@adhdev/daemon-core 0.9.82-rc.552 → 0.9.82-rc.554

package/src/providers/spec/adapter.ts

@@ -175,6 +175,13 @@ export class TerminalAdapter {
         return { row: pos.row, col: pos.col };
     }
 
+    /** Current terminal geometry (columns × rows). Tracked here rather than
+     *  read off the screen buffer so a resize is reflected immediately, before
+     *  the next repaint. Consumed by the mesh_read_terminal viewport read. */
+    getScreenSize(): { cols: number; rows: number } {
+        return { cols: this.cols, rows: this.rows };
+    }
+
     send_keys(text: string): void {
         this.recordEvent('input', capPreview(escapeControl(text)), text.length);
         this.pty?.write(text);

package/src/providers/spec/cli-adapter.ts

@@ -23,10 +23,17 @@ import { lastContiguousNumberedBlock } from './evaluator.js';
 import { executeNativeHistory } from './native-history-executor.js';
 import { detectBackgroundTaskActive } from './background-task-detector.js';
 import * as fs from 'node:fs';
+import { createHash } from 'node:crypto';
 import type { NativeHistoryConfig, Control, ControlAction } from './types.js';
 import type { CliAdapter, CliAdapterStatus } from '../../cli-adapter-types.js';
 import type { ChatMessage } from '../../types.js';
 import type { PtyTransportFactory } from '../../cli-adapters/pty-transport.js';
+import {
+    encodeMeshSendKeys,
+    truncateToByteTailByLine,
+    type MeshSendKeyItem,
+    type MeshSendKeyName,
+} from '../../cli-adapters/provider-cli-shared.js';
 import { LOG } from '../../logging/logger.js';
 import {
     buildClaudeInteractiveTuiAnswerSteps,
@@ -277,6 +284,121 @@ export class SpecCliAdapter implements CliAdapter {
         return this.spawned && !this.exited;
     }
 
+    // Process liveness for the MESH-STALL-WATCH watchdog (checkMeshWorkerStall).
+    // The spec path drives the child through the transport/driver rather than a
+    // directly-held ptyProcess handle, so liveness is tracked by the spawned/exited
+    // lifecycle flags — the same pair isReady() uses. A spawned, not-yet-exited
+    // session is alive. ProviderCliAdapter exposes the equivalent via `ptyProcess !== null`.
+    isAlive(): boolean {
+        return this.spawned && !this.exited;
+    }
+
+    // MESH-READ-TERMINAL / MESH-SEND-KEYS byte caps — same envelope as
+    // ProviderCliAdapter (32KiB default view, 64KiB absolute hard cap). Bytes,
+    // not chars: a multi-byte-glyph screen can exceed an MCP payload cap while
+    // the char count still looks safe.
+    private static readonly TERMINAL_SNAPSHOT_DEFAULT_MAX_BYTES = 32 * 1024;
+    private static readonly TERMINAL_SNAPSHOT_ABSOLUTE_MAX_BYTES = 64 * 1024;
+
+    /**
+     * MESH-READ-TERMINAL (feature 2: RAW terminal read). Least-privilege read
+     * of the CURRENT rendered viewport for mesh_read_terminal on the spec path
+     * (claude-cli / antigravity / codex-cli — the native-source providers that
+     * route through SpecCliAdapter). Mirrors ProviderCliAdapter.getTerminalScreenSnapshot:
+     *  - returns ONLY the driver's current viewport snapshot, the cursor
+     *    position and the terminal geometry — NO scrollback, NO parser/FSM
+     *    state, NO debug buffers;
+     *  - the payload is byte-bounded (UTF-8) with bottom-tail preservation so a
+     *    screen of multi-byte glyphs can never exceed the MCP payload cap;
+     *  - `hash` is over the FULL untruncated viewport so a caller can detect a
+     *    screen change across polls even when the returned text was truncated.
+     *
+     * SECURITY: the raw viewport can carry tokens / command args / env / user
+     * data. Callers MUST gate this on mesh ownership and MUST NOT log the text.
+     */
+    getTerminalScreenSnapshot(maxBytes = SpecCliAdapter.TERMINAL_SNAPSHOT_DEFAULT_MAX_BYTES): {
+        text: string;
+        cursor: { col: number; row: number };
+        cols: number;
+        rows: number;
+        truncated: boolean;
+        originalBytes: number;
+        returnedBytes: number;
+        hash: string;
+    } {
+        const cap = Math.min(
+            SpecCliAdapter.TERMINAL_SNAPSHOT_ABSOLUTE_MAX_BYTES,
+            Math.max(1024, Math.floor(maxBytes) || SpecCliAdapter.TERMINAL_SNAPSHOT_DEFAULT_MAX_BYTES),
+        );
+        let rawViewport = '';
+        try { rawViewport = this.driver.snapshot() || ''; } catch { rawViewport = ''; }
+        let cursor = { row: 0, col: 0 };
+        try { cursor = this.driver.getCursorPosition(); } catch { /* keep 0,0 */ }
+        // getScreenSize is optional on ISpecDriver; a test double may omit it.
+        let size = { cols: 0, rows: 0 };
+        try { size = this.driver.getScreenSize?.() ?? size; } catch { /* keep 0,0 */ }
+        const truncation = truncateToByteTailByLine(rawViewport, cap);
+        const hash = createHash('sha256').update(rawViewport, 'utf8').digest('hex').slice(0, 16);
+        return {
+            text: truncation.text,
+            cursor: { col: cursor.col, row: cursor.row },
+            cols: size.cols,
+            rows: size.rows,
+            truncated: truncation.truncated,
+            originalBytes: truncation.originalBytes,
+            returnedBytes: truncation.returnedBytes,
+            hash,
+        };
+    }
+
+    /**
+     * MESH-SEND-KEYS (feature 3: key injection). Inject a STRUCTURED key
+     * sequence into the spec-driven PTY for mesh_send_keys. Mirrors
+     * ProviderCliAdapter.injectKeys' modal fail-closed guard, then writes the
+     * whole encoded sequence in ONE pty_write dispatch (text+ENTER is a single
+     * contiguous string, so a submit key can never be separated from the text
+     * it submits).
+     *
+     * The spec path drives the child through the FsmDriver, not a directly-held
+     * ptyProcess — there is no adapter-level echo-gate/submit-retry FIFO to race
+     * against here (the driver serializes its own writes), so the only guard is
+     * the modal fail-closed: a NON-destructive injection into an actionable
+     * approval modal is refused (use mesh_approve) unless explicitly overridden.
+     * A destructive ESC/CTRL_C dismisses rather than confirms, so it is allowed
+     * past this gate (the tool layer owns the destructive double-gate + audit).
+     * This method NEVER logs the literal text — only key enums / byte length.
+     */
+    async injectKeys(
+        items: MeshSendKeyItem[],
+        opts: { allowModalOverride?: boolean } = {},
+    ): Promise<
+        | { ok: true; keys: MeshSendKeyName[]; hasDestructive: boolean; submits: boolean; bytes: number }
+        | { ok: false; refused: 'submit_race' | 'actionable_modal'; keys: MeshSendKeyName[]; hasDestructive: boolean }
+    > {
+        if (!this.spawned || this.exited) throw new Error(`${this.cliName} is not running`);
+        const encoded = encodeMeshSendKeys(items);
+
+        // Modal fail-closed — a NON-destructive injection while parked on an
+        // actionable approval modal is refused so a modal choice can't be
+        // confirmed via send_keys and bypass the approval policy.
+        const modalActive = this.latestState?.status === 'approval';
+        if (modalActive && !encoded.hasDestructive && !opts.allowModalOverride) {
+            LOG.warn('SpecAdapter', `[${this.cliType}] send_keys refused (actionable_modal): keys=${encoded.keys.join(',')} — use mesh_approve`);
+            return { ok: false, refused: 'actionable_modal', keys: encoded.keys, hasDestructive: encoded.hasDestructive };
+        }
+
+        // Atomic write: the full encoded sequence goes out in ONE pty_write.
+        this.driver.dispatch({ kind: 'pty_write', data: encoded.sequence });
+        LOG.info('SpecAdapter', `[${this.cliType}] send_keys injected keys=${encoded.keys.join(',') || '(text-only)'} bytes=${Buffer.byteLength(encoded.sequence, 'utf8')} destructive=${encoded.hasDestructive}`);
+        return {
+            ok: true,
+            keys: encoded.keys,
+            hasDestructive: encoded.hasDestructive,
+            submits: encoded.submits,
+            bytes: Buffer.byteLength(encoded.sequence, 'utf8'),
+        };
+    }
+
     setOnStatusChange(cb: () => void): void {
         this.statusCallback = cb;
     }

package/src/providers/spec/fsm-driver.ts

@@ -122,6 +122,10 @@ export interface ISpecDriver {
     snapshot(): string;
     getCursorPosition(): { row: number; col: number };
     getScreen(): string;
+    /** Current terminal geometry (columns × rows). Optional so a non-Fsm
+     *  ISpecDriver implementation (test doubles) need not provide it; the
+     *  mesh_read_terminal path falls back to a 0×0 geometry when absent. */
+    getScreenSize?(): { cols: number; rows: number };
     getSpecPath(): string;
     shutdown(): void;
     getStateHistory(): ReadonlyArray<DriverHistoryEntry>;
@@ -443,6 +447,7 @@ export class FsmDriver implements ISpecDriver {
     snapshot(): string { return this.adapter.snapshot(); }
     getCursorPosition(): { row: number; col: number } { return this.adapter.getCursorPosition(); }
     getScreen(): string { return this.adapter.snapshot(); }
+    getScreenSize(): { cols: number; rows: number } { return this.adapter.getScreenSize(); }
 
     /** Scrollback-inclusive screen as line array — used only for modal/button
      *  content extraction so a tall prompt's off-screen anchors stay matchable.

package/src/repo-mesh-types.ts

@@ -350,6 +350,17 @@ export interface RepoMeshPolicy {
      * A node policy may override this per-node (RepoMeshNodePolicy.delegatedWorkerAutoApprove).
      */
     delegatedWorkerAutoApprove?: boolean;
+    /**
+     * MESH-SEND-KEYS (feature 3): opt-in to allow the coordinator to inject
+     * DESTRUCTIVE keys (CTRL_C / ESC) into a worker PTY via mesh_send_keys. These
+     * can kill or derail the worker process, and delegatedWorkerAutoApprove is a
+     * TOOL-CONSENT policy, not a PTY-input authorization — so a destructive key
+     * injection additionally requires this explicit mesh-owner opt-in AND a
+     * per-call confirm_destructive=true. Defaults to false (destructive keys
+     * refused). Non-destructive keys (text/ENTER/arrows/TAB/BACKSPACE) are
+     * unaffected. A node policy may override per-node.
+     */
+    allowSendKeysDestructive?: boolean;
     /**
      * What to do with delegated session-host records for a node when it is removed.
      * Defaults to 'preserve' so completed work can be reviewed later and live
@@ -473,6 +484,11 @@ export interface RepoMeshNodePolicy {
      * precedence over the mesh-level policy for worker sessions launched onto this node.
      */
     delegatedWorkerAutoApprove?: boolean;
+    /**
+     * MESH-SEND-KEYS (feature 3): per-node override for
+     * RepoMeshPolicy.allowSendKeysDestructive.
+     */
+    allowSendKeysDestructive?: boolean;
     /**
      * Optional associated/external repos that must be checked alongside this node.
      * These are explicit policy/config entries only; Repo Mesh does not auto-discover
@@ -734,6 +750,25 @@ export function resolveDelegatedWorkerAutoApprove(
     return true;
 }
 
+/**
+ * MESH-SEND-KEYS (feature 3): resolve whether DESTRUCTIVE key injection
+ * (CTRL_C/ESC via mesh_send_keys) is permitted for a node. Node policy overrides
+ * mesh policy; DEFAULTS TO FALSE (fail-closed) — a destructive key still requires
+ * a per-call confirm_destructive=true on top of this opt-in.
+ */
+export function resolveAllowSendKeysDestructive(
+    meshPolicy?: Pick<RepoMeshPolicy, 'allowSendKeysDestructive'> | null,
+    nodePolicy?: Pick<RepoMeshNodePolicy, 'allowSendKeysDestructive'> | null,
+): boolean {
+    if (typeof nodePolicy?.allowSendKeysDestructive === 'boolean') {
+        return nodePolicy.allowSendKeysDestructive;
+    }
+    if (typeof meshPolicy?.allowSendKeysDestructive === 'boolean') {
+        return meshPolicy.allowSendKeysDestructive;
+    }
+    return false;
+}
+
 /**
  * Resolve the enforced per-(node, provider) maxParallel cap from a node's resolved
  * capability slots, or undefined when no matching slot declares a finite cap. Used