@adhdev/daemon-core 0.9.82-rc.49 → 0.9.82-rc.490

package/dist/boot/daemon-lifecycle.d.ts

@@ -37,6 +37,7 @@ export interface DaemonInitConfig {
     enabledIdes?: string[];
     /** Router transport-specific callbacks */
     onStatusChange?: () => void;
+    onMeshStateChange?: (meshId: string) => void;
     onPostChatCommand?: () => void;
     sessionHostControl?: SessionHostControlPlane | null;
     getCdpLogFn?: (ideType: string) => (msg: string) => void;
@@ -61,6 +62,8 @@ export interface DaemonInitConfig {
     dispatchMeshCommand?: (daemonId: string, command: string, args: Record<string, unknown>) => Promise<any>;
     /** Returns selected-coordinator mesh peer telemetry for a target daemon when available. */
     getMeshPeerConnectionStatus?: (daemonId: string) => Record<string, unknown> | null;
+    /** Cloud-only: P2P dashboard metadata sync after the core forwarder handles a mesh event. */
+    onMeshCoordinatorEventForwarded?: (payload: Record<string, unknown>) => void;
 }
 export interface DaemonComponents {
     providerLoader: ProviderLoader;
@@ -78,6 +81,12 @@ export interface DaemonComponents {
     };
     refreshProviderAvailability: (providerType?: string) => Promise<void>;
     dispatchMeshCommand?: (daemonId: string, command: string, args: Record<string, unknown>) => Promise<any>;
+    getMeshPeerConnectionStatus?: (daemonId: string) => Record<string, unknown> | null;
+    onMeshCoordinatorEventForwarded?: (payload: Record<string, unknown>) => void;
+    meshReconcileLoop?: {
+        stop(): void;
+    };
+    statusInstanceId?: string;
 }
 export interface DaemonDevSupportOptions {
     components: DaemonComponents;

package/dist/boot/process-hardening.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Process-level hardening — boot-time mitigations against provider scripts.
+ *
+ * Provider scripts run in-process (see providers/sdk/v1/sandbox/README-design.ts).
+ * The require() whitelist (sandbox/require-whitelist.ts) blocks the obvious
+ * attack surfaces (no `child_process.exec`, no `fs.writeFile`, no `net`, etc.)
+ * but a malicious or buggy script can still:
+ *
+ *   1. Pollute Object.prototype to influence the daemon's downstream consumers
+ *      (e.g. `Object.prototype.toString = () => '...'` makes every untagged
+ *      object stringify to that value across the whole process).
+ *   2. Mutate Array/Function/String prototypes for similar effect.
+ *   3. Call `process.exit()` / `process.kill()` to kill the daemon.
+ *
+ * Sandbox isolation (isolated-vm) is the proper fix but has a real perf cost
+ * and a real marshalling-complexity cost. As a cheaper layer we just freeze
+ * the built-in prototypes at boot, which is irreversible and catches every
+ * prototype-pollution variant for the lifetime of the process.
+ *
+ * `applyProcessHardening()` is idempotent — calling it twice is a no-op the
+ * second time. The function intentionally swallows any "cannot redefine
+ * property" errors that would arise if some upstream code already froze
+ * the same prototype: the post-condition (prototype is frozen) is satisfied
+ * either way.
+ *
+ * Trade-offs:
+ *   - Read-only access to prototype methods (`Object.prototype.hasOwnProperty.call`,
+ *     `Array.prototype.slice.call`, etc.) is unaffected — only writes throw.
+ *   - Some older npm libraries patch Array.prototype or Function.prototype at
+ *     import time. If a daemon-core dep does this, the import will throw. The
+ *     daemon-core vitest suite is the canonical regression check for this.
+ *   - We deliberately do NOT freeze RegExp.prototype, Error.prototype, Map/Set
+ *     prototypes, or Date.prototype because at least one of those tends to be
+ *     mutated by mainstream test/runtime libs and the value of freezing them
+ *     is low (no useful prototype-pollution attack surface).
+ */
+/**
+ * Freeze the canonical built-in prototypes so provider scripts (and anything
+ * else running in this process) cannot mutate them. Idempotent.
+ *
+ * Returns the list of prototype names that were newly frozen — primarily for
+ * tests / observability. Already-frozen prototypes are not re-reported.
+ */
+export declare function applyProcessHardening(): string[];
+/** For tests only — clears the internal "already hardened" flag. The
+ *  prototypes themselves cannot be un-frozen, so this is mostly useful for
+ *  testing the idempotency guard. */
+export declare function _resetProcessHardeningForTest(): void;
+/** For tests only — peek at the hardened state. */
+export declare function _isProcessHardened(): boolean;

package/dist/build-info.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Daemon build stamp — single runtime source for "which commit is this running
+ * daemon built from?".
+ *
+ * The values are injected at BUILD time via tsup `define` (esbuild global
+ * replacement). Every build config that bundles daemon-core into a shippable
+ * daemon (daemon-core's own dist, daemon-standalone, daemon-cloud) replaces
+ * these `__DAEMON_BUILD_*` identifiers with the literal git commit/version that
+ * was current when the bundle was produced. See:
+ *   - oss/packages/daemon-core/tsup.config.ts      (standalone consumes this dist)
+ *   - packages/daemon-cloud/tsup.config.ts         (re-bundles daemon-core from source)
+ *
+ * If a bundle is produced WITHOUT the define (e.g. running src directly through
+ * tsx in dev, or a build env without git), the identifiers stay undefined and
+ * we fall back to `"unknown"` — never a ReferenceError, never a build failure.
+ *
+ * IMPORTANT (live-reflection caveat): a fresh local `daemon-core dist` rebuild +
+ * daemon restart is NOT enough to make a *cloud* daemon report a new commit —
+ * daemon-cloud ships its own re-bundle of daemon-core, so the build stamp only
+ * advances after the cloud daemon is rebuilt/redeployed and restarted. This is
+ * precisely the gap `mesh_status`'s `staleDaemonBuild` warning exists to surface.
+ */
+export interface DaemonBuildInfo {
+    /** Full 40-char git commit the daemon bundle was built from, or 'unknown'. */
+    commit: string;
+    /** Short (7-char) form of the same commit, or 'unknown'. */
+    commitShort: string;
+    /** package.json version baked in at build time, or 'unknown'. */
+    version: string;
+    /** ISO build timestamp if the build config injected one. */
+    builtAt?: string;
+}
+/**
+ * Resolve the build stamp baked into the running daemon bundle. Pure read of
+ * build-time constants — no I/O, safe to call from any runtime path. Cached.
+ */
+export declare function getDaemonBuildInfo(): DaemonBuildInfo;

package/dist/chat/source-machine.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Chat source state machine.
+ *
+ * Replaces the ad-hoc anchor + freshness + 6-trigger ladder that
+ * chat-commands.ts:1500-1800 grew over time. The machine has four states and
+ * three events; every other signal collapses to one of those three.
+ *
+ *   States                Meaning
+ *   ─────────────────────────────────────────────────────────────────
+ *   Booting               No native attempt evaluated yet. PTY is the source
+ *                         because we have nothing else; this is not a
+ *                         "fallback", just the starting condition.
+ *   NativeLocked          Native transcript is the source. The lock holds even
+ *                         when PTY receives newer bytes — only NativeRegressed
+ *                         or NativeUnavailable can break it.
+ *   PtyOnly               Native is genuinely not usable (unavailable /
+ *                         regressed / never observed). PTY is the source.
+ *   Recovering            We were NativeLocked, native disappeared, but we
+ *                         have not yet seen enough PTY-only turns to commit
+ *                         to PtyOnly. Behaves like PtyOnly for the current
+ *                         read but a single NativeProgressed re-locks.
+ *
+ *   Events                Meaning
+ *   ─────────────────────────────────────────────────────────────────
+ *   NativeProgressed      Native transcript has fresh, safely-mapped messages
+ *                         whose newest sequence is >= the last observed peak.
+ *   NativeRegressed       Native messages dropped, mapping became unsafe, or
+ *                         the transcript shrank. Strong unlock signal.
+ *   NativeUnavailable     Native transcript could not be fetched at all
+ *                         (read error, provider not supported, schema invalid).
+ *                         Soft unlock — Recovering tolerates a transient miss.
+ *
+ * Why this replaces the v1 design:
+ *   - The v1 freshness check (`isNativeHistoryFreshEnough`) compared native's
+ *     newest receivedAt to the PTY buffer's. PTY arrived every turn, so
+ *     native looked stale by default and only the 30-minute anchor TTL kept
+ *     things stable. When the anchor expired the source flipped, which is
+ *     the "plipping" the user reported. The new machine does not compare
+ *     PTY freshness against native at all; the only thing that unlocks a
+ *     NativeLocked state is evidence that native itself moved backwards or
+ *     vanished.
+ *   - The 6 trigger strings (`native_history_partial`, `native_history_stale`,
+ *     `native_history_not_safely_mapped`, `native_history_empty`,
+ *     `native_history_error:*`, `native_history_unavailable:*`) collapse to
+ *     three events. Each transition records the original trigger as `cause`
+ *     for observability, so we lose nothing diagnostic.
+ *   - There is no anchor store. The "lock" is a state, not a piece of
+ *     mutable data living on the adapter. Callers pass the previous state in
+ *     and get the next state out.
+ */
+import type { ChatContractVersion } from '../providers/transcript-v2.js';
+import { CHAT_CONTRACT_VERSION_V1, CHAT_CONTRACT_VERSION_V2 } from '../providers/transcript-v2.js';
+export type ChatSourceStateName = 'Booting' | 'NativeLocked' | 'PtyOnly' | 'Recovering';
+export type ChatSourceSelected = 'native-history' | 'pty-parser';
+export type ChatSourceEventKind = 'NativeProgressed' | 'NativeRegressed' | 'NativeUnavailable';
+/**
+ * Cause codes mirror the legacy 6-trigger vocabulary so existing log
+ * pipelines and dashboards can group transitions the same way they do
+ * today. They are diagnostic, not control-flow.
+ */
+export type ChatSourceTransitionCause = 'initial' | 'native_progressed' | 'native_regressed_shrunk' | 'native_regressed_unsafe_mapping' | 'native_regressed_coverage_partial' | 'native_regressed_coverage_unavailable' | 'native_unavailable_read_error' | 'native_unavailable_provider_unsupported' | 'native_unavailable_empty' | 'native_unavailable_not_native_source';
+export interface ChatSourceState {
+    readonly name: ChatSourceStateName;
+    /**
+     * Highest sequence number ever observed from native. Used as the watermark
+     * NativeProgressed has to reach (or exceed) before re-locking from
+     * Recovering. Undefined while we have never seen native.
+     */
+    readonly nativeSequencePeak: number | undefined;
+    /**
+     * Highest providerUnitKey set we have committed to. Future progressed events
+     * must be a superset (no removals) for the lock to hold; if any prior
+     * unit key vanishes we issue NativeRegressed instead. Empty when we have
+     * never locked.
+     */
+    readonly committedUnitKeys: ReadonlySet<string>;
+    /**
+     * Number of consecutive non-progressed observations while in Recovering.
+     * Threshold-based promotion to PtyOnly so transient misses do not commit
+     * us to PtyOnly prematurely. Always 0 outside Recovering.
+     */
+    readonly recoveringMisses: number;
+}
+export declare const INITIAL_CHAT_SOURCE_STATE: ChatSourceState;
+/**
+ * Promote from Recovering to PtyOnly after this many consecutive misses.
+ * One transient miss should not flip the source for a user who was just
+ * reading from native; three in a row signals native is genuinely gone.
+ */
+export declare const RECOVERING_MISS_PROMOTION_THRESHOLD = 3;
+/**
+ * Per-message identity slice the machine needs. Producers normalise their
+ * native transcript output into this shape (v2 producers already do so via
+ * transcript-v2.ts; v1 producers go through a thin adapter — see
+ * source-resolver.ts).
+ */
+export interface ResolverNativeMessageIdentity {
+    providerUnitKey: string;
+    sequence: number;
+}
+/**
+ * Observation the resolver hands to the machine for a single readChat call.
+ * Three mutually exclusive shapes — represented as a discriminated union so
+ * the type system enforces honesty about what happened.
+ */
+export type ChatSourceObservation = {
+    kind: 'native_present';
+    contractVersion: ChatContractVersion;
+    messages: ReadonlyArray<ResolverNativeMessageIdentity>;
+    /** Producer-declared coverage. Drives Progressed vs Regressed when the
+     *  transcript is non-empty but only partial. */
+    coverage: 'full' | 'tail' | 'current-turn' | 'partial';
+    /** True when the daemon can prove these native messages belong to the
+     *  intended workspace+session. False is treated as regression. */
+    safeMapping: boolean;
+} | {
+    kind: 'native_unavailable';
+    reason: 'provider_not_supported' | 'read_error' | 'empty' | 'not_native_source' | 'coverage_unavailable';
+};
+export interface ChatSourceTransition {
+    readonly fromState: ChatSourceStateName;
+    readonly toState: ChatSourceStateName;
+    readonly event: ChatSourceEventKind | 'NoOp';
+    readonly cause: ChatSourceTransitionCause;
+    /** Wall-clock ms at the moment of resolution. Producer time, not ordering. */
+    readonly at: number;
+}
+export interface ChatSourceLockState {
+    readonly locked: boolean;
+    /**
+     * ms since epoch when the current lock began. Undefined when not locked or
+     * not yet observed. Producers may use this for "anchored Xs ago" UI but
+     * the machine itself never expires a lock based on it — only events do.
+     */
+    readonly lockedSince?: number;
+}
+export interface ChatSourceDecision {
+    readonly selected: ChatSourceSelected;
+    readonly nextState: ChatSourceState;
+    readonly transition: ChatSourceTransition;
+    readonly lockState: ChatSourceLockState;
+}
+/**
+ * Pure transition function. Given a previous state and a single observation,
+ * returns the next state, the resulting transition record, and the selected
+ * source. No side effects. No mutation of `prev`.
+ *
+ * Lock semantics:
+ *   - Booting + native_present(safeMapping, not partial-only) → NativeLocked
+ *   - NativeLocked + native_present(superset of committed keys, safe) → stays NativeLocked
+ *   - NativeLocked + native_present(missing committed keys OR unsafe OR partial-shrunk) → PtyOnly
+ *   - NativeLocked + native_unavailable → Recovering (lock holds for the source decision but watermark survives)
+ *   - Recovering + native_present(progressed past peak) → NativeLocked
+ *   - Recovering + native_unavailable (RECOVERING_MISS_PROMOTION_THRESHOLD times) → PtyOnly
+ *   - PtyOnly is sticky: only an explicit progressed observation that meets
+ *     the original superset rule moves us back to NativeLocked. This is the
+ *     intended behaviour — once we have concluded native is dead, we do not
+ *     re-lock on a single transient revival.
+ */
+export declare function transitionChatSourceState(prev: ChatSourceState, observation: ChatSourceObservation, at: number, lockedSince: number | undefined): {
+    next: ChatSourceState;
+    transition: ChatSourceTransition;
+    selected: ChatSourceSelected;
+    lockState: ChatSourceLockState;
+};
+export { CHAT_CONTRACT_VERSION_V1, CHAT_CONTRACT_VERSION_V2 };

package/dist/chat/source-resolver.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Chat source resolver.
+ *
+ * Facade over ChatSourceMachine. Responsibilities:
+ *   - Normalise heterogeneous provider output (v1 ad-hoc identities, v2
+ *     ChatMessageV2) into ResolverNativeMessageIdentity slices the machine
+ *     can compare.
+ *   - Hold per-session machine state in an in-memory map (no anchor disk
+ *     persistence — the machine is fully recoverable from a fresh
+ *     observation).
+ *   - Maintain a small ring buffer of recent transitions per session so
+ *     debug surfaces (web-devconsole SourceTimeline, mesh_read_debug
+ *     bundles) can show *why* the source flipped, not just what it is now.
+ *
+ * What this module deliberately does NOT do:
+ *   - Decide which messages to display. The machine decides only between
+ *     `native-history` and `pty-parser`; selecting/merging the actual
+ *     message arrays stays in chat-commands.ts (A2.2).
+ *   - Mutate provider modules or CLI adapters. nativeHistoryAnchoredAt on
+ *     ProviderCliAdapter is gone in A2.2; the resolver is the new owner.
+ *   - Persist anything to disk. A daemon restart starts every session in
+ *     `Booting`, which lock-promotes on the first valid native observation
+ *     of the new process.
+ */
+import { INITIAL_CHAT_SOURCE_STATE, transitionChatSourceState, type ChatSourceDecision, type ChatSourceObservation, type ChatSourceState, type ChatSourceTransition } from './source-machine.js';
+import type { ChatContractVersion } from '../providers/transcript-v2.js';
+/** Maximum transitions retained per session for debug surfaces. */
+export declare const TRANSITION_HISTORY_LIMIT = 25;
+/** Composite key uniquely identifying a chat surface for state purposes.
+ *  We key by (providerType, sessionId) because the same provider may run
+ *  multiple sessions and each has its own native/PTY interplay. */
+export type ChatSourceSessionKey = string;
+export declare function chatSourceSessionKey(providerType: string, sessionId: string): ChatSourceSessionKey;
+/**
+ * Per-session machine store. Keyed by ChatSourceSessionKey. Daemon-lifetime
+ * memory; not persisted. Tests should create their own instance to keep
+ * isolation; production has a module-level singleton (CHAT_SOURCE_REGISTRY)
+ * exposed at the bottom of this file.
+ */
+export declare class ChatSourceRegistry {
+    private readonly records;
+    /** Snapshot of current state for diagnostics. Does not mutate. */
+    getState(key: ChatSourceSessionKey): ChatSourceState;
+    /** Recent transitions, newest last. Empty array when nothing has happened. */
+    getTransitions(key: ChatSourceSessionKey): ReadonlyArray<ChatSourceTransition>;
+    /** Drop a session. Caller should invoke this when the session is destroyed
+     *  to avoid unbounded growth across long-lived daemons. */
+    clear(key: ChatSourceSessionKey): void;
+    /** Drop all sessions. Test helper. */
+    clearAll(): void;
+    /**
+     * Apply one observation, returning the decision and side-effecting the
+     * stored state. The returned `nextState` is the same object now stored
+     * under `key`; callers may treat the decision as authoritative without
+     * re-reading.
+     */
+    observe(key: ChatSourceSessionKey, observation: ChatSourceObservation, at?: number): ChatSourceDecision;
+}
+/**
+ * Build a native_present observation from a v2 read_chat payload's message
+ * array. v2 producers already provide stable identity (transcript-v2.ts
+ * invariants), so this is a thin projection.
+ */
+export declare function buildV2NativePresentObservation(args: {
+    messages: ReadonlyArray<{
+        providerUnitKey: string;
+        sequence: number;
+    }>;
+    coverage: 'full' | 'tail' | 'current-turn' | 'partial';
+    safeMapping: boolean;
+}): ChatSourceObservation;
+/**
+ * Build a native_present observation from v1 producer output. v1 messages
+ * may have no providerUnitKey or a producer-derived one that shifts across
+ * reads (index/content-hash based). We synthesise a deterministic identity
+ * from the most stable fields available so the machine has *something* to
+ * compare across reads. This is intentionally lossy — A2.3 retires v1
+ * producers and this branch goes away.
+ *
+ * The synthesised key is NOT the same as the v2 contract key; never compare
+ * v1-synthesised keys against v2 keys for the same logical message. The
+ * registry naturally separates them by ChatSourceSessionKey so cross-version
+ * leakage cannot happen in practice.
+ */
+export declare function buildV1NativePresentObservation(args: {
+    providerType: string;
+    sessionId: string;
+    messages: ReadonlyArray<{
+        providerUnitKey?: unknown;
+        bubbleId?: unknown;
+        id?: unknown;
+        index?: unknown;
+        role?: unknown;
+        receivedAt?: unknown;
+        timestamp?: unknown;
+        content?: unknown;
+    }>;
+    coverage: 'full' | 'tail' | 'current-turn' | 'partial';
+    safeMapping: boolean;
+}): ChatSourceObservation;
+export declare const CHAT_SOURCE_REGISTRY: ChatSourceRegistry;
+export type { ChatSourceDecision, ChatSourceLockState, ChatSourceObservation, ChatSourceState, ChatSourceTransition, ChatSourceTransitionCause, ResolverNativeMessageIdentity, } from './source-machine.js';
+export { transitionChatSourceState, INITIAL_CHAT_SOURCE_STATE };
+export type { ChatContractVersion };

package/dist/chat/subscription-updates.d.ts

@@ -5,6 +5,7 @@ export interface ChatTailSubscriptionCursor {
 export type SessionChatTailCommandResult = Partial<Omit<ReadChatSyncResult, 'activeModal'>> & {
     success?: boolean;
     activeModal?: unknown;
+    messagesTail?: unknown;
 };
 export interface PrepareSessionChatTailUpdateInput {
     key: string;

package/dist/cli-adapter-types.d.ts

@@ -4,13 +4,40 @@
  * Contract implemented by all CLI adapters (ProviderCliAdapter etc).
  */
 import type { ChatMessage } from './types.js';
+import type { InteractivePrompt, InteractivePromptResponse } from './providers/types/interactive-prompt.js';
 export interface CliAdapterStatus {
     status?: string;
+    parsedStatus?: string;
     messages?: ChatMessage[];
     activeModal?: {
         message: string;
         buttons: string[];
+        /**
+         * Semantic modal class, when the adapter knows it (spec/FSM path):
+         * 'approval' = tool/command/trust consent (auto-approve may fire);
+         * 'picker' = a selection menu the user opened (/model, /mode — must NOT
+         * be auto-answered); 'confirm' = a yes/no left to the user. Absent/null
+         * for adapters that don't classify modals — the auto-approve gate then
+         * falls back to its structural heuristic.
+         */
+        kind?: 'approval' | 'picker' | 'confirm' | null;
     } | null;
+    activeInteractivePrompt?: InteractivePrompt | null;
+    providerSessionId?: string;
+    errorMessage?: string;
+    errorReason?: string;
+    /**
+     * FSM-spec adapters only: true once the driver has observed its first
+     * non-initial idle state (the prompt is genuinely drawn — see
+     * FsmDriver.maybeMarkReady / readySeenOnce). Used by CliProviderInstance to
+     * re-arm the queue-claim `agent:ready` event on the first genuine ready,
+     * independent of the boot-time starting→idle one-shot. That one-shot is
+     * consumed too early for providers whose INITIAL FSM state already reports
+     * status 'idle' (e.g. antigravity-cli), so without this re-arm the worker
+     * never claims its queued task and the coordinator relaunch-loops. Absent
+     * (undefined) for non-FSM adapters — they keep the boot one-shot behavior.
+     */
+    fsmReadySeen?: boolean;
 }
 export interface AcpAdapterHandle {
     onEvent(event: string, data?: unknown): void;
@@ -28,14 +55,42 @@ export interface AcpAdapterHandle {
     setConfigOption?(configId: string, value: string): Promise<void>;
     resolvePermission?(approved: boolean): Promise<void>;
 }
+/**
+ * Launch metadata for a CLI session, surfaced by the dashboard Session info panel.
+ * Derived from the live adapter's spawn plan — the resolved binary, the full
+ * argument vector (provider base args + per-launch extra args), the cwd, and the
+ * set of per-launch extra-env KEYS (values are intentionally omitted so secrets in
+ * extraEnv are never sent to the dashboard). providerSessionId is the upstream
+ * agent's own session id once the CLI reports it.
+ */
+export interface CliLaunchInfo {
+    /** Resolved executable path the PTY actually spawns. */
+    command?: string;
+    /** Full argument vector (provider spawn.args + extraArgs, {{workingDir}} expanded). */
+    args: string[];
+    /** Per-launch extra args only (subset of args), for attribution. */
+    extraArgs: string[];
+    /** Working directory the session was spawned in. */
+    cwd: string;
+    /** KEYS of per-launch extra env (values omitted — may contain secrets). */
+    extraEnvKeys: string[];
+    /** Upstream agent session id, once the CLI reports one. */
+    providerSessionId?: string;
+}
 export interface CliAdapter {
     cliType: string;
     cliName: string;
     workingDir: string;
     _acpInstance?: AcpAdapterHandle;
     spawn(): Promise<void>;
-    sendMessage(text: string): Promise<void>;
-    getStatus(): CliAdapterStatus;
+    sendMessage(text: string, options?: {
+        force?: boolean;
+        meshTaskId?: string;
+    }): Promise<void>;
+    forceSendMessage?(text: string, meshTaskId?: string): Promise<void>;
+    getStatus(options?: {
+        allowParse?: boolean;
+    }): CliAdapterStatus;
     getScriptParsedStatus?(): unknown;
     getDebugSnapshot?(): unknown;
     invokeScript?(scriptName: string, args?: Record<string, unknown>): Promise<unknown>;
@@ -52,8 +107,19 @@ export interface CliAdapter {
     setServerConn?(serverConn: unknown): void;
     clearHistory?(): void;
     resolveAction?(data: unknown): Promise<void>;
+    setInteractivePromptResponse?(response: InteractivePromptResponse): Promise<void>;
     resolveModal?(buttonIndex: number): void;
+    isApprovalRecentlyResolved?(): boolean;
     setOnPtyData?(callback: (data: string) => void): void;
     writeRaw?(data: string): void;
     resize?(cols: number, rows: number): void;
+    getLaunchInfo?(): CliLaunchInfo;
+    getRuntimeMetadata?(): unknown;
+    updateRuntimeMeta?(meta: Record<string, unknown>): void;
+    refreshProviderDefinition?(provider: unknown): void;
+}
+export interface CliAdapterStatusOptional {
+    providerSessionId?: string;
+    errorMessage?: string;
+    errorReason?: string;
 }

package/dist/cli-adapters/cli-script-runner.d.ts

@@ -0,0 +1,117 @@
+/**
+ * CliScriptRunner — isolated execution of provider CLI scripts
+ *
+ * Responsible solely for invoking provider-supplied JavaScript functions
+ * (detectStatus, parseApproval, parseSession, etc.) and managing the
+ * per-session script state created by createState().
+ *
+ * The runner is stateless with respect to PTY / buffer content — all
+ * input data is passed explicitly by the caller so that the adapter can
+ * remain a pure transport layer without embedding parsing logic.
+ */
+import { type CliApprovalInput, type CliScripts, type CliScriptInput, type CliScreenSnapshot, type CliStatusInput, type ParsedSession } from './provider-cli-shared.js';
+/**
+ * One entry per script invocation, kept in a ring buffer so debug
+ * tooling can answer "what did the script see, and what did it return?"
+ * without having to re-run the daemon with custom logs. This is the
+ * trace that would have answered the codex-cli #102 regression in one
+ * pass instead of a dozen guesses.
+ *
+ * Body fields are bounded: input is reduced to a small summary (sizes
+ * + a salted hash + the first few normalized chars of screenText), and
+ * result is JSON-serialized then capped. Full PTY frames are NOT
+ * captured here — they live in CliBufferSnapshot and are exposed by
+ * the chat debug bundle separately.
+ */
+export interface CliScriptInvocationTrace {
+    at: number;
+    scriptName: string;
+    arity: number;
+    inputSummary: {
+        screenTextLen: number;
+        rawBufferLen: number;
+        tailLen: number;
+        isWaitingForResponse?: boolean;
+        screenTextHead?: string;
+    };
+    ok: boolean;
+    elapsedUs: number;
+    resultSummary?: string;
+    error?: string;
+    /**
+     * True when the invocation's elapsed time exceeded the runner's
+     * `scriptCallBudgetMs`. The script is NOT aborted (Node CJS can't
+     * interrupt sync code without a worker thread) — this flag plus the
+     * trace ring lets an operator identify which provider is hanging the
+     * settle loop. A throttled WARN is emitted alongside.
+     */
+    timedOut?: boolean;
+}
+export declare class CliScriptRunner {
+    private scripts;
+    private scriptState;
+    private _parseErrorMessage;
+    private readonly cliType;
+    private sdk;
+    private invocationTrace;
+    /** Per-invocation wall-clock budget (ms). Configurable via setScriptCallBudget. */
+    private scriptCallBudgetMs;
+    /** Last WARN emit time per scriptName, used to throttle repeated budget violations. */
+    private lastBudgetWarnAt;
+    constructor(cliType: string);
+    /** Returns the most-recent script invocation traces (oldest → newest). */
+    getInvocationTrace(): CliScriptInvocationTrace[];
+    /** Clear the trace ring — used by tests and after PTY reset. */
+    clearInvocationTrace(): void;
+    /**
+     * Configure the wall-clock budget (ms) applied to every script invocation.
+     *
+     * Out-of-range or non-finite values are clamped to [1, 5000] and the
+     * default (50ms) is used as a fallback. The budget is enforced per-call,
+     * not aggregated — it does not abort a runaway script (Node CJS cannot
+     * interrupt synchronous code without a worker thread). Instead, an
+     * exceeded budget flags the trace entry with `timedOut: true` and emits
+     * a throttled WARN naming the script and elapsed time so an operator
+     * can identify which provider is hanging the settle loop.
+     */
+    setScriptCallBudget(ms: number): void;
+    /** Test/debug accessor — current effective budget in ms. */
+    getScriptCallBudgetMs(): number;
+    private recordTrace;
+    setScripts(scripts: CliScripts, providerTui?: Record<string, unknown> | undefined): void;
+    private buildSdk;
+    /** Reset per-session state — called when the PTY process exits. */
+    resetSessionState(): void;
+    /** Returns the live scripts object. Direct property assignment on this object
+     *  patches individual scripts without replacing others (used in tests). */
+    get cliScripts(): CliScripts;
+    hasDetectStatus(): boolean;
+    hasParseSession(): boolean;
+    getScriptNames(): string[];
+    get parseErrorMessage(): string | null;
+    clearParseError(): void;
+    detectStatus(input: CliStatusInput): string | null;
+    parseApproval(input: CliApprovalInput): {
+        message: string;
+        buttons: string[];
+    } | null;
+    parseSession(input: CliScriptInput & {
+        tail?: string;
+        tailScreen?: CliScreenSnapshot;
+    }): ParsedSession | null;
+    /**
+     * Invoke an arbitrary named script (e.g. setModel, openModelPicker).
+     * Throws if the script is not available.
+     */
+    invokeByName(name: string, input: any): any;
+    private invoke;
+    /**
+     * Returns true when `elapsedUs` exceeded the configured budget. On the
+     * first violation per script (or after the throttle window expires) we
+     * emit a single WARN so the operator learns which provider is slow.
+     *
+     * We deliberately throttle per-scriptName so a chronically-slow
+     * detectStatus doesn't spam the log on every PTY frame settle.
+     */
+    private checkBudget;
+}