@adhdev/daemon-core 0.9.82-rc.48 → 0.9.82-rc.481

package/src/status/snapshot.ts

@@ -145,21 +145,56 @@ function buildAvailableProviders(
         lastDetection?: AvailableProviderInfo['lastDetection'];
         lastVerification?: AvailableProviderInfo['lastVerification'];
         meshCoordinator?: AvailableProviderInfo['meshCoordinator'];
+        _sourceTrust?: AvailableProviderInfo['trust'];
+        _sourceLayer?: AvailableProviderInfo['sourceLayer'];
+        _sourceName?: string | null;
+        providerVersion?: string;
+        binary?: string;
+        status?: string;
+        details?: string;
+        links?: Record<string, string>;
     }> = providerLoader.getAvailableProviderInfos?.() || providerLoader.getAll();
-    return providers.map((provider) => ({
-        type: provider.type,
-        name: provider.displayName || provider.type,
-        displayName: provider.displayName || provider.type,
-        icon: provider.icon || '💻',
-        category: provider.category,
-        ...(provider.installed !== undefined ? { installed: provider.installed } : {}),
-        ...(provider.detectedPath !== undefined ? { detectedPath: provider.detectedPath } : {}),
-        ...(provider.enabled !== undefined ? { enabled: provider.enabled } : {}),
-        ...(provider.machineStatus !== undefined ? { machineStatus: provider.machineStatus } : {}),
-        ...(provider.lastDetection !== undefined ? { lastDetection: provider.lastDetection } : {}),
-        ...(provider.lastVerification !== undefined ? { lastVerification: provider.lastVerification } : {}),
-        ...(provider.meshCoordinator !== undefined ? { meshCoordinator: provider.meshCoordinator } : {}),
-    }));
+    // Trust helpers come from daemon-core; resolve them lazily so the
+    // status snapshot path stays loadable in older bundles that don't
+    // ship provider-trust yet.
+    let describeTrust: (trust: AvailableProviderInfo['trust']) => string = () => '';
+    let requiresConfirmation: (trust: AvailableProviderInfo['trust']) => boolean = () => false;
+    try {
+        const mod = require('../providers/provider-trust.js') as typeof import('../providers/provider-trust.js');
+        describeTrust = mod.describeTrust as typeof describeTrust;
+        requiresConfirmation = mod.requiresConfirmation as typeof requiresConfirmation;
+    } catch { /* enrichment only */ }
+    return providers.map((provider) => {
+        const trust = (provider as any)._sourceTrust as AvailableProviderInfo['trust'] | undefined;
+        const sourceLayer = (provider as any)._sourceLayer as AvailableProviderInfo['sourceLayer'] | undefined;
+        const sourceName = (provider as any)._sourceName as string | null | undefined;
+        return {
+            type: provider.type,
+            name: provider.displayName || provider.type,
+            displayName: provider.displayName || provider.type,
+            icon: provider.icon || '💻',
+            category: provider.category,
+            ...(provider.installed !== undefined ? { installed: provider.installed } : {}),
+            ...(provider.detectedPath !== undefined ? { detectedPath: provider.detectedPath } : {}),
+            ...(provider.enabled !== undefined ? { enabled: provider.enabled } : {}),
+            ...(provider.machineStatus !== undefined ? { machineStatus: provider.machineStatus } : {}),
+            ...(provider.lastDetection !== undefined ? { lastDetection: provider.lastDetection } : {}),
+            ...(provider.lastVerification !== undefined ? { lastVerification: provider.lastVerification } : {}),
+            ...(provider.meshCoordinator !== undefined ? { meshCoordinator: provider.meshCoordinator } : {}),
+            ...(trust ? {
+                trust,
+                trustDescription: describeTrust(trust),
+                requiresConfirmation: requiresConfirmation(trust),
+            } : {}),
+            ...(sourceLayer ? { sourceLayer } : {}),
+            ...(sourceName ? { sourceName } : {}),
+            ...(provider.providerVersion ? { providerVersion: provider.providerVersion } : {}),
+            ...(provider.binary ? { binary: provider.binary } : {}),
+            ...(provider.status ? { status: provider.status } : {}),
+            ...(provider.details ? { details: provider.details } : {}),
+            ...(provider.links ? { links: provider.links } : {}),
+        };
+    });
 }
 
 export function buildMachineInfo(profile: 'full' | 'live' | 'metadata' = 'full'): MachineInfo {
@@ -248,7 +283,17 @@ function simplePreviewHash(value: string): string {
     return h.toString(16);
 }
 
-function getLastDisplayMessage(session: {
+/**
+ * Resolve the last user-visible (non-system) message for a session as a preview.
+ *
+ * Exported so the cloud coordinator can derive a preview for a LOCAL mesh-owned
+ * worktree session directly from the real provider instance it hosts. A REMOTE
+ * worker session has no local instance (its preview rides the completion event's
+ * finalSummary — see resolveMeshSurfacedSessionPreview), but a LOCAL coordinator
+ * IS the worker, so its hosted instance's transcript holds the assistant reply and
+ * this is the source of truth for that case.
+ */
+export function getLastDisplayMessage(session: {
     activeChat?: {
         messages?: Array<{
             role?: string;
@@ -297,18 +342,30 @@ export function getSessionCompletionMarker(session: {
             receivedAt?: number | string;
             timestamp?: number | string;
             _turnKey?: string;
+            kind?: string;
         }> | null
     } | null
 }) {
-    const lastMessage = session.activeChat?.messages?.at?.(-1);
-    if (!lastMessage) return '';
-    const role = typeof lastMessage.role === 'string' ? lastMessage.role : '';
-    if (role === 'user' || role === 'human' || role === 'system') return '';
-    if (typeof lastMessage._turnKey === 'string' && lastMessage._turnKey) return `turn:${lastMessage._turnKey}`;
-    if (typeof lastMessage.id === 'string' && lastMessage.id) return `id:${lastMessage.id}`;
-    if (typeof lastMessage.index === 'number' && Number.isFinite(lastMessage.index)) return `idx:${lastMessage.index}`;
-    const timestamp = getMessageEventTime(lastMessage);
-    return timestamp > 0 ? `ts:${timestamp}` : '';
+    const messages = session.activeChat?.messages;
+    if (!Array.isArray(messages) || messages.length === 0) return '';
+    // Walk backwards until we find an assistant message that's not a tool call,
+    // or a user/human message (which ends the turn). System messages and tool
+    // messages don't gate "task completion" — they can't be acknowledged
+    // independently and rotate too aggressively for marker-based bell clearing.
+    for (let i = messages.length - 1; i >= 0; i -= 1) {
+        const m = messages[i];
+        const role = typeof m?.role === 'string' ? m.role : '';
+        const kind = typeof m?.kind === 'string' ? m.kind : '';
+        if (role === 'user' || role === 'human') return '';
+        if (role === 'system') continue;
+        if (kind === 'tool') continue;
+        if (typeof m._turnKey === 'string' && m._turnKey) return `turn:${m._turnKey}`;
+        if (typeof m.id === 'string' && m.id) return `id:${m.id}`;
+        if (typeof m.index === 'number' && Number.isFinite(m.index)) return `idx:${m.index}`;
+        const timestamp = getMessageEventTime(m);
+        return timestamp > 0 ? `ts:${timestamp}` : '';
+    }
+    return '';
 }
 
 function getSessionLastUsedAt(session: {
@@ -347,9 +404,21 @@ function getUnreadState(
     if (status === 'generating' || status === 'starting') {
         return { unread: false, inboxBucket: 'working' };
     }
+    // Read-state resolution:
+    // - When provider supplies a `completionMarker`, prefer marker-equality.
+    //   But if `seenCompletionMarker` hasn't been recorded yet (legacy/transition
+    //   case), fall back to timestamp comparison so a stale marker doesn't keep
+    //   the bell lit after the user already viewed the conversation.
+    // - When there is no completionMarker, use timestamp + role guard.
+    // - Trailing `assistant.tool` turns no longer count as unread on their own
+    //   — the human can't acknowledge a tool call separately from the answer,
+    //   so they'd be stuck with a perpetually unread badge.
+    const ignorableTrailingRoles = lastRole === 'user' || lastRole === 'human' || lastRole === 'system' || lastRole === 'tool';
     const unread = completionMarker
-        ? completionMarker !== seenCompletionMarker
-        : hasContentChange && lastUsedAt > lastSeenAt && lastRole !== 'user' && lastRole !== 'human' && lastRole !== 'system';
+        ? (seenCompletionMarker
+            ? completionMarker !== seenCompletionMarker
+            : hasContentChange && lastUsedAt > lastSeenAt && !ignorableTrailingRoles)
+        : hasContentChange && lastUsedAt > lastSeenAt && !ignorableTrailingRoles;
     return { unread, inboxBucket: unread ? 'task_complete' : 'idle' };
 }
 

package/src/system/hash.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared SHA-256 hashing helpers for daemon-core (Node runtime).
+ *
+ * daemon-core runs under Node, so it uses `node:crypto` directly and must NOT
+ * import the server's WebCrypto-based `utils/crypto.ts` (different runtime +
+ * cross-package dependency direction). Output is byte-identical to that helper
+ * for the same input — lowercase hex SHA-256.
+ */
+import { createHash } from 'node:crypto';
+
+/** Full lowercase hex SHA-256 digest of `input`. */
+export function sha256Hex(input: string): string {
+    return createHash('sha256').update(input).digest('hex');
+}
+
+/**
+ * Truncated SHA-256 hex digest — the first `length` hex chars (default 16).
+ * Used for stable short identifiers (workspace hashes, token ids, coordinator
+ * home dirs) where collision risk at 16 hex chars (64 bits) is negligible.
+ */
+export function shortHash(input: string, length = 16): string {
+    return sha256Hex(input).slice(0, length);
+}

package/src/system/host-memory.ts

@@ -11,7 +11,10 @@
  */
 
 import * as os from 'os';
-import { execSync } from 'child_process';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+
+const execAsync = promisify(exec);
 
 export interface HostMemorySnapshot {
     totalMem: number;
@@ -21,19 +24,22 @@ export interface HostMemorySnapshot {
     availableMem: number;
 }
 
-function parseDarwinAvailableBytes(totalMem: number): number | null {
-    if (os.platform() !== 'darwin') return null;
+let cachedDarwinAvail: number | null = null;
+let darwinMemoryInterval: NodeJS.Timeout | null = null;
+
+async function updateDarwinMemoryCache() {
+    if (os.platform() !== 'darwin') return;
     try {
-        const out = execSync('vm_stat', {
+        const { stdout } = await execAsync('vm_stat', {
             encoding: 'utf-8',
             timeout: 4000,
             maxBuffer: 256 * 1024,
         });
-        const pageSizeMatch = out.match(/page size of (\d+)\s*bytes/i);
+        const pageSizeMatch = stdout.match(/page size of (\d+)\s*bytes/i);
         const pageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : 4096;
 
         const counts: Record<string, number> = {};
-        for (const line of out.split('\n')) {
+        for (const line of stdout.split('\n')) {
             const m = line.match(/^\s*Pages\s+([^:]+):\s+([\d,]+)\s*\.?/);
             if (!m) continue;
             const key = m[1].trim().toLowerCase().replace(/\s+/g, '_');
@@ -49,17 +55,28 @@ function parseDarwinAvailableBytes(totalMem: number): number | null {
 
         const availPages = free + inactive + speculative + purgeable + fileBacked;
         const bytes = availPages * pageSize;
-        if (!Number.isFinite(bytes) || bytes < 0) return null;
-        return Math.min(bytes, totalMem);
+        cachedDarwinAvail = Number.isFinite(bytes) && bytes >= 0 ? Math.min(bytes, os.totalmem()) : null;
     } catch {
-        return null;
+        // silently fallback
     }
 }
 
 export function getHostMemorySnapshot(): HostMemorySnapshot {
+    if (os.platform() === 'darwin' && !darwinMemoryInterval) {
+        updateDarwinMemoryCache();
+        darwinMemoryInterval = setInterval(updateDarwinMemoryCache, 3000);
+        darwinMemoryInterval.unref();
+    }
+
     const totalMem = os.totalmem();
     const freeMem = os.freemem();
-    const darwinAvail = parseDarwinAvailableBytes(totalMem);
-    const availableMem = darwinAvail != null ? darwinAvail : freeMem;
-    return { totalMem, freeMem, availableMem };
+    const availableMem = os.platform() === 'darwin'
+        ? (cachedDarwinAvail ?? freeMem)
+        : freeMem;
+
+    return {
+        totalMem,
+        freeMem,
+        availableMem,
+    };
 }

package/src/system/load-better-sqlite3.ts

@@ -0,0 +1,68 @@
+import { createRequire } from 'module';
+import type BetterSqlite3 from 'better-sqlite3';
+
+let cached: typeof BetterSqlite3 | undefined;
+
+/**
+ * Load the `better-sqlite3` constructor in a way that survives every runtime the
+ * daemon ships in.
+ *
+ * The naive `typeof require === 'function' ? require : createRequire(import.meta.url)`
+ * is unsafe inside the daemon-cloud bundle: esbuild emits CJS output but, for any
+ * chunk that touches `import.meta.url`, it shims the local `require` with a stub
+ * that THROWS `Dynamic require of "..." is not supported`. That stub is still
+ * `typeof === 'function'`, so the ternary picks it and the call throws — it never
+ * reaches the `createRequire` fallback. The failure surfaced as `mesh_send_task`
+ * crashing the whole tool call instead of gracefully degrading.
+ *
+ * The robust approach is to ATTEMPT the real `require` and CATCH the esbuild stub's
+ * throw, then fall back to `createRequire`. We try multiple resolution bases so the
+ * load works whether the code runs as:
+ *   - a genuine CJS module (bare `require` works),
+ *   - an esbuild CJS bundle with the throwing `require` shim (createRequire(import.meta.url)),
+ *   - a pure ESM module where `require` is undefined (createRequire(import.meta.url)).
+ */
+export function loadBetterSqlite3(): typeof BetterSqlite3 {
+    if (cached) return cached;
+
+    const errors: unknown[] = [];
+
+    // 1) Real CJS require, when present and not the esbuild throwing shim.
+    if (typeof require === 'function') {
+        try {
+            cached = require('better-sqlite3') as typeof BetterSqlite3;
+            return cached;
+        } catch (e) {
+            // Either the esbuild "Dynamic require is not supported" shim, or a
+            // genuine resolution failure. Fall through to createRequire.
+            errors.push(e);
+        }
+    }
+
+    // 2) createRequire anchored at this module's URL (works in ESM and in esbuild
+    //    CJS bundles, where import.meta.url is rewritten to a usable value).
+    try {
+        const metaUrl = typeof import.meta?.url === 'string' ? import.meta.url : undefined;
+        if (metaUrl) {
+            cached = createRequire(metaUrl)('better-sqlite3') as typeof BetterSqlite3;
+            return cached;
+        }
+    } catch (e) {
+        errors.push(e);
+    }
+
+    // 3) Last resort: createRequire anchored at the current working directory.
+    try {
+        cached = createRequire(`${process.cwd()}/__adhdev_better_sqlite3_loader__.js`)(
+            'better-sqlite3',
+        ) as typeof BetterSqlite3;
+        return cached;
+    } catch (e) {
+        errors.push(e);
+    }
+
+    const detail = errors
+        .map((e) => (e instanceof Error ? e.message : String(e)))
+        .join('; ');
+    throw new Error(`Failed to load better-sqlite3: ${detail}`);
+}

package/src/types.ts

@@ -43,6 +43,11 @@ export interface ChatMessage {
   index?: number;
   timestamp?: number;
   receivedAt?: number;
+  /** (A2.3) Monotonic sequence number per (session, source). Producer-asserted
+   *  when emitted by v2-aware providers (transcript v2 schema); otherwise
+   *  derived by the daemon from receivedAt/timestamp/index. ChatSourceMachine
+   *  uses this as the native peak watermark for regression detection. */
+  sequence?: number;
   _turnKey?: string;
   /** Tool calls associated with this message */
   toolCalls?: ToolCallInfo[];

package/dist/cli-adapters/terminal-backends/xterm-backend.d.ts

@@ -1,17 +0,0 @@
-import type { TerminalViewportBackend, TerminalViewportBackendOptions } from './types.js';
-export declare class XtermTerminalBackend implements TerminalViewportBackend {
-    readonly kind: "xterm";
-    private rows;
-    private cols;
-    private terminal;
-    constructor(options: TerminalViewportBackendOptions);
-    resize(rows: number, cols: number): void;
-    write(data: string): void;
-    getText(): string;
-    getCursorPosition(): {
-        col: number;
-        row: number;
-    };
-    dispose(): void;
-    private createTerminal;
-}

package/dist/mesh/mesh-sync.d.ts

@@ -1,53 +0,0 @@
-/**
- * Mesh Sync — Sync local mesh metadata to/from cloud D1
- *
- * When cloud is available, this module pushes local mesh config
- * to the server and pulls remote meshes that were created from
- * other machines. The local ~/.adhdev/meshes.json remains the
- * canonical source; cloud is a membership/metadata layer only.
- * Task/chat/ledger evidence remains local-first and must not be
- * synchronized through Cloud/D1.
- *
- * This is called lazily (not on daemon startup) — only when the
- * user explicitly opens the mesh page or runs `adhdev mesh sync`.
- */
-export interface MeshSyncTransport {
-    /** GET /api/v1/repo-meshes */
-    listRemoteMeshes(): Promise<{
-        meshes: RemoteMeshRecord[];
-    }>;
-    /** POST /api/v1/repo-meshes */
-    createRemoteMesh(data: {
-        name: string;
-        repo_identity: string;
-        repo_remote_url?: string;
-        default_branch?: string;
-        policy?: string;
-    }): Promise<{
-        mesh: RemoteMeshRecord;
-    }>;
-    /** DELETE /api/v1/repo-meshes/:id */
-    deleteRemoteMesh(meshId: string): Promise<void>;
-}
-export interface RemoteMeshRecord {
-    id: string;
-    name: string;
-    repo_identity: string;
-    repo_remote_url: string | null;
-    default_branch: string | null;
-    policy: string;
-    status: string;
-    created_at: string;
-    updated_at: string;
-}
-export interface MeshSyncResult {
-    pushed: number;
-    pulled: number;
-    deleted: number;
-    errors: string[];
-}
-/**
- * Push local meshes to cloud (upsert by repo_identity).
- * Pull remote meshes that don't exist locally.
- */
-export declare function syncMeshes(transport: MeshSyncTransport): Promise<MeshSyncResult>;

package/src/cli-adapters/terminal-backends/ghostty-vt-backend.d.ts

@@ -1,16 +0,0 @@
-import type { TerminalViewportBackend, TerminalViewportBackendOptions, TerminalViewportBackendPreference } from './types.js';
-export declare function resolveTerminalBackendPreference(): TerminalViewportBackendPreference;
-export declare function isGhosttyVtBackendAvailable(): boolean;
-export declare class GhosttyVtTerminalBackend implements TerminalViewportBackend {
-    readonly kind: "ghostty-vt";
-    private terminal;
-    constructor(options: TerminalViewportBackendOptions);
-    resize(rows: number, cols: number): void;
-    write(data: string): void;
-    getText(): string;
-    getCursorPosition(): {
-        col: number;
-        row: number;
-    };
-    dispose(): void;
-}

package/src/cli-adapters/terminal-backends/xterm-backend.ts

@@ -1,97 +0,0 @@
-import type { TerminalViewportBackend, TerminalViewportBackendOptions } from './types.js';
-
-type XtermBufferLine = {
-    translateToString(trimRight?: boolean): string;
-};
-
-type XtermBuffer = {
-    length: number;
-    viewportY: number;
-    cursorX?: number;
-    cursorY?: number;
-    getLine(index: number): XtermBufferLine | undefined;
-};
-
-type XtermTerminal = {
-    buffer: { active: XtermBuffer };
-    write(data: string, callback?: () => void): void;
-    resize(cols: number, rows: number): void;
-    dispose(): void;
-};
-
-let TerminalCtor: (new (options: { cols: number; rows: number; scrollback: number }) => XtermTerminal) | null = null;
-
-function loadTerminalCtor(): new (options: { cols: number; rows: number; scrollback: number }) => XtermTerminal {
-    if (!TerminalCtor) {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const mod = require('@xterm/xterm');
-        TerminalCtor = mod.Terminal || mod.default?.Terminal || mod.default;
-        if (!TerminalCtor) {
-            throw new Error('@xterm/xterm Terminal export not found');
-        }
-    }
-    return TerminalCtor;
-}
-
-export class XtermTerminalBackend implements TerminalViewportBackend {
-    readonly kind = 'xterm' as const;
-    private rows: number;
-    private cols: number;
-    private terminal: XtermTerminal;
-
-    constructor(options: TerminalViewportBackendOptions) {
-        this.rows = Math.max(1, options.rows | 0);
-        this.cols = Math.max(1, options.cols | 0);
-        this.terminal = this.createTerminal(options.scrollback);
-    }
-
-    resize(rows: number, cols: number): void {
-        this.rows = Math.max(1, rows | 0);
-        this.cols = Math.max(1, cols | 0);
-        this.terminal.resize(this.cols, this.rows);
-    }
-
-    write(data: string): void {
-        if (!data) return;
-        this.terminal.write(data);
-    }
-
-    getText(): string {
-        const buffer = this.terminal.buffer.active;
-        const start = Math.max(0, buffer.viewportY || 0);
-        const end = Math.max(start, Math.min(buffer.length || 0, start + this.rows));
-        const lines: string[] = [];
-
-        for (let i = start; i < end; i++) {
-            const line = buffer.getLine(i);
-            lines.push(line ? line.translateToString(true) : '');
-        }
-
-        let first = 0;
-        let last = lines.length;
-        while (first < last && !lines[first]?.trim()) first++;
-        while (last > first && !lines[last - 1]?.trim()) last--;
-        return lines.slice(first, last).join('\n');
-    }
-
-    getCursorPosition(): { col: number; row: number } {
-        const buffer = this.terminal.buffer.active;
-        return {
-            col: Math.max(0, buffer.cursorX || 0),
-            row: Math.max(0, buffer.cursorY || 0),
-        };
-    }
-
-    dispose(): void {
-        this.terminal.dispose();
-    }
-
-    private createTerminal(scrollback: number): XtermTerminal {
-        const Terminal = loadTerminalCtor();
-        return new Terminal({
-            cols: this.cols,
-            rows: this.rows,
-            scrollback,
-        });
-    }
-}

package/src/mesh/mesh-sync.ts

@@ -1,111 +0,0 @@
-/**
- * Mesh Sync — Sync local mesh metadata to/from cloud D1
- *
- * When cloud is available, this module pushes local mesh config
- * to the server and pulls remote meshes that were created from
- * other machines. The local ~/.adhdev/meshes.json remains the
- * canonical source; cloud is a membership/metadata layer only.
- * Task/chat/ledger evidence remains local-first and must not be
- * synchronized through Cloud/D1.
- *
- * This is called lazily (not on daemon startup) — only when the
- * user explicitly opens the mesh page or runs `adhdev mesh sync`.
- */
-
-import { listMeshes, getMesh, createMesh, deleteMesh, addNode, removeNode } from '../config/mesh-config.js';
-import type { LocalMeshEntry, LocalMeshNodeEntry } from '../repo-mesh-types.js';
-
-export interface MeshSyncTransport {
-    /** GET /api/v1/repo-meshes */
-    listRemoteMeshes(): Promise<{ meshes: RemoteMeshRecord[] }>;
-    /** POST /api/v1/repo-meshes */
-    createRemoteMesh(data: {
-        name: string;
-        repo_identity: string;
-        repo_remote_url?: string;
-        default_branch?: string;
-        policy?: string;
-    }): Promise<{ mesh: RemoteMeshRecord }>;
-    /** DELETE /api/v1/repo-meshes/:id */
-    deleteRemoteMesh(meshId: string): Promise<void>;
-}
-
-export interface RemoteMeshRecord {
-    id: string;
-    name: string;
-    repo_identity: string;
-    repo_remote_url: string | null;
-    default_branch: string | null;
-    policy: string;
-    status: string;
-    created_at: string;
-    updated_at: string;
-}
-
-export interface MeshSyncResult {
-    pushed: number;
-    pulled: number;
-    deleted: number;
-    errors: string[];
-}
-
-/**
- * Push local meshes to cloud (upsert by repo_identity).
- * Pull remote meshes that don't exist locally.
- */
-export async function syncMeshes(transport: MeshSyncTransport): Promise<MeshSyncResult> {
-    const result: MeshSyncResult = { pushed: 0, pulled: 0, deleted: 0, errors: [] };
-
-    let remoteMeshes: RemoteMeshRecord[];
-    try {
-        const res = await transport.listRemoteMeshes();
-        remoteMeshes = res.meshes;
-    } catch (e: any) {
-        result.errors.push(`Failed to list remote meshes: ${e.message}`);
-        return result;
-    }
-
-    const localMeshes = listMeshes();
-    const remoteByIdentity = new Map(remoteMeshes.map(m => [m.repo_identity, m]));
-    const localByIdentity = new Map(localMeshes.map(m => [m.repoIdentity, m]));
-
-    // Push: local meshes not in cloud
-    for (const local of localMeshes) {
-        if (!remoteByIdentity.has(local.repoIdentity)) {
-            try {
-                await transport.createRemoteMesh({
-                    name: local.name,
-                    repo_identity: local.repoIdentity,
-                    repo_remote_url: local.repoRemoteUrl,
-                    default_branch: local.defaultBranch,
-                    policy: JSON.stringify(local.policy),
-                });
-                result.pushed++;
-            } catch (e: any) {
-                result.errors.push(`Push failed for "${local.name}": ${e.message}`);
-            }
-        }
-    }
-
-    // Pull: remote meshes not in local
-    for (const remote of remoteMeshes) {
-        if (!localByIdentity.has(remote.repo_identity)) {
-            try {
-                let policy;
-                try { policy = JSON.parse(remote.policy); } catch { policy = undefined; }
-                createMesh({
-                    name: remote.name,
-                    repoIdentity: remote.repo_identity,
-                    repoRemoteUrl: remote.repo_remote_url || undefined,
-                    defaultBranch: remote.default_branch || undefined,
-                    policy,
-                });
-                result.pulled++;
-            } catch (e: any) {
-                result.errors.push(`Pull failed for "${remote.name}": ${e.message}`);
-            }
-        }
-    }
-
-    return result;
-}