@adhdev/daemon-core 0.9.82-rc.7 → 0.9.82-rc.70

package/src/mesh/refine-config.ts

@@ -0,0 +1,306 @@
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import * as yaml from 'js-yaml';
+
+export const MESH_REFINE_VALIDATION_CATEGORIES = ['typecheck', 'test', 'lint', 'build'] as const;
+export type MeshRefineValidationCategory = typeof MESH_REFINE_VALIDATION_CATEGORIES[number];
+
+export interface RepoMeshRefineValidationCommandConfig {
+    /** Executable name or a whitespace-tokenized command string. Never executed through a shell. */
+    command: string;
+    /** Optional explicit argv. Prefer this over shell-like command strings. */
+    args?: string[];
+    category?: MeshRefineValidationCategory;
+    cwd?: string;
+    timeoutMs?: number;
+    env?: Record<string, string>;
+}
+
+export interface RepoMeshRefineConfig {
+    version: 1;
+    validation?: {
+        required?: boolean;
+        commands?: RepoMeshRefineValidationCommandConfig[];
+    };
+}
+
+export interface MeshRefineValidationCommandPlan {
+    command: string;
+    args: string[];
+    displayCommand: string;
+    category: MeshRefineValidationCategory | 'custom';
+    source: string;
+    cwd?: string;
+    timeoutMs?: number;
+    env?: Record<string, string>;
+}
+
+export interface MeshRefineConfigLoadResult {
+    config?: RepoMeshRefineConfig;
+    source: string;
+    sourceType: 'mesh_policy' | 'repo_file' | 'unavailable' | 'invalid';
+    path?: string;
+    error?: string;
+}
+
+export interface MeshRefineValidationPlan {
+    source: string;
+    sourceType: MeshRefineConfigLoadResult['sourceType'];
+    commands: MeshRefineValidationCommandPlan[];
+    rejectedCommands: Array<Record<string, unknown>>;
+    suggestions: RepoMeshRefineValidationCommandConfig[];
+    suggestedConfig?: RepoMeshRefineConfig;
+    unavailableReason?: string;
+}
+
+export const MESH_REFINE_CONFIG_LOCATIONS = [
+    '.adhdev/refine.json',
+    '.adhdev/refine.yaml',
+    '.adhdev/refine.yml',
+    '.adhdev/repo-mesh-refine.json',
+    '.adhdev/repo-mesh-refine.yaml',
+    '.adhdev/repo-mesh-refine.yml',
+    'repo-mesh.refine.json',
+    'repo-mesh.refine.yaml',
+    'repo-mesh.refine.yml',
+];
+
+export const MESH_REFINE_CONFIG_SCHEMA = {
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    title: 'ADHDev Repo Mesh Refinery Config',
+    type: 'object',
+    additionalProperties: false,
+    required: ['version'],
+    properties: {
+        version: { const: 1 },
+        validation: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                required: { type: 'boolean', default: true },
+                commands: {
+                    type: 'array',
+                    minItems: 1,
+                    maxItems: 8,
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['command'],
+                        properties: {
+                            command: { type: 'string', minLength: 1 },
+                            args: { type: 'array', items: { type: 'string' } },
+                            category: { enum: [...MESH_REFINE_VALIDATION_CATEGORIES, 'custom'] },
+                            cwd: { type: 'string' },
+                            timeoutMs: { type: 'number', minimum: 1000, maximum: 600000 },
+                            env: { type: 'object', additionalProperties: { type: 'string' } },
+                        },
+                    },
+                },
+            },
+        },
+    },
+} as const;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+function tokenizeCommandString(command: string): string[] | null {
+    const trimmed = command.trim();
+    if (!trimmed) return null;
+    // Explicit config may name any executable, but the Refinery never invokes a shell.
+    // Reject shell syntax, quotes and substitutions so config cannot smuggle a compound command.
+    if (/[;&|<>`$\\\n\r'\"]/.test(trimmed)) return null;
+    const tokens = trimmed.split(/\s+/).filter(Boolean);
+    if (!tokens.length) return null;
+    if (tokens.some(token => !/^[A-Za-z0-9_@./:=+-]+$/.test(token))) return null;
+    return tokens;
+}
+
+function validateCategory(value: unknown): MeshRefineValidationCategory | 'custom' {
+    return typeof value === 'string' && ([...MESH_REFINE_VALIDATION_CATEGORIES, 'custom'] as string[]).includes(value)
+        ? value as MeshRefineValidationCategory | 'custom'
+        : 'custom';
+}
+
+function normalizeCommandConfig(entry: unknown, source: string): { command?: MeshRefineValidationCommandPlan; rejected?: Record<string, unknown> } {
+    if (!isRecord(entry) || typeof entry.command !== 'string') {
+        return { rejected: { source, reason: 'validation command must be an object with a command string' } };
+    }
+
+    const commandText = entry.command.trim();
+    const explicitArgs = Array.isArray(entry.args) ? entry.args : undefined;
+    if (explicitArgs && !explicitArgs.every(arg => typeof arg === 'string')) {
+        return { rejected: { source, command: commandText, reason: 'args must be an array of strings' } };
+    }
+
+    let command = commandText;
+    let args = explicitArgs ? [...explicitArgs] : [];
+    if (!explicitArgs) {
+        const tokens = tokenizeCommandString(commandText);
+        if (!tokens) return { rejected: { source, command: commandText, reason: 'unsafe command string is not allowlisted' } };
+        command = tokens[0];
+        args = tokens.slice(1);
+    } else if (!tokenizeCommandString(command)) {
+        return { rejected: { source, command: commandText, reason: 'unsafe executable name is not allowlisted' } };
+    }
+
+    if (args.some(arg => /[\n\r\0]/.test(arg))) {
+        return { rejected: { source, command: commandText, reason: 'args cannot contain control characters' } };
+    }
+    if (entry.cwd !== undefined && typeof entry.cwd !== 'string') {
+        return { rejected: { source, command: commandText, reason: 'cwd must be a string when provided' } };
+    }
+    if (entry.timeoutMs !== undefined && (typeof entry.timeoutMs !== 'number' || !Number.isFinite(entry.timeoutMs) || entry.timeoutMs < 1000 || entry.timeoutMs > 600000)) {
+        return { rejected: { source, command: commandText, reason: 'timeoutMs must be between 1000 and 600000' } };
+    }
+    if (entry.env !== undefined && (!isRecord(entry.env) || !Object.values(entry.env).every(value => typeof value === 'string'))) {
+        return { rejected: { source, command: commandText, reason: 'env must be an object of string values' } };
+    }
+
+    return {
+        command: {
+            command,
+            args,
+            displayCommand: [command, ...args].join(' '),
+            category: validateCategory(entry.category),
+            source,
+            ...(typeof entry.cwd === 'string' && entry.cwd.trim() ? { cwd: entry.cwd.trim() } : {}),
+            ...(typeof entry.timeoutMs === 'number' ? { timeoutMs: entry.timeoutMs } : {}),
+            ...(isRecord(entry.env) ? { env: entry.env as Record<string, string> } : {}),
+        },
+    };
+}
+
+export function validateMeshRefineConfig(config: unknown, source = 'inline'): { valid: boolean; errors: string[]; commands: MeshRefineValidationCommandPlan[]; rejectedCommands: Array<Record<string, unknown>> } {
+    const errors: string[] = [];
+    const commands: MeshRefineValidationCommandPlan[] = [];
+    const rejectedCommands: Array<Record<string, unknown>> = [];
+
+    if (!isRecord(config)) return { valid: false, errors: ['config must be an object'], commands, rejectedCommands };
+    if (config.version !== 1) errors.push('version must be 1');
+    const validation = config.validation;
+    if (validation !== undefined && !isRecord(validation)) errors.push('validation must be an object');
+    const rawCommands = isRecord(validation) ? validation.commands : undefined;
+    if (rawCommands !== undefined && !Array.isArray(rawCommands)) errors.push('validation.commands must be an array');
+    if (Array.isArray(rawCommands)) {
+        rawCommands.forEach((entry, index) => {
+            const normalized = normalizeCommandConfig(entry, `${source}:validation.commands[${index}]`);
+            if (normalized.command) commands.push(normalized.command);
+            if (normalized.rejected) rejectedCommands.push(normalized.rejected);
+        });
+    }
+    if (rejectedCommands.length) errors.push('one or more validation commands are invalid');
+    return { valid: errors.length === 0, errors, commands, rejectedCommands };
+}
+
+function parseConfigText(path: string, text: string): unknown {
+    if (/\.json$/i.test(path)) return JSON.parse(text);
+    return yaml.load(text);
+}
+
+export function loadMeshRefineConfig(mesh: any, workspace: string): MeshRefineConfigLoadResult {
+    const policy = mesh?.policy && typeof mesh.policy === 'object' && !Array.isArray(mesh.policy) ? mesh.policy : {};
+    const inline = mesh?.refineConfig || (policy as any).refineConfig || (policy as any).refine;
+    if (inline !== undefined) {
+        const validation = validateMeshRefineConfig(inline, 'mesh.policy.refineConfig');
+        if (!validation.valid) return { source: 'mesh.policy.refineConfig', sourceType: 'invalid', error: String(validation.rejectedCommands[0]?.reason || validation.errors.join('; ')) };
+        return { config: inline as RepoMeshRefineConfig, source: 'mesh.policy.refineConfig', sourceType: 'mesh_policy' };
+    }
+
+    for (const relative of MESH_REFINE_CONFIG_LOCATIONS) {
+        const configPath = join(workspace, relative);
+        if (!existsSync(configPath)) continue;
+        try {
+            const parsed = parseConfigText(configPath, readFileSync(configPath, 'utf-8'));
+            const validation = validateMeshRefineConfig(parsed, relative);
+            if (!validation.valid) return { source: relative, sourceType: 'invalid', path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join('; ')) };
+            return { config: parsed as RepoMeshRefineConfig, source: relative, sourceType: 'repo_file', path: configPath };
+        } catch (error: any) {
+            return { source: relative, sourceType: 'invalid', path: configPath, error: error?.message || String(error) };
+        }
+    }
+
+    return {
+        source: 'unavailable',
+        sourceType: 'unavailable',
+        error: `No repo mesh/refine config found. Checked: ${MESH_REFINE_CONFIG_LOCATIONS.join(', ')}`,
+    };
+}
+
+function readPackageScripts(workspace: string): Record<string, string> {
+    try {
+        const parsed = JSON.parse(readFileSync(join(workspace, 'package.json'), 'utf-8'));
+        return isRecord(parsed?.scripts) ? parsed.scripts as Record<string, string> : {};
+    } catch {
+        return {};
+    }
+}
+
+function collectProjectContextSuggestions(mesh: any): RepoMeshRefineValidationCommandConfig[] {
+    const commands = mesh?.projectContext?.commands;
+    if (!isRecord(commands)) return [];
+    const suggestions: RepoMeshRefineValidationCommandConfig[] = [];
+    for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
+        const entries = Array.isArray(commands[category]) ? commands[category] : [];
+        for (const entry of entries) {
+            if (isRecord(entry) && typeof entry.command === 'string') suggestions.push({ command: entry.command, category });
+        }
+    }
+    return suggestions;
+}
+
+function collectPackageScriptSuggestions(workspace: string): RepoMeshRefineValidationCommandConfig[] {
+    const scripts = readPackageScripts(workspace);
+    const suggestions: RepoMeshRefineValidationCommandConfig[] = [];
+    for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
+        for (const scriptName of Object.keys(scripts)) {
+            if (scriptName === category || scriptName.startsWith(`${category}:`)) {
+                suggestions.push({ command: 'npm', args: ['run', scriptName], category });
+            }
+        }
+    }
+    return suggestions;
+}
+
+export function suggestMeshRefineConfig(mesh: any, workspace: string): { suggestions: RepoMeshRefineValidationCommandConfig[]; suggestedConfig?: RepoMeshRefineConfig } {
+    const seen = new Set<string>();
+    const suggestions: RepoMeshRefineValidationCommandConfig[] = [];
+    for (const entry of [...collectProjectContextSuggestions(mesh), ...collectPackageScriptSuggestions(workspace)]) {
+        const key = `${entry.command} ${(entry.args || []).join(' ')}`.trim();
+        if (seen.has(key)) continue;
+        seen.add(key);
+        suggestions.push(entry);
+    }
+    return {
+        suggestions,
+        suggestedConfig: suggestions.length ? { version: 1, validation: { required: true, commands: suggestions.slice(0, 4) } } : undefined,
+    };
+}
+
+export function resolveMeshRefineValidationPlan(mesh: any, workspace: string): MeshRefineValidationPlan {
+    const loaded = loadMeshRefineConfig(mesh, workspace);
+    const suggestion = suggestMeshRefineConfig(mesh, workspace);
+    if (!loaded.config) {
+        return {
+            source: loaded.source,
+            sourceType: loaded.sourceType,
+            commands: [],
+            rejectedCommands: loaded.error ? [{ source: loaded.source, reason: loaded.error }] : [],
+            suggestions: suggestion.suggestions,
+            suggestedConfig: suggestion.suggestedConfig,
+            unavailableReason: loaded.error || 'validation_unavailable: repo mesh/refine config missing',
+        };
+    }
+
+    const validation = validateMeshRefineConfig(loaded.config, loaded.source);
+    return {
+        source: loaded.path || loaded.source,
+        sourceType: loaded.sourceType,
+        commands: validation.commands,
+        rejectedCommands: validation.rejectedCommands,
+        suggestions: suggestion.suggestions,
+        suggestedConfig: suggestion.suggestedConfig,
+        unavailableReason: validation.commands.length ? undefined : 'validation_unavailable: repo mesh/refine config has no validation.commands',
+    };
+}

package/src/providers/chat-message-normalization.ts

@@ -1,9 +1,11 @@
 import type { ChatMessage } from '../types.js';
 import { flattenContent } from './contracts.js';
 
+export const DEFAULT_FINAL_SUMMARY_MAX_CHARS = 4_000;
+
 export function extractFinalSummaryFromMessages(
   messages: ChatMessage[] | null | undefined,
-  maxChars: number = 500,
+  maxChars: number = DEFAULT_FINAL_SUMMARY_MAX_CHARS,
 ): string {
   if (!Array.isArray(messages) || messages.length === 0) return '';
 

package/src/providers/cli-provider-instance.ts

@@ -743,6 +743,55 @@ export class CliProviderInstance implements ProviderInstance {
         return role === 'assistant' && !!content;
     }
 
+    private buildCompletedFinalizationDiagnostic(args: {
+        blockReason: string;
+        latestStatus?: any;
+        latestVisibleStatus: string;
+        waitedMs: number;
+        pending: CompletedDebouncePending;
+        emittedAfterFinalizationTimeout: boolean;
+    }): Record<string, unknown> {
+        let parsed: any = null;
+        let parseError: string | undefined;
+        try {
+            parsed = this.adapter.getScriptParsedStatus();
+        } catch (error: any) {
+            parseError = error?.message || String(error);
+        }
+
+        const visibleMessages = (Array.isArray(parsed?.messages) ? parsed.messages : [])
+            .filter((message: any) => isUserFacingChatMessage(message as ChatMessage));
+        const lastVisible = visibleMessages[visibleMessages.length - 1] as ChatMessage | undefined;
+        const lastVisibleRole = typeof lastVisible?.role === 'string' ? lastVisible.role.trim().toLowerCase() : null;
+        const lastVisibleKind = typeof (lastVisible as any)?.kind === 'string' ? (lastVisible as any).kind : null;
+        const lastVisibleContentLength = lastVisible ? flattenContent(lastVisible.content).trim().length : 0;
+
+        return {
+            providerType: this.type,
+            sessionId: this.instanceId,
+            providerSessionId: this.providerSessionId || null,
+            workspace: this.workingDir,
+            blockReason: args.blockReason,
+            emittedAfterFinalizationTimeout: args.emittedAfterFinalizationTimeout,
+            waitedMs: args.waitedMs,
+            maxWaitMs: COMPLETED_FINALIZATION_MAX_WAIT_MS,
+            adapterStatus: typeof args.latestStatus?.status === 'string' ? args.latestStatus.status : null,
+            latestVisibleStatus: args.latestVisibleStatus,
+            parsedStatus: typeof parsed?.status === 'string' ? parsed.status : (parseError ? 'parse_error' : 'unknown'),
+            parseError: parseError || undefined,
+            finalAssistantPresent: this.completionHasFinalAssistantMessage(parsed?.messages),
+            visibleMessageCount: visibleMessages.length,
+            lastVisibleRole,
+            lastVisibleKind,
+            lastVisibleContentLength,
+            pendingStartedAt: this.generatingStartedAt || null,
+            pendingFirstObservedAt: args.pending.firstObservedAt,
+            pendingTimestamp: args.pending.timestamp,
+            pendingDurationSec: args.pending.duration,
+            previousBlockReason: args.pending.loggedBlockReason || null,
+        };
+    }
+
     private hasAdapterPendingResponse(): boolean {
         const adapterAny = this.adapter as any;
         if (adapterAny?.isWaitingForResponse === true) return true;
@@ -828,7 +877,23 @@ export class CliProviderInstance implements ProviderInstance {
                 this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
                 return;
             }
-            LOG.warn('CLI', `[${this.type}] suppressed completed event after ${waitedMs}ms without finalized assistant turn (${blockReason})`);
+            const completionDiagnostic = this.buildCompletedFinalizationDiagnostic({
+                blockReason,
+                latestStatus,
+                latestVisibleStatus,
+                waitedMs,
+                pending,
+                emittedAfterFinalizationTimeout: true,
+            });
+            LOG.warn('CLI', `[${this.type}] emitting completed event after ${waitedMs}ms without finalized assistant turn (${blockReason})`);
+            this.pushEvent({
+                event: 'agent:generating_completed',
+                chatTitle: pending.chatTitle,
+                duration: pending.duration,
+                timestamp: pending.timestamp,
+                finalSummary: extractFinalSummaryFromMessages(this.adapter?.getScriptParsedStatus()?.messages),
+                completionDiagnostic,
+            });
             this.completedDebouncePending = null;
             this.completedDebounceTimer = null;
             this.generatingStartedAt = 0;

package/src/providers/ide-provider-instance.ts

@@ -43,6 +43,20 @@ type ReadChatPayload = {
     [key: string]: unknown;
 };
 
+async function withTimeout<T>(promise: Promise<T>, timeoutMs: number, label: string): Promise<T> {
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise<never>((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs);
+            }),
+        ]);
+    } finally {
+        if (timer) clearTimeout(timer);
+    }
+}
+
 export class IdeProviderInstance implements ProviderInstance {
     readonly type: string;
     readonly category = 'ide' as const;
@@ -320,7 +334,7 @@ export class IdeProviderInstance implements ProviderInstance {
                 if (webviewScript) {
                     const matchText = this.provider.webviewMatchText;
                     const matchFn = matchText ? (body: string) => body.includes(matchText) : undefined;
-                    const webviewRaw = await cdp.evaluateInWebviewFrame(webviewScript, matchFn);
+                    const webviewRaw = await withTimeout(cdp.evaluateInWebviewFrame(webviewScript, matchFn), 30000, 'evaluateInWebviewFrame');
                     if (webviewRaw) {
                         raw = typeof webviewRaw === 'string' ? (() => { try { return JSON.parse(webviewRaw); } catch { return null; } })() : webviewRaw;
                     }
@@ -331,7 +345,7 @@ export class IdeProviderInstance implements ProviderInstance {
             if (!raw) {
                 const readChatScript = this.getReadChatScript();
                 if (!readChatScript) return;
-                raw = await cdp.evaluate(readChatScript, 30000);
+                raw = await withTimeout(cdp.evaluate(readChatScript, 30000), 30000, 'evaluate.readChatScript');
                 if (typeof raw === 'string') {
                     try { raw = JSON.parse(raw); } catch { return; }
                 }
@@ -706,7 +720,7 @@ export class IdeProviderInstance implements ProviderInstance {
             );
 
             LOG.info('IdeInstance', `[IdeInstance:${this.type}] autoApprove: executing resolveAction for "${targetButton}"`);
-            let rawResult = await cdp.evaluate(script, 10000);
+            let rawResult = await withTimeout(cdp.evaluate(script, 10000), 10000, 'evaluate.autoApprove');
             if (typeof rawResult === 'string') {
                 try { rawResult = JSON.parse(rawResult); } catch { }
             }

package/src/providers/provider-loader.ts

@@ -1067,13 +1067,17 @@ export class ProviderLoader {
           awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 },
         });
 
+        let reloadTimer: ReturnType<typeof setTimeout> | null = null;
         const handleChange = (filePath: string) => {
           if (/[\/\\]fixtures[\/\\]/.test(filePath)) {
             return;
           }
           if (filePath.endsWith('.js') || filePath.endsWith('.json')) {
-            this.log(`File changed: ${path.basename(filePath)}, reloading...`);
-            this.reload();
+            if (reloadTimer) clearTimeout(reloadTimer);
+            reloadTimer = setTimeout(() => {
+              this.log(`File changed: ${path.basename(filePath)}, reloading...`);
+              this.reload();
+            }, 300);
           }
         };
 
@@ -1130,7 +1134,9 @@ export class ProviderLoader {
       return { updated: false };
     }
     const https = require('https') as typeof import('https');
-    const { execSync } = require('child_process') as typeof import('child_process');
+    const { exec } = require('child_process') as typeof import('child_process');
+    const { promisify } = require('util');
+    const execAsync = promisify(exec);
 
     const metaPath = path.join(this.upstreamDir, ProviderLoader.META_FILE);
     let prevEtag = '';
@@ -1207,7 +1213,7 @@ export class ProviderLoader {
 
  // Extract
       fs.mkdirSync(tmpExtract, { recursive: true });
-      execSync(`tar -xzf "${tmpTar}" -C "${tmpExtract}"`, { timeout: 30000 });
+      await execAsync(`tar -xzf "${tmpTar}" -C "${tmpExtract}"`, { timeout: 30000 });
 
  // Tarball internal structure: adhdev-providers-main/ide/... → strip 1 level
       const extracted = fs.readdirSync(tmpExtract);

package/src/providers/version-archive.ts

@@ -12,7 +12,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { execSync } from 'child_process';
+// Removed execSync import
 import { platform } from 'os';
 import type { ProviderLoader } from './provider-loader.js';
 import type { ProviderModule } from './contracts.js';
@@ -117,22 +117,40 @@ export class VersionArchive {
 
 // ─── Version Detection ──────────────────────────────
 
-function runCommand(cmd: string, timeout = 10000): string | null {
-  try {
-    return execSync(cmd, {
+import { exec } from 'child_process';
+
+async function runCommand(cmd: string, timeout = 10000): Promise<string | null> {
+  return new Promise((resolve) => {
+    exec(cmd, {
       encoding: 'utf-8',
       timeout,
-      stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
-  } catch {
-    return null;
-  }
+    }, (error, stdout) => {
+      if (error) return resolve(null);
+      resolve(stdout.trim());
+    });
+  });
 }
 
 function findBinary(name: string): string | null {
-  const cmd = platform() === 'win32' ? `where ${name}` : `which ${name}`;
-  const result = runCommand(cmd, 5000);
-  return result ? result.split('\n')[0] : null;
+  const isWin = platform() === 'win32';
+  const paths = (process.env.PATH || '').split(isWin ? ';' : ':');
+  const exes = isWin ? ['.exe', '.cmd', '.bat', ''] : [''];
+  
+  for (const p of paths) {
+    if (!p) continue;
+    for (const ext of exes) {
+      const fullPath = path.join(p, name + ext);
+      try {
+        if (fs.existsSync(fullPath)) {
+          const stat = fs.statSync(fullPath);
+          if (stat.isFile() && (isWin || (stat.mode & 0o111))) {
+            return fullPath;
+          }
+        }
+      } catch { }
+    }
+  }
+  return null;
 }
 
 /** Extract version string from CLI output */
@@ -162,16 +180,16 @@ function getPlatformVersionCommand(
   return undefined;
 }
 
-function getVersion(binary: string, versionCommand?: string): string | null {
+async function getVersion(binary: string, versionCommand?: string): Promise<string | null> {
   // Custom version command from provider.json
   if (versionCommand) {
-    const raw = runCommand(versionCommand);
+    const raw = await runCommand(versionCommand);
     return raw ? parseVersion(raw) : null;
   }
 
   // Default: try --version, then -V, then -v
   for (const flag of ['--version', '-V', '-v']) {
-    const raw = runCommand(`"${binary}" ${flag}`);
+    const raw = await runCommand(`"${binary}" ${flag}`);
     if (raw && raw.length < 500) return parseVersion(raw);
   }
   return null;
@@ -191,11 +209,11 @@ function checkPathExists(paths: string[]): string | null {
 }
 
 /** macOS: Get app version from Info.plist */
-function getMacAppVersion(appPath: string): string | null {
+async function getMacAppVersion(appPath: string): Promise<string | null> {
   if (platform() !== 'darwin' || !appPath.endsWith('.app')) return null;
   const plistPath = path.join(appPath, 'Contents', 'Info.plist');
   if (!fs.existsSync(plistPath)) return null;
-  const raw = runCommand(`/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "${plistPath}"`);
+  const raw = await runCommand(`/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "${plistPath}"`);
   return raw || null;
 }
 
@@ -242,10 +260,10 @@ export async function detectAllVersions(
 
       // Version: try CLI first, then plist
       if (resolvedBin) {
-        info.version = getVersion(resolvedBin, versionCommand);
+        info.version = await getVersion(resolvedBin, versionCommand);
       }
       if (!info.version && appPath) {
-        info.version = getMacAppVersion(appPath);
+        info.version = await getMacAppVersion(appPath);
       }
 
     } else if (provider.category === 'cli' || provider.category === 'acp') {
@@ -256,7 +274,7 @@ export async function detectAllVersions(
       info.binary = binPath || null;
 
       if (binPath) {
-        info.version = getVersion(binPath, versionCommand);
+        info.version = await getVersion(binPath, versionCommand);
       }
 
     } else if (provider.category === 'extension') {