@adhdev/daemon-core 0.9.82-rc.566 → 0.9.82-rc.568

package/src/providers/cli-provider-instance.ts

@@ -109,6 +109,16 @@ export class CliProviderInstance implements ProviderInstance {
      */
     private static readonly AUTO_APPROVE_SETTLE_MS = 600;
 
+    /**
+     * APPROVAL-INBOX-BLINDSPOT (Fix A): how long after a LOCAL auto-approve fire the mesh
+     * event forwarder still treats the modal as "being resolved locally" and suppresses the
+     * coordinator notification. Chosen to comfortably cover the resolveModal → PTY absorb →
+     * status-leaves-approval round trip (incl. the win32 CR-resend loop) while staying short
+     * enough that a modal which auto-approve fired at but did NOT resolve re-surfaces to the
+     * coordinator on the next event. Aligned with the adapter's own approval cooldown scale.
+     */
+    private static readonly APPROVAL_LOCAL_RESOLUTION_COOLDOWN_MS = 8000;
+
     /**
      * Busy-side hysteresis for the settle gate. A momentary `generating` flip
      * while the SAME approval modal's button block is still on screen (its
@@ -387,6 +397,16 @@ export class CliProviderInstance implements ProviderInstance {
     // signature) while a genuinely closed modal — buttons empty continuously past
     // the continuity window — is still recognised and resets the gate.
     private autoApproveLastModalSeenAt = 0;
+    // APPROVAL-INBOX-BLINDSPOT (Fix A): wall-clock of the last time this session actually
+    // FIRED a local auto-approve resolveModal (the settle gate passed → resolveModal
+    // dispatched). The mesh event forwarder keys its agent:waiting_approval suppression on
+    // this + a cooldown so it only drops the coordinator notification when we can positively
+    // confirm the modal was (or is being) resolved LOCALLY. If auto-approve is merely
+    // *configured* on but has NOT recently fired for this modal, the raw waiting_approval is
+    // forwarded so a task_approval_needed ledger row is created and the coordinator/inbox is
+    // told — closing the blind spot where a never-resolving worker approval was silently
+    // dropped just because settings.autoApprove===true.
+    private lastAutoApproveFiredAt = 0;
     // AUTOAPPROVE-FLAP-INBOX-MISSING sticky-approval overlay (see APPROVAL_STICKY_FLAP_MS).
     // The wall-clock of the last frame where the RAW adapter reported waiting_approval with
     // a CONCRETE modal (buttons present), the cached modal to re-present across a busy blip,
@@ -1099,6 +1119,34 @@ export class CliProviderInstance implements ProviderInstance {
         return null;
     }
 
+    /**
+     * APPROVAL-INBOX-BLINDSPOT (Fix A): true when this session's approval modal was — or is
+     * being — resolved LOCALLY within the recent cooldown. Two independent positive signals:
+     *   (1) auto-approve fired its resolveModal within APPROVAL_LOCAL_RESOLUTION_COOLDOWN_MS
+     *       (lastAutoApproveFiredAt), or
+     *   (2) the underlying adapter reports isApprovalRecentlyResolved() — its own resolve
+     *       cooldown, which also covers a dashboard / mesh_approve resolution.
+     * The mesh event forwarder uses this to decide whether an agent:waiting_approval from an
+     * auto-approving worker can be safely SUPPRESSED (a local resolution is in flight) or must
+     * be FORWARDED (auto-approve is configured but has NOT actually resolved this modal, so the
+     * coordinator/inbox must be told). Keying suppression on real resolution — not just the
+     * autoApprove *intent* — is the blind-spot fix: a never-resolving worker approval is no
+     * longer silently dropped.
+     */
+    approvalRecentlyResolvedLocally(now = Date.now()): boolean {
+        if (this.lastAutoApproveFiredAt
+            && now - this.lastAutoApproveFiredAt < CliProviderInstance.APPROVAL_LOCAL_RESOLUTION_COOLDOWN_MS) {
+            return true;
+        }
+        try {
+            const adapter = this.adapter as { isApprovalRecentlyResolved?: () => boolean };
+            if (typeof adapter.isApprovalRecentlyResolved === 'function') {
+                return adapter.isApprovalRecentlyResolved() === true;
+            }
+        } catch { /* adapter gone / transient */ }
+        return false;
+    }
+
     /**
      * NOTIF-HELD-DRAIN: true when this `waiting_approval` is a routine, transient tool-consent
      * of an autonomously-progressing mesh session rather than a genuine human-await modal —
@@ -1344,7 +1392,7 @@ export class CliProviderInstance implements ProviderInstance {
      * real last answer with ZERO per-tick native reads (the native read already ran
      * once at completion). Reset on the next turn's start.
      */
-    private lastCompletionSummary: { content: string; receivedAt: number } | null = null;
+    private lastCompletionSummary: { content: string; receivedAt: number; sourceTimestampMs?: number } | null = null;
 
     private async enforceFreshSessionLaunchIfNeeded(): Promise<void> {
         const scriptName = getForcedNewSessionScriptName(this.provider, this.launchMode);
@@ -1546,18 +1594,31 @@ export class CliProviderInstance implements ProviderInstance {
      * the dashboard tail-repair cache — a display value, not a completion decision.
      */
     private lastVisibleAssistantSummary(messages: unknown): string {
-        if (!Array.isArray(messages)) return '';
+        return this.lastVisibleAssistantSummaryDetail(messages).content;
+    }
+
+    // Like lastVisibleAssistantSummary but also returns the source bubble's own
+    // timestamp (ms), so a cached summary can later be turn-scoped: the display
+    // cache is populated from an UNSCOPED tail read (it must show the answer as
+    // soon as native-history has it), so it can hold a bubble that predates the
+    // current turn. Recording the bubble's timestamp lets the weak-completion
+    // fallback reject a turn-stale cached summary instead of re-leaking the exact
+    // stale bubble the turn-boundary gate already rejected (FALSE-IDLE Defect 1c).
+    private lastVisibleAssistantSummaryDetail(messages: unknown): { content: string; timestampMs?: number } {
+        if (!Array.isArray(messages)) return { content: '' };
         for (let i = messages.length - 1; i >= 0; i -= 1) {
             const m = messages[i] as { role?: string; kind?: string; content?: unknown };
             const role = typeof m?.role === 'string' ? m.role : '';
             const kind = typeof m?.kind === 'string' ? m.kind : '';
             if (role === 'system') continue;
             if (kind === 'tool' || kind === 'activity') continue;
-            if (role === 'user' || role === 'human') return '';
-            if (role === 'assistant') return flattenContent(m.content as any).trim();
-            return '';
+            if (role === 'user' || role === 'human') return { content: '' };
+            if (role === 'assistant') {
+                return { content: flattenContent(m.content as any).trim(), timestampMs: readChatMessageTimestampMs(m as any) };
+            }
+            return { content: '' };
         }
-        return '';
+        return { content: '' };
     }
 
     /**
@@ -1580,6 +1641,29 @@ export class CliProviderInstance implements ProviderInstance {
         return content;
     }
 
+    // FALSE-IDLE Defect 1c: turn-scoped view of the cached completion summary.
+    // The cache is populated from an UNSCOPED tail read (lastVisibleAssistant‑
+    // SummaryDetail) so the dashboard can show the answer the instant native-history
+    // has it — which means it can hold a bubble that PREDATES the producing turn.
+    // The weak-completion (missing_final_assistant) emit path falls back to the cache
+    // for finalSummary; without turn-scoping it would re-surface the exact stale
+    // mid-turn bubble the turn-boundary gate already rejected as evidence, freezing
+    // that stale text as the completion's finalSummary. Consult the cache only when
+    // its source bubble is proven in-turn (timestamp at/after turnStartedAt). When no
+    // boundary is known (turnStartedAt falsy) or the cache carries no source timestamp
+    // (legacy writes), behaviour is identical to the unscoped read.
+    private cachedInTurnCompletionSummaryContent(turnStartedAt?: number): string {
+        const cached = this.lastCompletionSummary;
+        const content = typeof cached?.content === 'string' ? cached.content.trim() : '';
+        if (!content) return '';
+        const hasBoundary = typeof turnStartedAt === 'number' && Number.isFinite(turnStartedAt) && turnStartedAt > 0;
+        const ts = cached?.sourceTimestampMs;
+        if (hasBoundary && typeof ts === 'number' && Number.isFinite(ts) && ts < (turnStartedAt as number)) {
+            return '';
+        }
+        return content;
+    }
+
     private completionFinalAssistantEvidence(parsedMessages: unknown, turnStartedAt?: number): CompletionFinalAssistantEvidence {
         // (FALSEIDLE FixB) UPPER-BOUND turn-end evidence. completionHasFinalAssistantMessage is a
         // pure message-content check ("does the last visible bubble read as a finalized assistant
@@ -1633,9 +1717,9 @@ export class CliProviderInstance implements ProviderInstance {
             // (which also requires turnClosed and turn-scoping): the dashboard should
             // show the answer as soon as native-history has it, even if the FSM has
             // not yet ratified the turn end. getState() replaces it on the next turn.
-            const lastVisibleAssistant = this.lastVisibleAssistantSummary(externalMessages);
-            if (lastVisibleAssistant) {
-                this.lastCompletionSummary = { content: lastVisibleAssistant, receivedAt: Date.now() };
+            const lastVisibleAssistant = this.lastVisibleAssistantSummaryDetail(externalMessages);
+            if (lastVisibleAssistant.content) {
+                this.lastCompletionSummary = { content: lastVisibleAssistant.content, receivedAt: Date.now(), sourceTimestampMs: lastVisibleAssistant.timestampMs };
             }
             return {
                 present,
@@ -1697,7 +1781,11 @@ export class CliProviderInstance implements ProviderInstance {
                 // sessions whose generating_completed is suppressed, and short-gen
                 // settle paths), so the dashboard sees the answer even when no
                 // agent:generating_completed is ever emitted. Native read already ran.
-                this.lastCompletionSummary = { content: externalSummary, receivedAt: Date.now() };
+                // externalSummary is already turn-scoped (extractFinalSummaryFromMessagesAfter
+                // dropped any bubble predating turnStartedAt), so it is in-turn by construction.
+                // Record the turn boundary as its source timestamp so the weak-completion
+                // fallback (cachedInTurnCompletionSummaryContent) accepts it.
+                this.lastCompletionSummary = { content: externalSummary, receivedAt: Date.now(), sourceTimestampMs: typeof turnStartedAt === 'number' ? turnStartedAt : undefined };
                 return externalSummary;
             }
             return parsedSummary || undefined;
@@ -1721,7 +1809,12 @@ export class CliProviderInstance implements ProviderInstance {
             parseError = error?.message || String(error);
         }
 
-        const evidence = this.completionFinalAssistantEvidence(parsed?.messages);
+        // FALSE-IDLE Defect 1c: turn-scope the diagnostic's evidence probe too. Passing
+        // pending.turnStartedAt makes completionHasFinalAssistantMessage reject a stale
+        // mid-turn bubble (predating the turn) just as the finalization gate did, so the
+        // diagnostic cannot credit finalAssistantPresent (or clear missing_final_assistant)
+        // off a bubble the gate already rejected. With no boundary this is unchanged.
+        const evidence = this.completionFinalAssistantEvidence(parsed?.messages, args.pending.turnStartedAt);
         if (evidence.source === 'external-native') {
             this.recordPendingTranscriptProbe(args.pending);
         }
@@ -1742,7 +1835,7 @@ export class CliProviderInstance implements ProviderInstance {
         // missing_final_assistant with an empty payload. Only ever UPGRADES a
         // point-sample miss — a genuine present=true is unchanged, and an empty cache
         // leaves the missing-evidence diagnostic exactly as before.
-        const cachedSummary = evidence.present ? '' : this.cachedCompletionSummaryContent();
+        const cachedSummary = evidence.present ? '' : this.cachedInTurnCompletionSummaryContent(args.pending.turnStartedAt);
         const creditedFromCache = !evidence.present && cachedSummary.length > 0;
         const finalAssistantPresent = evidence.present || creditedFromCache;
         const finalAssistantEvidenceSource = evidence.present
@@ -2707,7 +2800,7 @@ export class CliProviderInstance implements ProviderInstance {
                 // carries the summary that mesh_read_chat.summary already shows — consistent with
                 // completionDiagnostic.finalAssistantPresent being credited from the same cache.
                 finalSummary: (this.completionFinalSummary(this.adapter?.getScriptParsedStatus()?.messages, pending.turnStartedAt)
-                    || this.cachedCompletionSummaryContent()
+                    || this.cachedInTurnCompletionSummaryContent(pending.turnStartedAt)
                     || (blockReason.startsWith('parsed_status:') ? '' : undefined)),
                 completionDiagnostic,
             });
@@ -3139,8 +3232,34 @@ export class CliProviderInstance implements ProviderInstance {
             this.lastAutoApprovalSignature = '';
         }, 5000);
         this.recordAutoApproval(modal?.message, buttonLabel, now);
+        // APPROVAL-INBOX-BLINDSPOT (Fix A) + BUTTON-INDEX-MISMAP (Fix C): stamp the
+        // local-resolution clock so the mesh forwarder can distinguish "auto-approve just
+        // fired / is firing" (suppress the coordinator notification — modal is being resolved
+        // locally) from "auto-approve is merely configured but has not fired for this modal"
+        // (forward it so the coordinator is told and a task_approval_needed ledger row is
+        // created). Only stamp when the click actually MATCHED a button: resolveModalMatched
+        // maps the array position to the real FSM display index and reports whether a button
+        // was pressed, so a mis-mapped/never-pressed modal does NOT falsely mark itself
+        // locally-resolved (which would suppress the coordinator notification for a modal that
+        // never got answered — the exact blind spot). Legacy adapters keep the void resolveModal.
+        this.lastAutoApproveFiredAt = now;
         setTimeout(() => {
-            this.adapter.resolveModal(buttonIndex);
+            const adapter = this.adapter as {
+                resolveModalMatched?: (i: number) => boolean;
+                resolveModal?: (i: number) => void;
+            };
+            if (typeof adapter.resolveModalMatched === 'function') {
+                const matched = adapter.resolveModalMatched(buttonIndex);
+                if (!matched) {
+                    // Click did not land on any button — undo the local-resolution stamp so the
+                    // next agent:waiting_approval is FORWARDED to the coordinator/inbox rather
+                    // than suppressed as "resolved locally".
+                    if (this.lastAutoApproveFiredAt === now) this.lastAutoApproveFiredAt = 0;
+                    LOG.warn('CLI', `[${this.type}] auto-approve resolveModal matched no button (index ${buttonIndex}) — surfacing approval to coordinator`);
+                }
+            } else {
+                adapter.resolveModal?.(buttonIndex);
+            }
         }, 0);
         return autoApproveActive;
     }

package/src/providers/spec/cli-adapter.ts

@@ -204,8 +204,21 @@ export class SpecCliAdapter implements CliAdapter {
                 // modal this frame still stays waiting_approval (no activeModal yet).
                 // `kind` carries the semantic modal class through to the auto-approve
                 // gate so a /model picker (kind='picker') is never auto-answered.
+                // BUTTON-INDEX-MISMAP (Fix C.1): keep `buttons` as the label list every
+                // existing consumer (pickApprovalButton, mesh_approve, auto-approve) reads,
+                // but ALSO surface `buttonMeta` carrying each button's real FSM display index
+                // alongside its label. A partial/non-contiguous modal (display indices [1,3,4]
+                // at array positions [0,1,2]) then no longer loses the index → label mapping
+                // once it leaves the adapter: a consumer that has an array position can recover
+                // the true FSM index without re-parsing. resolveModal() below relies on the same
+                // ordered list to translate an array position to the correct FSM index.
                 activeModal: modal
-                    ? { message: modal.title ?? state.label, buttons: modal.buttons.map(b => b.label), kind: modal.kind ?? null }
+                    ? {
+                        message: modal.title ?? state.label,
+                        buttons: modal.buttons.map(b => b.label),
+                        buttonMeta: modal.buttons.map(b => ({ index: b.index, label: b.label })),
+                        kind: modal.kind ?? null,
+                    }
                     : null,
                 activeInteractivePrompt: this.activeInteractivePrompt,
                 ...sessionFields,
@@ -420,8 +433,29 @@ export class SpecCliAdapter implements CliAdapter {
     }
 
     resolveModal(buttonIndex: number): void {
-        // CliAdapter buttonIndex is 0-based; spec buttons are 1-based.
-        this.driver.dispatch({ kind: 'click_modal_button', index: buttonIndex + 1 });
+        this.resolveModalMatched(buttonIndex);
+    }
+
+    resolveModalMatched(buttonIndex: number): boolean {
+        // BUTTON-INDEX-MISMAP (Fix C): `buttonIndex` is an ARRAY POSITION into the
+        // label list this adapter surfaced via getStatus().activeModal.buttons (the
+        // same order pickApprovalButton / mesh_approve pick from). The FSM matches a
+        // click by the button's DISPLAYED number (evaluator sets button.index =
+        // Number(m[1])), which is NOT `arrayPos + 1` for a partial / non-contiguous
+        // modal — e.g. a "1. Yes / 3. Always / 4. No" set parses to display indices
+        // [1,3,4] at array positions [0,1,2]. Blindly sending `arrayPos + 1` then
+        // targets a non-existent display index (2) and handleClickModalButton finds
+        // no button → nothing is pressed. Look up the real FSM display index from the
+        // same ordered button list instead, and fall back to the legacy +1 only when
+        // no modal is captured (defensive; the driver's own guard rejects a miss).
+        const buttons = this.latestModal?.buttons ?? [];
+        const target = (buttonIndex >= 0 && buttonIndex < buttons.length)
+            ? buttons[buttonIndex].index
+            : buttonIndex + 1;
+        // clickModalButton returns whether the FSM actually found a button for `target`
+        // and dispatched its confirm keys — surfaced so mesh_approve can distinguish a
+        // real press from a silent miss (the exact false-success the mis-map produced).
+        return this.driver.clickModalButton(target);
     }
 
     async resolveAction(data: unknown): Promise<void> {

package/src/providers/spec/fsm-driver.ts

@@ -118,6 +118,13 @@ export interface ISpecDriver {
     subscribe(listener: (ev: DashboardEvent) => void): () => void;
     start(): void;
     dispatch(cmd: DashboardCommand): void;
+    /**
+     * BUTTON-INDEX-MISMAP (Fix C.3): click a modal button by its FSM display index and report
+     * whether a button was actually matched and its confirm keys dispatched. Unlike the
+     * fire-and-forget `dispatch('click_modal_button')`, callers that need to know the click
+     * landed (mesh_approve → SpecCliAdapter.resolveModalMatched) can observe a miss.
+     */
+    clickModalButton(index: number): boolean;
     updateMeta(meta: Record<string, unknown>, replace?: boolean): void;
     snapshot(): string;
     getCursorPosition(): { row: number; col: number };
@@ -428,7 +435,7 @@ export class FsmDriver implements ISpecDriver {
             case 'send_message': this.handleSendMessage(cmd.text); return;
             case 'pty_write': this.adapter.send_keys(cmd.data); return;
             case 'click_control': this.handleClickControl(cmd.control_id, cmd.payload); return;
-            case 'click_modal_button': this.handleClickModalButton(cmd.index); return;
+            case 'click_modal_button': this.clickModalButton(cmd.index); return;
             case 'attach_image': this.handleAttachImage(cmd.blob, cmd.mime); return;
             case 'resize': this.adapter.resize(cmd.cols, cmd.rows); return;
             case 'cancel': this.adapter.send_keys('\x03'); return;
@@ -1318,11 +1325,25 @@ export class FsmDriver implements ISpecDriver {
         }
     }
 
-    private handleClickModalButton(index: number): void {
+    /**
+     * BUTTON-INDEX-MISMAP (Fix C.3): public modal-click entry that returns whether a button
+     * matching the requested FSM display index was actually found and its confirm keys were
+     * dispatched. The old private handleClickModalButton silently `return`ed on a miss (no
+     * modal captured, or no button whose `.index` equals the requested display index), so a
+     * mis-mapped index looked identical to a successful press. Callers that need to know
+     * whether the click landed (mesh_approve → resolveModal) can now observe the miss instead
+     * of reporting success into the void. The generic `dispatch('click_modal_button')` path
+     * keeps ignoring the return (fire-and-forget UI clicks).
+     */
+    clickModalButton(index: number): boolean {
+        return this.handleClickModalButton(index);
+    }
+
+    private handleClickModalButton(index: number): boolean {
         const m = this.currentEval?.modal;
-        if (!m) return;
+        if (!m) return false;
         const btn = m.buttons.find(b => b.index === index);
-        if (!btn) return;
+        if (!btn) return false;
 
         const rule = stateById(this.spec, this.currentStateId)?.extract?.buttons;
         if (rule?.select_mode === 'arrow_keys') {
@@ -1343,9 +1364,10 @@ export class FsmDriver implements ISpecDriver {
             const confirm = (rule.key_for_index || '\r').replace(/\{index\}/g, '') || '\r';
             if (nav) this.adapter.send_keys(nav);
             this.submitModalConfirm(confirm);
-            return;
+            return true;
         }
         this.submitModalConfirm(btn.key);
+        return true;
     }
 
     /**