@adhdev/daemon-core 0.9.82-rc.552 → 0.9.82-rc.554

package/dist/cli-adapter-types.d.ts

@@ -5,6 +5,7 @@
  */
 import type { ChatMessage } from './types.js';
 import type { InteractivePrompt, InteractivePromptResponse } from './providers/types/interactive-prompt.js';
+import type { MeshSendKeyItem, MeshSendKeyName } from './cli-adapters/provider-cli-shared.js';
 export interface CliAdapterStatus {
     status?: string;
     parsedStatus?: string;
@@ -118,6 +119,34 @@ export interface CliAdapter {
     cancel(): void;
     isProcessing(): boolean;
     isReady(): boolean;
+    isAlive?(): boolean;
+    getTerminalScreenSnapshot?(maxBytes?: number): {
+        text: string;
+        cursor: {
+            col: number;
+            row: number;
+        };
+        cols: number;
+        rows: number;
+        truncated: boolean;
+        originalBytes: number;
+        returnedBytes: number;
+        hash: string;
+    };
+    injectKeys?(items: MeshSendKeyItem[], opts?: {
+        allowModalOverride?: boolean;
+    }): Promise<{
+        ok: true;
+        keys: MeshSendKeyName[];
+        hasDestructive: boolean;
+        submits: boolean;
+        bytes: number;
+    } | {
+        ok: false;
+        refused: 'submit_race' | 'actionable_modal';
+        keys: MeshSendKeyName[];
+        hasDestructive: boolean;
+    }>;
     setOnStatusChange(callback: () => void): void;
     updateRuntimeSettings?(settings: Record<string, unknown>): void;
     setCliScripts?(scripts: Record<string, unknown>): void;

package/dist/cli-adapters/provider-cli-adapter.d.ts

@@ -16,7 +16,7 @@
 import type { CliAdapter, CliLaunchInfo } from '../cli-adapter-types.js';
 import type { InteractivePromptResponse } from '../providers/types/interactive-prompt.js';
 import { type PtyRuntimeMetadata, type PtyTransportFactory } from './pty-transport.js';
-import { type CliProviderModule, type CliScripts, type CliSessionStatus, type CliTraceEntry, type ParsedSession } from './provider-cli-shared.js';
+import { type MeshSendKeyItem, type MeshSendKeyName, type CliProviderModule, type CliScripts, type CliSessionStatus, type CliTraceEntry, type ParsedSession } from './provider-cli-shared.js';
 import { CliStateEngine, type CliBufferSnapshot } from './cli-state-engine.js';
 import { type TurnParseScope } from './provider-cli-parse.js';
 import { type ProviderResolutionMeta } from './provider-cli-config.js';
@@ -109,6 +109,8 @@ export declare class ProviderCliAdapter implements CliAdapter {
     private static readonly MAX_ACCUMULATED_BUFFER;
     private parsedStatusCache;
     private static readonly SCREEN_SNAPSHOT_MIN_INTERVAL_MS;
+    private static readonly TERMINAL_SNAPSHOT_DEFAULT_MAX_BYTES;
+    private static readonly TERMINAL_SNAPSHOT_ABSOLUTE_MAX_BYTES;
     private static readonly STATIC_IDLE_POLL_CONFIRM_COUNT;
     private readonly providerResolutionMeta;
     private getBufferState;
@@ -340,6 +342,83 @@ export declare class ProviderCliAdapter implements CliAdapter {
     /** Returns a point-in-time snapshot of all buffer/screen state for external consumers (e.g. CliStateEngine). */
     getSnapshot(): CliBufferSnapshot;
     isAlive(): boolean;
+    /**
+     * MESH-READ-TERMINAL (feature 2: RAW terminal read). Narrow, least-privilege
+     * read of the CURRENT rendered viewport for mesh_read_terminal. Deliberately
+     * NARROWER than getSnapshot()/getDebugSnapshot():
+     *  - It returns ONLY the terminal's current rendered viewport (what a human
+     *    would see on screen right now), the cursor position and the viewport
+     *    size. NO debug buffers, NO parser/FSM state, NO scrollback/history.
+     *  - It does NOT call getParseScreenText() (which may graft an older snapshot
+     *    onto the current frame for parse accuracy) — the caller asked for the
+     *    live viewport, not a parse-optimized composite.
+     *  - The payload is bounded in BYTES (UTF-8) with bottom-tail preservation so
+     *    a screen of multi-byte glyphs can never exceed the MCP payload cap. See
+     *    truncateToByteTailByLine.
+     *
+     * SECURITY NOTE: the raw viewport can contain tokens / command args / env
+     * values / user data. Callers MUST gate this on mesh ownership and MUST NOT
+     * log the returned text. Opt-in redaction is intentionally out of scope for
+     * this feature and left as a future enhancement.
+     *
+     * `maxBytes` is clamped to [1KiB, ABSOLUTE_MAX] (default 32KiB, hard cap 64KiB).
+     */
+    getTerminalScreenSnapshot(maxBytes?: number): {
+        text: string;
+        cursor: {
+            col: number;
+            row: number;
+        };
+        cols: number;
+        rows: number;
+        truncated: boolean;
+        originalBytes: number;
+        returnedBytes: number;
+        hash: string;
+    };
+    /**
+     * MESH-SEND-KEYS (feature 3: key injection). Inject a STRUCTURED key sequence
+     * into the PTY for the mesh_send_keys tool. Reuses the same serialized write
+     * path as sends (writeToPty via writeRaw semantics) so the injection FIFO-
+     * orders behind any in-flight write.
+     *
+     * Two guards run INSIDE this method, immediately before the write, so they see
+     * a consistent snapshot of the adapter's submit/echo/queue state (no async gap
+     * between check and write — the encode is synchronous and the write is chained
+     * atomically after it):
+     *
+     *  1. submit-race recheck (echo-gate): even though writeToPty is FIFO, an
+     *     already-SCHEDULED echo-gated Enter (engine.submitPendingUntil in the
+     *     future), an armed stuck-submit retry (submitRetryTimer), or an in-flight
+     *     pending-outbound flush can submit at a DIFFERENT tick than our write —
+     *     so an injected literal could be submitted by a pending Enter, or our
+     *     ENTER could submit a half-typed pending body. When any of those is live
+     *     we REFUSE the injection rather than interleave.
+     *
+     *  2. modal fail-closed: if the session is parked on an actionable approval
+     *     modal, refuse a NON-destructive injection (ENTER/text/arrows) and direct
+     *     the caller to mesh_approve — so a modal choice can't be confirmed via
+     *     send_keys to bypass the approval policy. (A destructive ESC/CTRL_C, which
+     *     dismisses rather than confirms, is allowed to proceed past this gate; it
+     *     is separately gated by confirm_destructive + policy at the tool layer.)
+     *
+     * The caller (tool layer) owns the destructive-key double gate and the audit
+     * ledger. This method NEVER logs the literal text (only key enums / byte len).
+     */
+    injectKeys(items: MeshSendKeyItem[], opts?: {
+        allowModalOverride?: boolean;
+    }): Promise<{
+        ok: true;
+        keys: MeshSendKeyName[];
+        hasDestructive: boolean;
+        submits: boolean;
+        bytes: number;
+    } | {
+        ok: false;
+        refused: 'submit_race' | 'actionable_modal';
+        keys: MeshSendKeyName[];
+        hasDestructive: boolean;
+    }>;
     flushOutboundQueue(): void;
     writeRaw(data: string | Buffer): Promise<void>;
     resolveModal(buttonIndex: number): void;

package/dist/cli-adapters/provider-cli-shared.d.ts

@@ -295,6 +295,61 @@ export declare class TerminalTranscriptAccumulator {
     private applyCsi;
 }
 export declare function sanitizeTerminalText(str: string): string;
+/** Named PTY keys the send-keys tool accepts (closed enum). */
+export type MeshSendKeyName = 'ENTER' | 'ESC' | 'CTRL_C' | 'UP' | 'DOWN' | 'LEFT' | 'RIGHT' | 'TAB' | 'BACKSPACE';
+/** Exact terminal byte sequence for each named key. */
+export declare const MESH_SEND_KEY_ENCODING: Record<MeshSendKeyName, string>;
+export declare const MESH_DESTRUCTIVE_KEYS: ReadonlySet<MeshSendKeyName>;
+export type MeshSendKeyItem = {
+    text: string;
+} | {
+    key: MeshSendKeyName;
+};
+export interface MeshSendKeysEncodeResult {
+    /** The concatenated byte sequence to write to the PTY (single atomic write). */
+    sequence: string;
+    /** Named keys present, in order (for audit — text bodies are NOT recorded). */
+    keys: MeshSendKeyName[];
+    /** True if any item is a destructive key (CTRL_C / ESC). */
+    hasDestructive: boolean;
+    /** True if the sequence submits (ends with an ENTER/CR) — informational. */
+    submits: boolean;
+}
+/** Per-call limits (auditability + safety — no unbounded blast). */
+export declare const MESH_SEND_KEYS_MAX_ITEMS = 64;
+export declare const MESH_SEND_KEYS_MAX_TEXT_BYTES = 4096;
+/**
+ * Validate + encode a structured key sequence into the exact bytes to write.
+ * Throws on an invalid key name, an over-limit item count, or an over-limit
+ * total text byte length. text+ENTER (or any text followed by ENTER) is encoded
+ * as ONE contiguous string so the caller can submit it in a single atomic write
+ * — no interleaving between the text and its submit key.
+ */
+export declare function encodeMeshSendKeys(items: MeshSendKeyItem[]): MeshSendKeysEncodeResult;
+/**
+ * MESH-READ-TERMINAL (feature 2): result of a byte-bounded, bottom-tail terminal
+ * screen truncation. The bound is in BYTES (UTF-8), not characters, because a
+ * screen full of multi-byte glyphs can blow past an MCP payload cap even when the
+ * character count looks safe. The bottom (tail) of the screen is preserved — the
+ * prompt, an active modal and the most recent output all live at the bottom — so
+ * a truncated read still shows the coordinator the actionable frame.
+ */
+export interface ByteTailTruncation {
+    text: string;
+    truncated: boolean;
+    /** UTF-8 byte length of the full input before truncation. */
+    originalBytes: number;
+    /** UTF-8 byte length of the returned (possibly truncated) text. */
+    returnedBytes: number;
+}
+/**
+ * Truncate `text` to at most `maxBytes` UTF-8 bytes, preserving whole lines from
+ * the BOTTOM up (the prompt/modal/recent output). Never splits a line and never
+ * splits a UTF-8 code point (whole-line granularity guarantees valid UTF-8). If
+ * even the single last line exceeds the bound, that line is hard-clipped on a
+ * safe UTF-8 boundary from its END so the tail is still returned intact-ish.
+ */
+export declare function truncateToByteTailByLine(text: string, maxBytes: number): ByteTailTruncation;
 export declare function listCliScriptNames(scripts: CliScripts | undefined): string[];
 export declare function buildCliScreenSnapshot(text: string): CliScreenSnapshot;
 export declare const buildCliSpawnEnv: typeof sanitizeSpawnEnv;

package/dist/cli-adapters/terminal-screen.d.ts

@@ -21,6 +21,11 @@ export declare class TerminalScreen {
         col: number;
         row: number;
     };
+    /** Current viewport dimensions (cols × rows). */
+    getSize(): {
+        cols: number;
+        rows: number;
+    };
     dispose(): void;
     private createBackend;
 }

package/dist/commands/stream-commands.d.ts

@@ -7,6 +7,37 @@ export declare function handleSelectSession(h: CommandHelpers, args: any): Promi
 export declare function handleOpenPanel(h: CommandHelpers, args: any): Promise<CommandResult>;
 export declare function handlePtyInput(h: CommandHelpers, args: any): Promise<CommandResult>;
 export declare function handlePtyResize(_h: CommandHelpers, args: any): CommandResult;
+/**
+ * MESH-READ-TERMINAL (feature 2: RAW terminal read). Reads the CURRENT rendered
+ * PTY viewport of a specific mesh worker session for the mesh_read_terminal tool.
+ *
+ * This is the daemon-side `read_terminal` verb. It runs BOTH on the coordinator
+ * (for a locally-hosted worker) and, after router forwarding
+ * (MESH_FORWARDABLE_SESSION_COMMANDS + _meshDirectDispatch), on the OWNING remote
+ * worker daemon — where the live viewport actually exists. The instance's
+ * getTerminalScreenSnapshot() is gated on isMeshWorkerSession() (returns null for
+ * a non-mesh session), which the MCP layer complements with a mesh/session/node
+ * ownership cross-check. SECURITY: the raw viewport can contain tokens / args /
+ * env / user data — never logged here (only its byte size / truncation flag are).
+ */
+export declare function handleReadTerminal(h: CommandHelpers, args: any): CommandResult;
+/**
+ * MESH-SEND-KEYS (feature 3: key injection). Inject a structured key sequence into
+ * a specific mesh worker session's PTY for the mesh_send_keys tool.
+ *
+ * Daemon-side `send_keys` verb. Like read_terminal it runs on the coordinator for
+ * a local worker and, after router forwarding (MESH_FORWARDABLE_SESSION_COMMANDS +
+ * _meshDirectDispatch), on the OWNING remote worker daemon. The instance's
+ * injectKeys() is gated on isMeshWorkerSession(); the MCP layer complements it with
+ * mesh/session/node ownership + the destructive-key double gate (confirm_destructive
+ * + mesh policy) + audit ledger.
+ *
+ * Defense-in-depth here: even though the MCP layer gates destructive keys, the
+ * daemon re-enforces confirm_destructive so a direct/forwarded send_keys that
+ * contains CTRL_C/ESC without confirm is refused at the boundary too.
+ * SECURITY: never logs the literal text body (only key enums / byte counts).
+ */
+export declare function handleSendKeys(h: CommandHelpers, args: any): Promise<CommandResult>;
 export declare function handleGetProviderSettings(h: CommandHelpers, args: any): CommandResult;
 export declare function handleSetProviderSetting(h: CommandHelpers, args: any): Promise<CommandResult>;
 export declare function handleGetProviderSourceConfig(h: CommandHelpers, _args: any): CommandResult;

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export type { SessionEntry, CompactSessionEntry, CompactDaemonEntry, CloudDaemon
 export type { InteractivePrompt, InteractiveQuestion, InteractiveOption, InteractivePromptResponse, InteractiveAnswer, } from './providers/types/interactive-prompt.js';
 export { normalizeInteractivePrompt, normalizeInteractivePromptResponse, buildClaudeInteractiveToolResult, interactivePromptFromClaudeAskUserQuestion, detectClaudeAskUserQuestionPromptFromJson, } from './providers/types/interactive-prompt.js';
 export type { RepoMesh, RepoMeshDaemonRole, RepoMeshHostMetadata, RepoMeshHostPairingMetadata, RepoMeshHostStatus, RepoMeshNode, RepoMeshNodeHealth, RepoMeshPolicy, RepoMeshMagiSessionCleanupMode, RepoMeshNodePolicy, RepoMeshRelatedRepo, RepoMeshNodeCapabilities, DetectedCommand, ProjectContextSnapshot, ProjectContextSource, RepoMeshCoordinatorConfig, LocalMeshConfig, LocalMeshEntry, LocalMeshNodeEntry, RepoMeshStatus, RepoMeshNodeStatus, RepoMeshPeerConnectionStatus, RepoMeshPeerConnectionState, RepoMeshPeerConnectionTransport, RepoMeshSessionStatus, RepoMeshQueueTask, RepoMeshQueueTaskStatus, RepoMeshQueueSummary, RepoMeshQueueStatus, RepoMeshLedgerEntryStatus, RepoMeshLedgerSummaryStatus, RepoMeshLedgerStatus, MeshAsyncJobLifecycle, RepoMeshSchedulingStrategy, RepoMeshSchedulingStatus, RepoMeshNodeSchedulingStatus, RepoMeshNodeProviderSchedulingStatus, } from './repo-mesh-types.js';
-export { DEFAULT_MESH_POLICY, resolveDelegatedWorkerAutoApprove, resolveMagiSessionCleanupMode, magiAutoLaunchedSessionCleanupDecision, MESH_SCHEDULING_STRATEGIES, DEFAULT_MESH_SCHEDULING_STRATEGY, normalizeMeshSchedulingStrategy, resolveNodeSchedulingPriority, resolveProviderMaxParallel, mergeAndNormalizePolicy, normalizeAutoFastForwardPolicy, resolveMaxParallelTasks, MESH_MAX_PARALLEL_TASKS_MIN, MESH_MAX_PARALLEL_TASKS_MAX, MESH_CONVERGE_REFINE_TAG, MESH_CONVERGE_FAST_FORWARD_TAG, resolveAutoConvergeCodeChange, } from './repo-mesh-types.js';
+export { DEFAULT_MESH_POLICY, resolveDelegatedWorkerAutoApprove, resolveAllowSendKeysDestructive, resolveMagiSessionCleanupMode, magiAutoLaunchedSessionCleanupDecision, MESH_SCHEDULING_STRATEGIES, DEFAULT_MESH_SCHEDULING_STRATEGY, normalizeMeshSchedulingStrategy, resolveNodeSchedulingPriority, resolveProviderMaxParallel, mergeAndNormalizePolicy, normalizeAutoFastForwardPolicy, resolveMaxParallelTasks, MESH_MAX_PARALLEL_TASKS_MIN, MESH_MAX_PARALLEL_TASKS_MAX, MESH_CONVERGE_REFINE_TAG, MESH_CONVERGE_FAST_FORWARD_TAG, resolveAutoConvergeCodeChange, } from './repo-mesh-types.js';
 export * from './git/index.js';
 import type { RuntimeWriteOwner as _RuntimeWriteOwner } from './shared-types-extra.js';
 import type { RuntimeAttachedClient as _RuntimeAttachedClient } from './shared-types-extra.js';