@adhdev/daemon-core 0.9.82-rc.490 → 0.9.82-rc.492

package/dist/providers/cli-provider-instance.d.ts

@@ -114,6 +114,28 @@ export declare class CliProviderInstance implements ProviderInstance {
      * the nudge was NOT deferred) and leaked to the coordinator.
      */
     private static readonly AUTO_APPROVE_MASK_STALL_MS;
+    /**
+     * FALSE-IDLE (inter-approval quiet valley): grace window after an auto-approve
+     * (or mesh_approve) RESOLVES a modal during which a subsequent generating→idle
+     * quiet valley must NOT be treated as turn completion.
+     *
+     * The RCA: auto-approve resolves a modal → the agent resumes the same turn →
+     * between resolving that approval and preparing the next tool/approval the agent
+     * falls briefly silent. The FSM sees idle + a recorded mid-turn assistant bubble
+     * and fires an early agent:generating_completed even though the turn is still in
+     * flight. Live evidence showed the same session resuming waiting_approval ~13s
+     * after a "clean" completion emit.
+     *
+     * The window must be comfortably larger than the observed resume gap (~13s) so
+     * the valley is bridged, but not so large that a turn that genuinely ended right
+     * after an approval is held for an annoying stretch. 18s clears 13s with margin
+     * while capping the worst-case extra hold on a truly-finished turn at 18s (still
+     * well under COMPLETED_FINALIZATION_MAX_WAIT_MS's 30s hard bound). The recency is
+     * measured from the engine's lastApprovalResolvedAt, which is stamped ONLY by
+     * resolveModal (auto-approve fire / dashboard / mesh_approve) — so a plain turn
+     * with no approval never carries recency and is never held (no regression).
+     */
+    private static readonly APPROVAL_RESUME_GRACE_MS;
     private adapter;
     private context;
     private events;
@@ -395,6 +417,19 @@ export declare class CliProviderInstance implements ProviderInstance {
      */
     private approvableModalSignature;
     private isAutonomousMeshSession;
+    /**
+     * FALSE-IDLE: are we inside the post-approval resume grace window? True when this
+     * is an autonomous auto-approving mesh session AND the engine resolved a modal
+     * (auto-approve / mesh_approve) within APPROVAL_RESUME_GRACE_MS. This is the single
+     * "auto-approve recency" judgment shared by Fix 1 (the SETTLE-VALLEY completion
+     * hold below) and Fix 2 (the FSM-level applyIdle hysteresis in cli-state-engine).
+     *
+     * Scoped to autonomous auto-approving sessions so a foreground/attended session,
+     * or a session with auto-approve off (whose approvals a human answers), is never
+     * held. The recency clock (adapter.lastApprovalResolvedAt) is 0 until the first
+     * resolveModal, so a plain turn that never saw an approval always returns false.
+     */
+    private inApprovalResumeGrace;
     /**
      * ARCH-REFACTOR R1: the taskId to attribute the CURRENTLY-completing turn to.
      * Prefers the per-turn binding (engine.currentTurnTaskId, set when the turn was

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.490",
+  "version": "0.9.82-rc.492",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.490",
-    "@adhdev/session-host-core": "0.9.82-rc.490",
+    "@adhdev/mesh-shared": "0.9.82-rc.492",
+    "@adhdev/session-host-core": "0.9.82-rc.492",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/cli-adapters/cli-state-engine.ts

@@ -66,6 +66,16 @@ export interface CliStateEngineCallbacks {
     onStatusChange(): void;
     onApplyParsedSession(session: ParsedSession): void;
     onTurnCompleted(): void;
+    /**
+     * FALSE-IDLE (Fix 2): true when the owning session is inside the post-approval
+     * resume grace — an autonomous auto-approving mesh session that resolved a modal
+     * within the resume-grace window. The engine cannot decide this on its own (it has
+     * no mesh/auto-approve awareness); the instance answers using the SAME
+     * `inApprovalResumeGrace` judgment Fix 1 uses, so the two fixes stay in lockstep.
+     * Optional: absent ⇒ treated as false (no hysteresis) so any non-instance embedder
+     * keeps the pre-fix behavior.
+     */
+    isInApprovalResumeGrace?(): boolean;
 }
 
 interface IdleFinishCandidate {
@@ -94,6 +104,13 @@ const FINISH_RETRY_DELAY_MS = 300;
 const MAX_TRACE_ENTRIES = 250;
 const APPROVAL_EXIT_TIMEOUT_MS = 60_000;
 const IDLE_CONFIRMATION_GRACE_MS = 2_000;
+// FALSE-IDLE (Fix 2): hard upper bound on how long applyIdle may keep deferring
+// finishResponse inside the post-approval resume grace. Mirrors the instance-side
+// APPROVAL_RESUME_GRACE_MS (18s) — kept as a local constant since the engine has no
+// access to the instance's static. If the turn truly ended right after an approval
+// and stays silent this long, we stop suppressing and let the normal idle-finish run,
+// so a genuinely-finished turn can never be held past this bound (no infinite defer).
+const APPROVAL_RESUME_IDLE_DEFER_CAP_MS = 18_000;
 
 // ─── Engine ────────────────────────────────────────────────────────────────
 
@@ -185,6 +202,13 @@ export class CliStateEngine {
     // ── Idle candidate ───────────────────────────────
     private idleFinishCandidate: IdleFinishCandidate | null = null;
 
+    // FALSE-IDLE (Fix 2): wall-clock when the current post-approval resume-grace idle
+    // defer began, scoped to a responseEpoch. Zero when not deferring. Bounds the defer
+    // to APPROVAL_RESUME_IDLE_DEFER_CAP_MS so a turn that genuinely ended right after an
+    // approval eventually finishes. Reset whenever a new turn/response starts or completes.
+    private approvalResumeDeferSince = 0;
+    private approvalResumeDeferEpoch = -1;
+
     // ── Idle confirmation grace ──────────────────────
     /**
      * `finishResponse` produces the `generating → idle` transition that
@@ -450,6 +474,8 @@ export class CliStateEngine {
         this.activeModal = null;
         this.pendingScriptStatus = null;
         this.pendingScriptStatusSince = 0;
+        this.approvalResumeDeferSince = 0;
+        this.approvalResumeDeferEpoch = -1;
     }
 
     clearIdleFinishCandidate(reason: string): void {
@@ -959,6 +985,28 @@ export class CliStateEngine {
             && assistantLength >= candidate.assistantLength
             && (now - candidate.armedAt) >= idleFinishConfirmMs;
 
+        // FALSE-IDLE (Fix 2) FSM-level hysteresis: an autonomous auto-approving mesh
+        // worker that just auto-resolved an approval resumes the same turn and falls
+        // briefly silent (the inter-approval quiet valley) before the next tool/approval.
+        // resetActiveTurnState tearing the turn down in that valley is the root cause the
+        // downstream Fix 1 / hasAdapterPendingResponse gates then inherit as "turn closed".
+        // Suppress the idle declaration here — at the FSM level — while inside the
+        // post-approval resume grace, so the turn scope is NOT torn down mid-flight.
+        // Bounded by APPROVAL_RESUME_IDLE_DEFER_CAP_MS: if the turn genuinely ended right
+        // after an approval and stays silent past the cap, we stop deferring and let the
+        // normal idle-finish run. Re-arm the idle timeout so we re-evaluate after the
+        // quiet grows (either the worker resumes → this path releases, or the cap lapses
+        // → finish). Scoped through the instance callback so a plain/interactive turn with
+        // no autonomous auto-approve is never affected.
+        if (this.shouldDeferIdleForApprovalResume(now)) {
+            this.clearIdleFinishCandidate('approval_resume_grace_defer');
+            if (this.idleTimeout) clearTimeout(this.idleTimeout);
+            this.idleTimeout = setTimeout(() => {
+                if (this.isWaitingForResponse) this.evaluateSettled(this.transport.getSnapshot());
+            }, this.timeouts.idleFinish);
+            return;
+        }
+
         if (idleReady && candidateQuiet) {
             this.clearIdleFinishCandidate('finish_response');
             if (this.idleTimeout) clearTimeout(this.idleTimeout);
@@ -975,6 +1023,12 @@ export class CliStateEngine {
         if (this.idleTimeout) clearTimeout(this.idleTimeout);
         this.idleTimeout = setTimeout(() => {
             if (this.isWaitingForResponse && !this.hasActionableApproval()) {
+                if (this.shouldDeferIdleForApprovalResume(Date.now())) {
+                    this.idleTimeout = setTimeout(() => {
+                        if (this.isWaitingForResponse) this.evaluateSettled(this.transport.getSnapshot());
+                    }, this.timeouts.idleFinish);
+                    return;
+                }
                 if (this.shouldDeferIdleTimeoutFinish()) return;
                 const parsed = this.runParseSession(this.transport.getSnapshot());
                 if (this.shouldDeferFinishForTranscript(parsed)) {
@@ -987,6 +1041,49 @@ export class CliStateEngine {
         }, this.timeouts.idleFinish);
     }
 
+    /**
+     * FALSE-IDLE (Fix 2): should applyIdle suppress the idle/finish for the current
+     * turn because we are inside the post-approval resume grace?
+     *
+     * True only when: (a) the owning instance reports it is an autonomous auto-approving
+     * mesh session that resolved a modal within the resume-grace window
+     * (isInApprovalResumeGrace callback — the SAME judgment Fix 1 uses), AND (b) the defer
+     * for THIS response epoch has not yet exceeded APPROVAL_RESUME_IDLE_DEFER_CAP_MS.
+     * The cap guarantees no infinite defer: a turn that genuinely ended right after an
+     * approval and stays silent past the cap stops being suppressed and finishes normally.
+     * The per-epoch anchor means a fresh turn/response restarts the clock.
+     */
+    private shouldDeferIdleForApprovalResume(now: number): boolean {
+        if (typeof this.callbacks.isInApprovalResumeGrace !== 'function') { this.clearApprovalResumeDefer(); return false; }
+        let inGrace = false;
+        try { inGrace = this.callbacks.isInApprovalResumeGrace() === true; } catch { inGrace = false; }
+        // Probe says the session is no longer in the post-approval resume grace — reset the
+        // cap clock so a LATER approval-resume valley in this same response starts fresh.
+        if (!inGrace) { this.clearApprovalResumeDefer(); return false; }
+        if (this.approvalResumeDeferEpoch !== this.responseEpoch || this.approvalResumeDeferSince === 0) {
+            // First defer for this response — start the cap clock. Note: the clock is only
+            // reset by clearApprovalResumeDefer (probe false, turn teardown), NOT by a
+            // cap-release below — so once the cap trips it STAYS released for the whole
+            // grace episode (no arm/clear cycle can restart the 18s and defer forever).
+            this.approvalResumeDeferEpoch = this.responseEpoch;
+            this.approvalResumeDeferSince = now;
+            return true;
+        }
+        if ((now - this.approvalResumeDeferSince) >= APPROVAL_RESUME_IDLE_DEFER_CAP_MS) {
+            // Cap reached: stop suppressing so the normal idle-finish can run. Deliberately
+            // does NOT clear the clock — leaving deferSince set keeps this branch returning
+            // false on every subsequent call until the probe drops (clearApprovalResumeDefer)
+            // or the turn ends (resetActiveTurnState), preventing an infinite re-defer.
+            return false;
+        }
+        return true;
+    }
+
+    private clearApprovalResumeDefer(): void {
+        this.approvalResumeDeferSince = 0;
+        this.approvalResumeDeferEpoch = -1;
+    }
+
     finishResponse(): void {
         if (this.submitPendingUntil > Date.now()) return;
         if (this.responseSettleIgnoreUntil > Date.now()) return;

package/src/cli-adapters/provider-cli-adapter.ts

@@ -169,6 +169,9 @@ export class ProviderCliAdapter implements CliAdapter {
     private ptyProcess: PtyRuntimeTransport | null = null;
     private transportFactory: PtyTransportFactory;
     private onStatusChange: (() => void) | null = null;
+    // FALSE-IDLE (Fix 2): probe the owning instance for the post-approval resume grace.
+    // Null until the instance registers it; the engine treats absence as "not in grace".
+    private inApprovalResumeGraceProbe: (() => boolean) | null = null;
 
     // ─── State machine engine ─────────────────────────
     readonly engine: CliStateEngine;
@@ -477,6 +480,7 @@ export class ProviderCliAdapter implements CliAdapter {
                 onStatusChange: () => { this.onStatusChange?.(); },
                 onApplyParsedSession: (session) => { this.applyParsedSessionMetadata(session); },
                 onTurnCompleted: () => { this.responseBuffer = ''; },
+                isInApprovalResumeGrace: () => this.inApprovalResumeGraceProbe?.() === true,
             } satisfies CliStateEngineCallbacks,
             resolvedConfig.timeouts,
         );
@@ -549,6 +553,13 @@ export class ProviderCliAdapter implements CliAdapter {
         this.onStatusChange = callback;
     }
 
+    // FALSE-IDLE (Fix 2): the instance registers its inApprovalResumeGrace judgment so the
+    // engine's applyIdle hysteresis can scope itself to autonomous auto-approving sessions
+    // without the engine needing any mesh/auto-approve awareness of its own.
+    setInApprovalResumeGraceProbe(probe: () => boolean): void {
+        this.inApprovalResumeGraceProbe = probe;
+    }
+
     setOnPtyData(callback: (data: string) => void): void {
         this.onPtyDataCallback = callback;
     }

package/src/commands/med-family/mesh-crud.ts

@@ -537,7 +537,7 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
         const ownerFailure = await ctx.requireMeshHostMutationOwner(meshId, args?.inlineMesh, 'node update');
         if (ownerFailure) return ownerFailure;
         try {
-            const { updateNode } = await import('../../config/mesh-config.js');
+            const { updateNode, normalizeCapabilityTags } = await import('../../config/mesh-config.js');
             const policy = args?.policy && typeof args.policy === 'object' && !Array.isArray(args.policy)
                 ? { ...(args.policy as Record<string, unknown>) }
                 : {};
@@ -579,13 +579,54 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
                     .filter(Boolean);
             }
             const node = updateNode(meshId, nodeId, patch as any);
-            if (!node) return { success: false, error: 'Mesh node not found' };
-            // Provider priority / systemPrompt changes don't touch
-            // the queue revision, so without a manual bust the
-            // cached aggregate keeps surfacing pre-update values
-            // (priority chip, coordinator prompt preview, etc.).
-            ctx.invalidateAggregateMeshStatus(meshId);
-            return { success: true, node };
+            if (node) {
+                // Provider priority / systemPrompt changes don't touch
+                // the queue revision, so without a manual bust the
+                // cached aggregate keeps surfacing pre-update values
+                // (priority chip, coordinator prompt preview, etc.).
+                ctx.invalidateAggregateMeshStatus(meshId);
+                return { success: true, node };
+            }
+            // NODE-SLOTS-REMOTE-WRITE: updateNode reads ONLY this daemon's local
+            // meshes.json. When update_mesh_node is forwarded to a node's home-daemon
+            // that has no local config entry for a coordinator-owned mesh (a remote
+            // member daemon, or a cloud coordinator that holds the mesh solely in its
+            // inline cache), updateNode returns undefined and the write failed with
+            // "Mesh node not found" — even though the coordinator attached the mesh
+            // snapshot as inlineMesh and the read paths (get_mesh / dry-run / list)
+            // resolve it fine via getMeshForCommand's inline fallback. Mirror those
+            // read paths here: resolve the mesh from the inline cache and apply the
+            // same field semantics as updateNode, persisting to the inline cache.
+            const meshRecord = await ctx.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+            const mesh = meshRecord?.mesh;
+            if (!mesh) return { success: false, error: 'Mesh not found' };
+            const inlineNode = Array.isArray(mesh.nodes)
+                ? mesh.nodes.find((n: any) => meshNodeIdMatches(n, nodeId))
+                : undefined;
+            if (!inlineNode) return { success: false, error: 'Mesh node not found' };
+            // Apply the SAME field semantics updateNode uses so the inline write and a
+            // local-config write are indistinguishable: shallow-merge policy, honor an
+            // explicit systemPrompt clear, replace/normalize capability tags.
+            inlineNode.policy = {
+                ...(inlineNode.policy && typeof inlineNode.policy === 'object' && !Array.isArray(inlineNode.policy)
+                    ? inlineNode.policy as Record<string, unknown>
+                    : {}),
+                ...(patch.policy as Record<string, unknown>),
+            };
+            if (Object.prototype.hasOwnProperty.call(patch, 'systemPrompt')) {
+                const sp = (patch as any).systemPrompt;
+                if (typeof sp === 'string' && sp.trim()) inlineNode.systemPrompt = sp;
+                else delete inlineNode.systemPrompt;
+            }
+            if (Object.prototype.hasOwnProperty.call(patch, 'capabilities')) {
+                const tags = normalizeCapabilityTags((patch as any).capabilities);
+                if (tags && tags.length) inlineNode.capabilities = tags;
+                else delete inlineNode.capabilities;
+            }
+            // updateInlineMeshNode canonicalizes node identity, persists the mutated
+            // mesh back to the inline cache, and busts the aggregate-status cache.
+            ctx.updateInlineMeshNode(meshId, mesh, inlineNode);
+            return { success: true, node: inlineNode };
         } catch (e: any) {
             return { success: false, error: e.message };
         }

package/src/config/mesh-config.ts

@@ -104,7 +104,7 @@ function stripDeadRoleFromProviderRoles(policy: unknown): boolean {
     return changed;
 }
 
-function normalizeCapabilityTags(value: unknown): string[] | undefined {
+export function normalizeCapabilityTags(value: unknown): string[] | undefined {
     if (!Array.isArray(value)) return undefined;
     const seen = new Set<string>();
     const tags = value

package/src/providers/cli-provider-instance.ts

@@ -193,6 +193,29 @@ export class CliProviderInstance implements ProviderInstance {
      */
     private static readonly AUTO_APPROVE_MASK_STALL_MS = 10500;
 
+    /**
+     * FALSE-IDLE (inter-approval quiet valley): grace window after an auto-approve
+     * (or mesh_approve) RESOLVES a modal during which a subsequent generating→idle
+     * quiet valley must NOT be treated as turn completion.
+     *
+     * The RCA: auto-approve resolves a modal → the agent resumes the same turn →
+     * between resolving that approval and preparing the next tool/approval the agent
+     * falls briefly silent. The FSM sees idle + a recorded mid-turn assistant bubble
+     * and fires an early agent:generating_completed even though the turn is still in
+     * flight. Live evidence showed the same session resuming waiting_approval ~13s
+     * after a "clean" completion emit.
+     *
+     * The window must be comfortably larger than the observed resume gap (~13s) so
+     * the valley is bridged, but not so large that a turn that genuinely ended right
+     * after an approval is held for an annoying stretch. 18s clears 13s with margin
+     * while capping the worst-case extra hold on a truly-finished turn at 18s (still
+     * well under COMPLETED_FINALIZATION_MAX_WAIT_MS's 30s hard bound). The recency is
+     * measured from the engine's lastApprovalResolvedAt, which is stamped ONLY by
+     * resolveModal (auto-approve fire / dashboard / mesh_approve) — so a plain turn
+     * with no approval never carries recency and is never held (no regression).
+     */
+    private static readonly APPROVAL_RESUME_GRACE_MS = 18_000;
+
     private adapter: ProviderCliAdapter;
     private context: InstanceContext | null = null;
     private events: ProviderEvent[] = [];
@@ -400,6 +423,12 @@ export class CliProviderInstance implements ProviderInstance {
             this.detectStatusTransition();
         });
 
+ // FALSE-IDLE (Fix 2): let the engine's applyIdle hysteresis consult THIS instance's
+ // auto-approve/mesh-scoped resume-grace judgment (the same one Fix 1 uses).
+        if (typeof this.adapter.setInApprovalResumeGraceProbe === 'function') {
+            this.adapter.setInApprovalResumeGraceProbe(() => this.inApprovalResumeGrace());
+        }
+
  // PTY spawn
         await this.adapter.spawn();
         await this.enforceFreshSessionLaunchIfNeeded();
@@ -1630,6 +1659,26 @@ export class CliProviderInstance implements ProviderInstance {
         if (adapterAny?.currentTurnScope) return { reason: 'adapter_turn_scope_active', terminal: !approvalResolvedIdle };
         if (this.hasAdapterPendingResponse()) return { reason: 'adapter_pending_response', terminal: !approvalResolvedIdle };
 
+        // (FALSE-IDLE, Fix 1) SETTLE-VALLEY hold extension for the generating→idle valley.
+        // The existing SETTLE-VALLEY hold below only covers previousStatus==='waiting_approval'.
+        // But when auto-approve RESOLVES a modal the engine flips straight to 'generating'
+        // (resolveModal → setStatus('generating')), so the resumed turn's brief inter-approval
+        // quiet valley arrives with previousStatus==='generating' and a recorded mid-turn
+        // assistant bubble — which satisfies every gate below and fires an early completion
+        // mid-turn (RCA: same session re-enters waiting_approval ~13s later). Here we HOLD:
+        // by this point the adapter's own pending-response evidence (above) is clean — the
+        // engine has torn down currentTurnScope/isWaitingForResponse in the valley — so we
+        // rely on the approval-resume recency signal instead. Non-terminal, so the retry loop
+        // re-runs the resume guard (busy_reentry / new_pty_output / resumed_status in the
+        // flush) and cancels the moment the turn actually resumes; and it clears on its own
+        // once the grace window lapses (a turn that genuinely ended right after an approval
+        // then emits normally). Bounded by COMPLETED_FINALIZATION_MAX_WAIT_MS as a hard floor
+        // against a wedge. Scoped by inApprovalResumeGrace to autonomous auto-approving mesh
+        // sessions with a recent resolveModal, so a plain non-approval turn is untouched.
+        if (!approvalResolvedIdle && this.inApprovalResumeGrace()) {
+            return { reason: 'approval_resume_grace', terminal: false };
+        }
+
         const partial = typeof this.adapter.getPartialResponse === 'function'
             ? this.adapter.getPartialResponse()
             : '';
@@ -1837,6 +1886,27 @@ export class CliProviderInstance implements ProviderInstance {
         return this.isMeshWorkerSession() || !!this.settings.meshCoordinatorFor;
     }
 
+    /**
+     * FALSE-IDLE: are we inside the post-approval resume grace window? True when this
+     * is an autonomous auto-approving mesh session AND the engine resolved a modal
+     * (auto-approve / mesh_approve) within APPROVAL_RESUME_GRACE_MS. This is the single
+     * "auto-approve recency" judgment shared by Fix 1 (the SETTLE-VALLEY completion
+     * hold below) and Fix 2 (the FSM-level applyIdle hysteresis in cli-state-engine).
+     *
+     * Scoped to autonomous auto-approving sessions so a foreground/attended session,
+     * or a session with auto-approve off (whose approvals a human answers), is never
+     * held. The recency clock (adapter.lastApprovalResolvedAt) is 0 until the first
+     * resolveModal, so a plain turn that never saw an approval always returns false.
+     */
+    private inApprovalResumeGrace(now = Date.now()): boolean {
+        if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return false;
+        const resolvedAt = typeof (this.adapter as any)?.lastApprovalResolvedAt === 'number'
+            ? (this.adapter as any).lastApprovalResolvedAt as number
+            : 0;
+        if (resolvedAt <= 0) return false;
+        return (now - resolvedAt) < CliProviderInstance.APPROVAL_RESUME_GRACE_MS;
+    }
+
     /**
      * ARCH-REFACTOR R1: the taskId to attribute the CURRENTLY-completing turn to.
      * Prefers the per-turn binding (engine.currentTurnTaskId, set when the turn was
@@ -2308,8 +2378,31 @@ export class CliProviderInstance implements ProviderInstance {
         // Mirrors the SDK v1 detect-status approval heuristic (detect-status.ts).
         const modalKind = typeof modal?.kind === 'string' ? modal.kind : 'approval';
         if (modalKind !== 'approval') {
-            // Picker/confirm — leave it for the user; keep the modal surfaced.
-            return autoApproveActive;
+            // Defense-in-depth (APPROVAL-PICKER-MISROUTE): a genuine tool-consent
+            // modal ("Do you want to proceed?" + 1. Yes / 3. No) can be MIS-routed
+            // to modal_kind='picker' by the spec FSM when a picker matcher wins the
+            // priority tie in the wrong state. The spec-level negative guard (Fix A)
+            // is the root fix, but a stale/undeployed spec would leave the worker
+            // wedged on a modal it could safely have approved. So don't bail on the
+            // kind label alone: only bail when this modal is ALSO a genuine SELECTION
+            // picker (/model, /mode — "Select a model/mode/option" / "Switch
+            // between") with NO consent structure. A modal that carries approval
+            // text or a decline/grant anchor is treated as an approval and falls
+            // through to the structural gate below, even under kind='picker'.
+            const modalText = `${String(modal?.title || '')}\n${String(modal?.message || '')}\n${buttons.join('\n')}`;
+            const looksLikeSelectionPicker = /Select (?:a |an )?(?:model|mode|option)\b|Switch between/i.test(modalText);
+            const looksLikeConsent = looksLikeActiveApprovalPromptText(modalText)
+                || /Do you want to (?:proceed|create|make|edit|apply|run|delete|modify|allow)\b|allow all edits\b|don'?t ask again\b/i.test(modalText)
+                || hasNegativeApprovalOption(buttons)
+                || hasReliableApprovalAffirmative(buttons);
+            if (looksLikeSelectionPicker && !looksLikeConsent) {
+                // Genuine /model or /mode selection picker — no safe default to
+                // auto-pick. Leave it for the user; keep the modal surfaced.
+                return autoApproveActive;
+            }
+            // Otherwise: mis-routed consent modal (or an ambiguous picker that still
+            // carries consent structure) — fall through to the structural approval
+            // gate below, which only fires on a real affirmative+decline/grant set.
         }
         const { index: buttonIndex, label: buttonLabel } = pickApprovalButton(buttons, this.provider);
         // Structural decline anchor. A real approval offers BOTH an affirmative