline?: boolean;
+    }): Promise<{
+        mesh: any;
+        inline: boolean;
+        source: 'inline_cache' | 'inline_bootstrap' | 'local_config';
+    } | null>;
+    invalidateAggregateMeshStatus(meshId: string): void;
+    /**
+     * Build the MedFamilyContext handed to RF-ROUTER MED family handlers. Binds the
+     * router-private collaborators those handlers need (mesh resolution, owner
+     * gating, inline-cache mutation, worktree / session cleanup, refine job
+     * starters, IDE stop/launch) plus the inline-mesh and git-probe caches. The
+     * `launchIde` field closes over the freshly-built context so restart_session /
+     * restart_ide invoke the IDE launch directly instead of recursing through
+     * executeDaemonCommand('launch_ide').
+     */
+    private buildMedFamilyContext;
+    /**
+     * Build the HighFamilyContext handed to RF-ROUTER HIGH family handlers. Binds
+     * the router-private collaborators those handlers need (mesh resolution, the
+     * aggregate-status memory cache + its bound read/write helpers, the
+     * running-refine-job table, inline-mesh + git-probe caches, and the router's
+     * own `execute` for the get_mesh_review_inbox mesh_status re-entry). HIGH
+     * handlers reach more router-owned state than MED, but the binding shape is
+     * the same: bound methods + direct field references, none reachable from
+     * `deps`.
+     */
+    private buildHighFamilyContext;
+    private requireMeshHostMutationOwner;
     private updateInlineMeshNode;
     private removeInlineMeshNode;
-    private normalizeMeshSessionCleanupMode;
-    private sessionMatchesMeshNode;
-    private cleanupLocalWorktreeNode;
-    private getWorktreeForceCleanupConvergence;
-    private isCompletedHostedSession;
-    private recordIntentionalMeshSessionStop;
-    private cleanupMeshSessions;
-    private traceSessionHostAction;
+    /**
+     * WORKTREE-BOOTSTRAP-COORD-STATE: mark a worktree node's bootstrap as reaching a
+     * terminal state (complete / failed) in THIS daemon's mesh view.
+     *
+     * Root cause this fixes: clone_mesh_node forwards the clone+bootstrap to the
+     * source node's daemon (the worktree's machine). persistWorktreeSetupState
+     * therefore flips worktreeBootstrap.status to 'complete' on the WORKER daemon's
+     * mesh object — never on the coordinator's. The coordinator only ever holds the
+     * 'running' state it stamped from the forwarded clone reply. The claim path's
+     * bootstrap gate (mesh-event-forwarding agent:ready / mesh-queue-assignment)
+     * reads the coordinator's mesh via getMeshWithCache, sees status==='running'
+     * forever, and DEFERS every claim — so the worktree_bootstrap_complete re-fire
+     * (triggerMeshQueue) loops against a gate that never opens: claim never lands,
+     * the idle session is re-registered each tick, and auto-launch keeps spawning
+     * fresh sessions (runaway worktree-session multiplication).
+     *
+     * Called from the worktree_bootstrap_complete/_failed event handler BEFORE the
+     * queue re-fire so the gate sees the terminal state and the deferred claim can
+     * finally land. Updates the inline cache (clone worktree nodes are inline-only)
+     * and, when the node also exists in local config, persists there too; both paths
+     * invalidate the aggregate status cache. Best-effort and idempotent.
+     */
+    markWorktreeBootstrapTerminalState(meshId: string, nodeId: string, status: 'complete' | 'failed', opts?: {
+        workspace?: string;
+    }): void;
+    private tombstoneRemovedInlineMeshNode;
+    /** Filter an incoming inline mesh against this mesh's tombstones before it is
+     *  reconciled into the cache. A tombstoned node is dropped only while its
+     *  workspace is still absent from disk; if the workspace is back (genuine
+     *  re-registration), the tombstone is cleared and the node merges normally. */
+    private applyInlineMeshNodeTombstones;
+    normalizeMeshSessionCleanupMode(value: unknown): RepoMeshSessionCleanupMode;
+    sessionMatchesMeshNode(record: any, node: any, nodeId: string, sessionIds?: Set<string>): boolean;
+    bestEffortRemoveWorktreeDir(dir: string): Promise<{
+        removed: boolean;
+        residue: boolean;
+        error?: string;
+    }>;
+    precheckLocalWorktreeRemovable(args: {
+        mesh: any;
+        node: any;
+        nodeId: string;
+        force?: boolean;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: string;
+        error: string;
+        recoveryHint: string;
+    }>;
+    cleanupLocalWorktreeNode(args: {
+        mesh: any;
+        node: any;
+        nodeId: string;
+        force?: boolean;
+    }): Promise<{
+        success: true;
+        skipped?: boolean;
+        removedPath?: string;
+        repoRoot?: string;
+        reason?: string;
+        fallback?: string;
+        forced?: boolean;
+        convergence?: Record<string, unknown>;
+        recovered?: boolean;
+        residue?: boolean;
+        residueWarning?: string;
+        residueError?: string;
+        branchRefDeleted?: boolean;
+        branchRefReason?: string;
+        branchRefForced?: boolean;
+        branchRefWarning?: string;
+    } | {
+        success: false;
+        code: string;
+        error: string;
+        recoveryHint: string;
+        convergence?: Record<string, unknown>;
+    }>;
+    getWorktreeForceCleanupConvergence(args: {
+        repoRoot: string;
+        workspace: string;
+        node: any;
+    }): Promise<{
+        allow: boolean;
+        status?: string;
+        source?: string;
+        ref?: string;
+        error?: string;
+    }>;
+    isCompletedHostedSession(record: any): boolean;
+    recordIntentionalMeshSessionStop(args: {
+        meshId: string;
+        nodeId: string;
+        node: any;
+        sessionId: string;
+        mode: RepoMeshSessionCleanupMode;
+        source: 'mesh_cleanup_sessions' | 'mesh_remove_node' | 'magi_session_cleanup';
+        action: 'stop_session' | 'delete_session_force';
+    }): Promise<void>;
+    cleanupMeshSessions(args: {
+        meshId: string;
+        nodeId: string;
+        node: any;
+        mode: RepoMeshSessionCleanupMode;
+        sessionIds?: string[];
+        dryRun?: boolean;
+        source?: 'mesh_cleanup_sessions' | 'mesh_remove_node' | 'magi_session_cleanup';
+        requireAutoLaunchedForTaskIds?: Record<string, string>;
+        reclaimOrphans?: boolean;
+        liveMeshNodeIds?: string[];
+    }): Promise<{
+        success: boolean;
+        [key: string]: unknown;
+    }>;
     /**
      * Unified command routing.
      * Returns result for all commands:
@@ -120,6 +305,10 @@ export declare class DaemonCommandRouter {
      * @param source Log source ('ws' | 'p2p' | 'standalone' | etc.)
      */
     execute(cmd: string, args: any, source?: string): Promise<CommandRouterResult>;
+    resumePendingRefineJobsOnStartup(): Promise<void>;
+    private batchRefineMeshNodes;
+    private startMeshRefineBatchJob;
+    private startMeshRefineJob;
     /**
      * Daemon-level command execution (IDE start/stop/restart, CLI, detect, logs).
      * Returns null if not handled at this level → caller delegates to CommandHandler.

package/dist/commands/upgrade-helper.d.ts

@@ -39,6 +39,46 @@ export declare function buildPinnedGlobalInstallCommand(options: {
 }): PinnedGlobalInstallCommand;
 export declare function getNpmExecOptions(platform?: NodeJS.Platform): NpmExecOptions;
 export declare function execNpmCommandSync(args: string[], options?: ExecFileSyncOptions, surface?: Pick<CurrentGlobalInstallSurface, 'npmExecutable' | 'npmArgsPrefix' | 'execOptions'>): Buffer | string;
-export declare function stopSessionHostProcesses(appName: string): void;
+export declare function stopSessionHostProcesses(appName: string): Promise<void>;
+/**
+ * Enumerate processes that have a locked native addon (conpty.node /
+ * ghostty-vt.dll) of *this* install memory-mapped.
+ *
+ * `stopSessionHostProcesses()` only knows the single managed session-host pid, so
+ * any *foreign* holder — e.g. an orphaned `pty_*probe*.cjs` left in `%TEMP%` — is
+ * invisible to it and keeps the addon locked through every install retry, dooming
+ * the upgrade with EBUSY. This scans by the module's full path so we only ever
+ * target a holder of the exact `packageRoot` being replaced (never an unrelated
+ * install's copy). Windows-only — these locks don't exist on POSIX.
+ */
+export declare function listForeignNativeAddonHolders(packageRoot: string | null | undefined): Array<{
+    pid: number;
+    commandLine: string | null;
+}>;
+/**
+ * Terminate every foreign process holding this install's native addon mapped,
+ * then wait for each to actually exit so the mapping is released before npm
+ * copies the file into its staging dir. Returns what it found/killed so the
+ * caller can surface an actionable recovery message on failure.
+ */
+export declare function stopForeignNativeAddonHolders(packageRoot: string | null | undefined, options?: {
+    parentPid?: number;
+}): Promise<Array<{
+    pid: number;
+    commandLine: string | null;
+    killed: boolean;
+}>>;
+/**
+ * Best-effort removal of a leftover npm staging entry.
+ *
+ * A stale staging dir can hold a locked native binary — e.g. `ghostty-vt.dll`
+ * from `@adhdev/ghostty-vt-node` still mapped by a lingering session-host
+ * process — which makes `rmSync` throw `EPERM` on Windows. Staging cleanup is
+ * only housekeeping: the leftover is inert and npm creates its own fresh
+ * staging dir for the real install, so a lock on an old leftover must NOT abort
+ * the upgrade. Log and continue instead of letting the error propagate.
+ */
+export declare function safeRemoveStaleEntry(target: string, label: string): void;
+export declare function cleanupStaleGlobalInstallDirs(pkgName: string, surface: CurrentGlobalInstallSurface): void;
 export declare function spawnDetachedDaemonUpgradeHelper(payload: DaemonUpgradeHelperPayload): void;
 export declare function maybeRunDaemonUpgradeHelperFromEnv(): Promise<boolean>;

package/dist/config/chat-history.d.ts

@@ -110,12 +110,21 @@ export declare function readProviderChatHistory(agentType: string, options?: {
     excludeRecentCount?: number;
     historyBehavior?: ProviderHistoryBehavior;
     scripts?: ProviderNativeHistoryScripts;
+    excludeInProgressTurn?: boolean;
+    sessionStartedAtMs?: number;
+    envOverrides?: Record<string, string>;
+    forceRefresh?: boolean;
 }): {
     messages: HistoryMessage[];
     hasMore: boolean;
     source: 'provider-native' | 'adhdev-mirror' | 'native-unavailable';
     sourcePath?: string;
     sourceMtimeMs?: number;
+    providerSessionId?: string;
+    workspace?: string;
+    nativeHistoryCoverage?: string;
+    partialReason?: string;
+    unavailableReason?: string;
 };
 export declare function listProviderHistorySessions(agentType: string, options?: {
     canonicalHistory?: ProviderCanonicalHistoryConfig;

package/dist/config/config.d.ts

@@ -71,6 +71,20 @@ export interface ADHDevConfig {
     disableUpstream?: boolean;
     providerSourceMode?: ProviderSourceMode;
     providerDir?: string;
+    /**
+     * Optional provider registry base URL override (for example a self-hosted
+     * registry). Highest-priority source in the registry resolver, ahead of the
+     * `ADHDEV_REGISTRY_URL` env var and the vendor default. See
+     * `config/registry-resolver.ts`.
+     */
+    registryUrl?: string;
+    /**
+     * Optional provider tarball (archive) URL override so self-hosters can point
+     * the daemon at their own provider mirror instead of the vendor GitHub repo.
+     * Highest-priority source, ahead of `ADHDEV_PROVIDER_TARBALL_URL` and the
+     * vendor default. See `config/registry-resolver.ts`.
+     */
+    providerTarballUrl?: string;
     /** Preferred daemon update channel. Defaults to stable/latest. */
     updateChannel?: ReleaseChannel;
     /**
@@ -86,6 +100,11 @@ export declare function isStableMachineId(machineId?: string | null): boolean;
  * Get the config directory path
  */
 export declare function getConfigDir(): string;
+/**
+ * Get the daemon runtime data directory (~/.adhdev/daemon/).
+ * Distinct from the user-config dir so runtime state can be cleared independently.
+ */
+export declare function getDaemonDataDir(): string;
 /**
  * Load configuration from disk
  */