@adhdev/daemon-core 0.9.82-rc.510 → 0.9.82-rc.511

package/dist/mesh/mesh-event-forwarding.d.ts

@@ -1,4 +1,12 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
+export declare function bootstrapQueueTaskCountsAsHandled(task: {
+    status: string;
+    targetNodeId?: string | null;
+    autoLaunch?: {
+        status: string;
+        updatedAt: string;
+    } | null;
+}, bootstrapNodeId: string, nowMs: number): boolean;
 export declare function recoverMeshIdByCoordinatorAndNode(coordinatorDaemonId: string, nodeId: string): string;
 export declare function resolveForwardEventMeshId(components: DaemonComponents, payload: Record<string, unknown>): string;
 export declare function __resetMeshWorkspaceCacheForTests(): void;

package/dist/mesh/mesh-idle-reminder.d.ts

@@ -19,10 +19,12 @@
  * Design invariants:
  *  - Only fires when the mesh has ≥1 `active` mission AND is fully idle. Fully idle =
  *    buildMeshActiveWork over queue + direct dispatches reports totalActiveCount === 0
- *    && generatingCount === 0. We intentionally do NOT probe remote node sessions here
- *    (expensive per-tick RPC): any non-terminal queue/direct work already makes
- *    totalActiveCount > 0, so the idle check is conservative — it suppresses the
- *    reminder whenever any work is outstanding, which is the safe direction.
+ *    && generatingCount === 0 AND no async refine job is accepted/running. We intentionally
+ *    do NOT probe remote node sessions here (expensive per-tick RPC): any non-terminal
+ *    queue/direct work already makes totalActiveCount > 0, so the idle check is
+ *    conservative — it suppresses the reminder whenever any work is outstanding, which is
+ *    the safe direction. Async refine jobs (`mesh_refine_node`) are a separate class that
+ *    buildMeshActiveWork does not count, so they are checked explicitly from the ledger.
  *  - NEVER transitions a mission's status. It only surfaces a hint; the coordinator
  *    decides via mesh_mission_upsert.
  *  - Debounced per mission-set. Re-fires only when the debounce window has elapsed OR

package/dist/mesh/mesh-queue-assignment.d.ts

@@ -3,6 +3,7 @@ import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
 export declare function __resetIdleAutoFastForwardForTests(): void;
 export declare function getMeshWithCache(components: DaemonComponents, meshId: string): any | undefined;
 export declare function tryAssignQueueTask(components: DaemonComponents, meshId: string, nodeId: string, sessionId: string, providerType: string): boolean;
+export declare const AUTO_LAUNCH_AWAIT_CLAIM_MS = 90000;
 interface AwaitClaimBackoffState {
     cycles: number;
     nextAttemptAtMs: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.510",
+  "version": "0.9.82-rc.511",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.510",
-    "@adhdev/session-host-core": "0.9.82-rc.510",
+    "@adhdev/mesh-shared": "0.9.82-rc.511",
+    "@adhdev/session-host-core": "0.9.82-rc.511",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/git/git-status.ts

@@ -1,3 +1,4 @@
+import { join } from 'node:path';
 import type { DaemonBuildBehind, GitRepoStatus, GitSubmoduleStatus, GitUpstreamFreshness } from './git-types.js';
 import { GIT_STATUS_TIMEOUT_MS, GitCommandError, resolveGitRepository, runGit } from './git-executor.js';
 import { getDaemonBuildInfo, type DaemonBuildInfo } from '../build-info.js';
@@ -444,6 +445,18 @@ export interface ChangedPackageClassification {
   affectedPackages: string[];
 }
 
+/**
+ * Same as {@link ChangedPackageClassification} but also carries the runtime-ambiguous
+ * non-package paths that forced (or would force) a daemon-affecting verdict. Callers
+ * with git access (classifyChangedPackages) inspect these to descend into submodule
+ * gitlinks — a bare submodule path (e.g. `oss`) is runtime-ambiguous from the root's
+ * point of view, but its *content* diff may be entirely web-only.
+ */
+interface ChangedFileListClassification extends ChangedPackageClassification {
+  /** Non-package paths that were not recognized as benign root files. */
+  ambiguousNonPackageFiles: string[];
+}
+
 /**
  * Pure bucketer: classify an already-collected changed-file list into the coarse
  * daemon-vs-web verdict, per the resolved policy. Shared by classifyDaemonBuildChange
@@ -454,21 +467,21 @@ export interface ChangedPackageClassification {
 function classifyChangedFileList(
   files: string[],
   policy: ResolvedChangeImpactPolicy,
-): ChangedPackageClassification {
+): ChangedFileListClassification {
   if (files.length === 0) {
     // No file diff (e.g. only merge metadata) — nothing actionable, but stay
     // conservative and treat as daemon-affecting so we don't suppress a real warning.
-    return { isDaemonAffecting: true, affectedPackages: [] };
+    return { isDaemonAffecting: true, affectedPackages: [], ambiguousNonPackageFiles: [] };
   }
   const pkgs = new Set<string>();
-  // A non-package path that is NOT a recognized benign root file (marker/doc).
+  // Non-package paths that are NOT recognized benign root files (marker/doc).
   // Only these force daemon-affecting; benign markers/docs are ignored so a
   // gitlink-moving root commit over a marker-only oss commit no longer over-warns.
-  let sawRuntimeAmbiguousNonPackage = false;
+  const ambiguousNonPackageFiles: string[] = [];
   for (const file of files) {
     const match = file.match(/(?:^|\/)packages\/([^/]+)\//);
     if (!match) {
-      if (!isNonRuntimeRootFile(file, policy)) sawRuntimeAmbiguousNonPackage = true;
+      if (!isNonRuntimeRootFile(file, policy)) ambiguousNonPackageFiles.push(file);
       continue;
     }
     pkgs.add(match[1]);
@@ -481,9 +494,9 @@ function classifyChangedFileList(
   // file changed) — i.e. nothing runtime-ambiguous remains. Unlisted/new packages
   // therefore stay daemon-affecting (fail-safe default preserved).
   const allBenign =
-    !sawRuntimeAmbiguousNonPackage &&
+    ambiguousNonPackageFiles.length === 0 &&
     affectedPackages.every((p) => policy.webOnlyPackages.has(p) && !policy.daemonRuntimePackages.has(p));
-  return { isDaemonAffecting: !allBenign, affectedPackages };
+  return { isDaemonAffecting: !allBenign, affectedPackages, ambiguousNonPackageFiles };
 }
 
 /**
@@ -542,7 +555,138 @@ export async function classifyChangedPackages(
     .split('\n')
     .map((line) => line.trim())
     .filter(Boolean);
-  return classifyChangedFileList(files, policy);
+  const rootVerdict = classifyChangedFileList(files, policy);
+  return refineVerdictThroughSubmodules(repoPath, fromRef, toRef, options, policy, rootVerdict);
+}
+
+/**
+ * A `.gitmodules`-registered submodule root path (e.g. `oss`) appears in the root diff
+ * as a bare gitlink — no `packages/...` segment — so classifyChangedFileList treats it
+ * as runtime-ambiguous and the root verdict is daemon-affecting. But the submodule's
+ * *content* diff may be entirely web-only (a web-core-only oss commit) — in which case
+ * the daemon genuinely isn't affected and the refine gate should skip daemon-scoped
+ * validation. This descends into each submodule that is the *only* thing blocking a
+ * benign verdict, classifies its own gitlink-range content diff with the SAME policy,
+ * and folds the result back.
+ *
+ * Strictly conservative — a submodule verdict can only ever KEEP the root benign or
+ * flip an otherwise-benign root back to daemon-affecting; it never overrides a root
+ * that was daemon-affecting for its own reasons (a runtime package / unknown package /
+ * a runtime-ambiguous non-submodule file). If ANY blocking non-package path is not a
+ * registered submodule, or any submodule probe fails, we keep the conservative root
+ * verdict (fail-safe: never silence a real warning on uncertainty).
+ */
+async function refineVerdictThroughSubmodules(
+  repoPath: string,
+  fromRef: string,
+  toRef: string,
+  options: GitStatusOptions,
+  policy: ResolvedChangeImpactPolicy,
+  rootVerdict: ChangedFileListClassification,
+): Promise<ChangedPackageClassification> {
+  const strip = ({ isDaemonAffecting, affectedPackages }: ChangedPackageClassification) => ({ isDaemonAffecting, affectedPackages });
+  const ambiguous = rootVerdict.ambiguousNonPackageFiles;
+  // Fast path: nothing to descend into, or the root is daemon-affecting for a reason
+  // other than an ambiguous path (an unknown/daemon package). Submodule descent only
+  // ever addresses the ambiguous-non-package reason, so it cannot help here.
+  if (ambiguous.length === 0) return strip(rootVerdict);
+
+  let submodulePaths: Set<string>;
+  try {
+    submodulePaths = await listSubmodulePaths(repoPath, options);
+  } catch {
+    return strip(rootVerdict); // can't read .gitmodules → stay conservative.
+  }
+  // Every blocking ambiguous path must be a registered submodule for descent to be able
+  // to clear the verdict — otherwise a non-submodule ambiguous file keeps it daemon.
+  if (ambiguous.length === 0 || !ambiguous.every((f) => submodulePaths.has(f))) {
+    return strip(rootVerdict);
+  }
+
+  const submoduleAffectedPackages: string[] = [];
+  for (const subPath of ambiguous) {
+    let range: { from: string; to: string };
+    try {
+      range = await resolveSubmoduleGitlinkRange(repoPath, fromRef, toRef, subPath, options);
+    } catch {
+      return strip(rootVerdict); // couldn't read the gitlink SHAs → conservative.
+    }
+    // A recursive classify inside the submodule reuses the SAME repo config resolution:
+    // the submodule has its own packages/ layout and may carry its own change-impact
+    // config; classifyChangedPackages(subRepo, ...) resolves it there.
+    let subVerdict: ChangedPackageClassification;
+    try {
+      subVerdict = await classifyChangedPackages(join(repoPath, subPath), range.from, range.to, {
+        ...options,
+        // Do not force the root's injected config onto the submodule — let it resolve
+        // its own .adhdev/change-impact.* (or fall back to defaults).
+        changeImpactConfig: undefined,
+      });
+    } catch {
+      return strip(rootVerdict); // submodule diff failed → conservative.
+    }
+    if (subVerdict.isDaemonAffecting) {
+      // The submodule content really does touch daemon runtime → keep daemon-affecting,
+      // surfacing the submodule packages so the reason is visible.
+      return {
+        isDaemonAffecting: true,
+        affectedPackages: [...new Set([...rootVerdict.affectedPackages, ...subVerdict.affectedPackages])].sort(),
+      };
+    }
+    submoduleAffectedPackages.push(...subVerdict.affectedPackages);
+  }
+
+  // Every ambiguous path was a submodule whose content is web-only. The remaining root
+  // packages (if any) must themselves be benign web-only for the whole change to be
+  // benign — reuse the exact same rule by re-checking the root package set.
+  const rootPackagesBenign = rootVerdict.affectedPackages.every(
+    (p) => policy.webOnlyPackages.has(p) && !policy.daemonRuntimePackages.has(p),
+  );
+  return {
+    isDaemonAffecting: !rootPackagesBenign,
+    affectedPackages: [...new Set([...rootVerdict.affectedPackages, ...submoduleAffectedPackages])].sort(),
+  };
+}
+
+/** Registered submodule paths from `.gitmodules` (empty set if none / unreadable). */
+async function listSubmodulePaths(repoPath: string, options: GitStatusOptions): Promise<Set<string>> {
+  // `git config -f .gitmodules --get-regexp path` lists `submodule.<name>.path <path>`.
+  const res = await runGit(repoPath, ['config', '-f', '.gitmodules', '--get-regexp', 'path'], options);
+  const paths = new Set<string>();
+  for (const line of res.stdout.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf(' ');
+    if (idx === -1) continue;
+    const p = trimmed.slice(idx + 1).trim();
+    if (p) paths.add(p);
+  }
+  return paths;
+}
+
+/**
+ * Read the old/new subproject SHAs a root gitlink moved between over `fromRef..toRef`.
+ * `git diff <range> -- <subPath>` on a gitlink prints `-Subproject commit <old>` /
+ * `+Subproject commit <new>`. Throws if either SHA can't be resolved.
+ */
+async function resolveSubmoduleGitlinkRange(
+  repoPath: string,
+  fromRef: string,
+  toRef: string,
+  subPath: string,
+  options: GitStatusOptions,
+): Promise<{ from: string; to: string }> {
+  const res = await runGit(repoPath, ['diff', `${fromRef}..${toRef}`, '--', subPath], options);
+  let from = '';
+  let to = '';
+  for (const line of res.stdout.split('\n')) {
+    const m = line.match(/^([+-])Subproject commit ([0-9a-f]{7,40})/);
+    if (!m) continue;
+    if (m[1] === '-') from = m[2];
+    else to = m[2];
+  }
+  if (!from || !to) throw new Error(`no gitlink range for submodule ${subPath}`);
+  return { from, to };
 }
 
 /**

package/src/mesh/mesh-event-forwarding.ts

@@ -44,8 +44,40 @@ import {
     runIdleMaintenanceThenAssignQueue,
     maybeAutoFastForwardIdleNode,
     sessionHasActiveAssignment,
+    AUTO_LAUNCH_AWAIT_CLAIM_MS,
 } from './mesh-queue-assignment.js';
 
+// ---------------------------------------------------------------------------
+// BOOTSTRAP-MSG: worktreeHasQueuedTask predicate (exported for unit testing)
+// ---------------------------------------------------------------------------
+// Returns true when a queue task entry should be counted as "this worktree node already
+// has work being handled" — suppressing the misleading 'use mesh_launch_session' advice
+// in the worktree_bootstrap_complete system message.
+//
+// Mirrors the autoLaunchPending logic in triggerMeshQueue (mesh-queue-assignment.ts):
+//   • assigned           → true  (session claimed it)
+//   • pending, no al     → true  (queue will auto-launch, no action needed)
+//   • pending, al started|completed within AUTO_LAUNCH_AWAIT_CLAIM_MS
+//                        → true  (session spun up, will claim soon)
+//   • pending, al started|completed but OUTSIDE the window
+//                        → false (launch timed out, manual launch IS needed)
+//   • pending, other al  → true  (not yet tried, queue will handle)
+export function bootstrapQueueTaskCountsAsHandled(
+    task: { status: string; targetNodeId?: string | null; autoLaunch?: { status: string; updatedAt: string } | null },
+    bootstrapNodeId: string,
+    nowMs: number,
+): boolean {
+    if (!meshNodeIdMatches({ id: task.targetNodeId } as MeshNodeIdentified, bootstrapNodeId)) return false;
+    if (task.status === 'assigned') return true;
+    const al = task.autoLaunch;
+    if (!al) return true;
+    if (al.status === 'started' || al.status === 'completed') {
+        const launchedAtMs = Date.parse(al.updatedAt);
+        return Number.isFinite(launchedAtMs) && nowMs - launchedAtMs < AUTO_LAUNCH_AWAIT_CLAIM_MS;
+    }
+    return true;
+}
+
 // The set of coordinator-daemon ids this daemon answers to when draining the
 // pending-events queue. Mirrors resolveCoordinatorDaemonIds in mesh-reconcile-loop:
 // a unicast event may be stamped with the status id, the bare machineId, OR the
@@ -1319,8 +1351,9 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
         // Only meaningful for the 'complete' transition (a failed bootstrap claims nothing).
         if (args.event === 'worktree_bootstrap_complete' && bootstrapNodeId) {
             try {
+                const nowMs = Date.now();
                 worktreeHasQueuedTask = getQueue(args.meshId, { status: ['pending', 'assigned'] })
-                    .some((task) => meshNodeIdMatches({ id: task.targetNodeId } as MeshNodeIdentified, bootstrapNodeId));
+                    .some((task) => bootstrapQueueTaskCountsAsHandled(task, bootstrapNodeId, nowMs));
             } catch (e: any) {
                 LOG.warn('MeshQueue', `Failed to check queued task for ${bootstrapNodeId} (mesh ${args.meshId}): ${e?.message || e}`);
             }

package/src/mesh/mesh-idle-reminder.ts

@@ -19,10 +19,12 @@
  * Design invariants:
  *  - Only fires when the mesh has ≥1 `active` mission AND is fully idle. Fully idle =
  *    buildMeshActiveWork over queue + direct dispatches reports totalActiveCount === 0
- *    && generatingCount === 0. We intentionally do NOT probe remote node sessions here
- *    (expensive per-tick RPC): any non-terminal queue/direct work already makes
- *    totalActiveCount > 0, so the idle check is conservative — it suppresses the
- *    reminder whenever any work is outstanding, which is the safe direction.
+ *    && generatingCount === 0 AND no async refine job is accepted/running. We intentionally
+ *    do NOT probe remote node sessions here (expensive per-tick RPC): any non-terminal
+ *    queue/direct work already makes totalActiveCount > 0, so the idle check is
+ *    conservative — it suppresses the reminder whenever any work is outstanding, which is
+ *    the safe direction. Async refine jobs (`mesh_refine_node`) are a separate class that
+ *    buildMeshActiveWork does not count, so they are checked explicitly from the ledger.
  *  - NEVER transitions a mission's status. It only surfaces a hint; the coordinator
  *    decides via mesh_mission_upsert.
  *  - Debounced per mission-set. Re-fires only when the debounce window has elapsed OR
@@ -39,6 +41,7 @@ import { getMeshMissions, type MeshMissionRecord } from './mesh-missions.js';
 import { getQueue, getActiveDirectDispatches } from './mesh-work-queue.js';
 import { readLedgerEntries } from './mesh-ledger.js';
 import { buildMeshActiveWork } from './mesh-active-work.js';
+import { buildMeshAsyncRefineJobs, summarizeMeshAsyncRefineJobs } from './mesh-refine-status.js';
 
 /** Coordinator instance the reminder is injected into (the idle CLI session). */
 type CoordinatorInstance = ReturnType<DaemonComponents['instanceManager']['getInstance']>;
@@ -119,15 +122,28 @@ export function maybeInjectIdleActiveMissionReminder(
         // We pass no `nodes`: totalActiveCount already counts pending/assigned queue tasks
         // and un-acknowledged direct dispatches from the store alone, so the check stays
         // cheap (no per-node status RPC) and conservative.
+        const ledgerEntries = readLedgerEntries(meshId, { tail: 200 });
         const summary = buildMeshActiveWork({
             meshId,
             queue: getQueue(meshId),
             directDispatches: getActiveDirectDispatches(meshId),
-            ledgerEntries: readLedgerEntries(meshId, { tail: 200 }),
+            ledgerEntries,
             now,
         }).summary;
         if (summary.totalActiveCount !== 0 || summary.generatingCount !== 0) return false;
 
+        // Async refine jobs are NOT modeled as queue/direct dispatches, so buildMeshActiveWork
+        // never counts them — an accepted/running `mesh_refine_node` job (each pass runs
+        // typecheck/test/build for minutes) would otherwise read as "no work in flight" and the
+        // reminder would push the coordinator to close a mission whose verification is still
+        // in progress. Derive in-flight refine jobs from the SAME ledger tail already read
+        // (buildMeshAsyncRefineJobs maps `task_dispatched` refine entries with no terminal to
+        // accepted/running) and suppress the reminder while any is non-terminal.
+        const activeRefineJobs = summarizeMeshAsyncRefineJobs(
+            buildMeshAsyncRefineJobs({ meshId, ledgerEntries }),
+        ).activeJobs;
+        if (activeRefineJobs.length > 0) return false;
+
         // Debounce — same mission set within the window is nudged at most once.
         const store = MeshRuntimeStore.getInstance();
         const hash = missionSetHash(activeMissions);

package/src/mesh/mesh-queue-assignment.ts

@@ -709,7 +709,7 @@ const AUTO_LAUNCH_COOLDOWN_MS = 5_000;
 // successfully-launched session whose claim we are still waiting on, do not launch it
 // again until the window lapses. It is generous (a slow remote spawn can take tens of
 // seconds) but bounded so a launch that silently never reaches idle is eventually retried.
-const AUTO_LAUNCH_AWAIT_CLAIM_MS = 90_000;
+export const AUTO_LAUNCH_AWAIT_CLAIM_MS = 90_000;
 
 // AUTOLAUNCH-CLAIM-CHURN. For a REMOTE node the launch→claim handshake is purely
 // event-sourced: the worker's agent:ready must be pulled (reconcile PHASE 1) to run

package/src/providers/spec/fsm-driver.ts

@@ -790,7 +790,24 @@ export class FsmDriver implements ISpecDriver {
         if (!rule) return null;
         const hay = sectionText(sections, rule.section, fullScreen);
         const minCount = rule.min_count ?? 2;
-        const buttons = extractButtonsFromRule(rule, hay);
+        let buttons = extractButtonsFromRule(rule, hay);
+        if (buttons.length < minCount && rule.section) {
+            // Whole-screen fallback: the modal `section` can resolve too short
+            // when a spec's `until` anchor clips the section BEFORE the choices
+            // (e.g. a claude-cli approval whose command preview carries a leading
+            // shell-redirect line — `>/dev/null 2>&1` — that an over-broad
+            // `[…>…]` modal-terminator anchor mistakes for the input prompt,
+            // stranding the `❯ 1. Yes / 2. No` buttons below the cut and wedging
+            // auto-approve forever). The buttons are still present in the full
+            // buffer, so re-extract from it. `lastContiguousNumberedBlock`
+            // (inside extractButtonsFromRule) already isolates the real
+            // bottom-most choice block from any stray body-numbered lines the
+            // wider scope pulls in, so this cannot bind the wrong rows. Guards
+            // it to the buttons-under-count case only, so a correctly-scoped
+            // spec pays nothing.
+            const whole = extractButtonsFromRule(rule, fullScreen);
+            if (whole.length >= minCount) buttons = whole;
+        }
         if (buttons.length < minCount) return null;
         const title = this.deriveTitle(state, sections, fullScreen);
         return { title, buttons };