@adhdev/daemon-core 1.0.18-rc.1 → 1.0.18-rc.10

package/dist/mesh/coordinator-prompt.d.ts

@@ -68,6 +68,41 @@ export interface CoordinatorOperatingNote {
     category?: 'provider_quirk' | 'pattern_to_avoid' | 'recovery_lesson';
     createdAt?: string;
     sourceCoordinator?: string;
+    /**
+     * Operating-notes lifecycle (minimal first cut). When true the note ALWAYS
+     * rides into the coordinator prompt — it is never dropped by TTL expiry and
+     * survives the injection cap ahead of unpinned notes. Legacy notes without
+     * this field default to false.
+     */
+    pinned?: boolean;
+    /**
+     * Optional explicit expiry ISO timestamp. When set and in the past, an
+     * UNPINNED note is dropped from the injected prompt (read-side only — the
+     * ledger entry is never pruned by age). When absent, the category→TTL map
+     * (see isNoteExpired) governs expiry; pinned notes never expire regardless.
+     */
+    expiresAt?: string;
+    /**
+     * Phase 2 — the ledger id of this note, when known. Threaded from the ledger
+     * entry id at launch so version-supersede can target a specific note and
+     * same-class folding can list the subsumed ids. Repo-declared notes may lack
+     * one; absent is fine (folding/supersede fall back to the subject key).
+     */
+    noteId?: string;
+    /**
+     * Phase 2 (b) version-supersede — an optional note-id or stable subject-key
+     * this note replaces. At injection, any earlier LIVE note whose `noteId` or
+     * `subjectKey` matches this value is hidden from the prompt (the ledger entry
+     * is retained for audit). Optional and lossless: absent = supersedes nothing.
+     */
+    supersedes?: string;
+    /**
+     * Phase 2 (b)/(c) — an optional stable subject-key grouping notes about the
+     * same subject. Drives version-supersede targeting and same-class folding.
+     * When absent, folding derives a key from a leading `[tag]` bracket instead,
+     * so legacy notes still collapse by their conventional tag prefix.
+     */
+    subjectKey?: string;
 }
 export interface CoordinatorPromptContext {
     mesh: LocalMeshEntry;
@@ -102,6 +137,46 @@ export interface CoordinatorPromptContext {
     magiKindPanels?: MagiKindPanelMap;
 }
 export declare function buildCoordinatorSystemPrompt(ctx: CoordinatorPromptContext): string;
+/**
+ * Phase 2 (c) — deterministic same-class fold. Given ranked notes (already
+ * highest-priority first), collapse runs of UNPINNED notes that share the same
+ * category AND subject key into a single injected entry: keep the highest-ranked
+ * (first-seen) note and record the note-ids/count it subsumes so the rendered
+ * line can say "(+N earlier)". Pinned notes never fold — each pinned note is
+ * author-opted-in and shown verbatim. The store is untouched; this is a pure,
+ * model-free text fold at injection time.
+ *
+ * Returns the folded note list (order preserved) with per-entry subsumed info.
+ */
+interface FoldedNote {
+    note: CoordinatorOperatingNote;
+    /** note-ids of same-class notes this entry subsumes (may be empty). */
+    subsumedIds: string[];
+    /** count of subsumed notes (== subsumedIds.length, but counts id-less ones too). */
+    subsumedCount: number;
+}
+/**
+ * Operating-notes lifecycle selection (read-side). Given the effective notes
+ * (oldest-first, ledger order) and the current time, produce the ordered list
+ * that rides into the prompt:
+ *   (i)    ALWAYS include pinned notes.
+ *   (ii)   drop expired UNPINNED notes (per category TTL / explicit expiresAt).
+ *   (iii)  Phase 2 (b) drop any note SUPERSEDED by a later live note (by noteId
+ *          or subjectKey); pinned notes are never dropped by supersede.
+ *   (iv)   rank pinned-first, then durable-category, then recency (newest first).
+ *   (v)    Phase 2 (c) fold same-category/same-subject unpinned runs into one.
+ *   (vi)   Phase 2 (d) fill up to a byte budget AND a count cap; pinned always
+ *          kept even if they alone exceed the byte budget.
+ * Pure + deterministic given `now`. Returns { shown, omittedCount } where `shown`
+ * carries per-entry fold info for the renderer.
+ *
+ * Ranking is stable on the original ledger index so, within a tier, newest notes
+ * lead. The caps keep the leading (highest-priority) entries.
+ */
+export declare function selectOperatingNotesForPrompt(notes: CoordinatorOperatingNote[], now: number, cap?: number, byteBudget?: number): {
+    shown: FoldedNote[];
+    omittedCount: number;
+};
 /**
  * Render the machine-local MAGI kind-panel bindings so the coordinator KNOWS
  * which cross-verification panels (rca / design / claim_audit / freeform) are
@@ -114,3 +189,4 @@ export declare function buildCoordinatorSystemPrompt(ctx: CoordinatorPromptConte
  * That keeps a MAGI-less mesh's prompt byte-identical to before.
  */
 export declare function buildMagiKindPanelsSection(panels: MagiKindPanelMap | undefined | null): string | null;
+export {};

package/dist/mesh/mesh-disk-retention.d.ts

@@ -0,0 +1,105 @@
+import type { SessionHostSurfaceRecordLike } from '../session-host/runtime-surface.js';
+import type { LocalMeshEntry } from '../repo-mesh-types.js';
+export declare const DAY_MS: number;
+/** JSONL ledger files are legacy after the SQLite ledger — 30-day lifetime. */
+export declare const LEDGER_JSONL_MAX_AGE_MS: number;
+/** Terminated session-host runtimes: conservative 14-day retention. */
+export declare const SESSION_HOST_RUNTIME_MAX_AGE_MS: number;
+/** mesh-runtime.db.bak-* backups: 7-day retention. */
+export declare const DB_BAK_MAX_AGE_MS: number;
+/** A file candidate for age-based pruning: absolute path + last-modified epoch ms. */
+export interface AgedFile {
+    path: string;
+    mtimeMs: number;
+}
+/**
+ * PURE. Select the JSONL ledger files whose mtime is older than `maxAgeMs`
+ * relative to `now`. A file exactly at the threshold is KEPT (strict `>`), so a
+ * 30-day-old file survives its 30th day and is pruned on the 31st. Deterministic:
+ * no fs access, no clock read.
+ */
+export declare function selectExpiredLedgerJsonl(files: AgedFile[], now: number, maxAgeMs?: number): AgedFile[];
+/** A parsed session-host runtime file: its path, mtime, and the wrapped record. */
+export interface SessionHostRuntimeFile {
+    path: string;
+    mtimeMs: number;
+    /** The `record` object from the on-disk `{ record, snapshot, updatedAt }` file. */
+    record: SessionHostSurfaceRecordLike | null;
+}
+/**
+ * PURE. Select the session-host runtime files safe to delete: ONLY those whose
+ * runtime is terminated/dead (NOT a live runtime — decided by the session-host-core
+ * SSOT `isSessionHostLiveRuntime`) AND older than `maxAgeMs`. A live runtime, or a
+ * dead-but-recent one, is always kept. A file whose record failed to parse is treated
+ * as NON-live but is still age-gated, so a corrupt-but-fresh file is never removed.
+ */
+export declare function selectExpiredSessionHostRuntimes(files: SessionHostRuntimeFile[], now: number, maxAgeMs?: number): SessionHostRuntimeFile[];
+/** True for a `mesh-runtime.db.bak-*` backup filename (basename only). */
+export declare function isDbBackupFileName(name: string): boolean;
+/** PURE. Select `.bak-*` backups older than `maxAgeMs`. Strict `>` (see ledger). */
+export declare function selectExpiredDbBackups(files: AgedFile[], now: number, maxAgeMs?: number): AgedFile[];
+/** Minimal shape needed to decide whether a worktree path is orphaned. */
+export interface WorktreePathLike {
+    path: string;
+    bare?: boolean;
+}
+/** A live mesh node's known workspace paths (self workspace + repoRoot, normalized). */
+export interface LiveNodeWorkspaceLike {
+    workspace?: string;
+    repoRoot?: string;
+}
+/**
+ * PURE. Given the worktrees git reports on disk and the set of live-node workspace
+ * paths, return the worktrees that have NO matching live node — the orphan
+ * cleanup_candidates.
+ *
+ * SAFETY:
+ *  - `mainWorktreePath` (the primary repo checkout, i.e. worktree[0]) is NEVER an
+ *    orphan — it is the base repo, not a mesh clone.
+ *  - `bare` worktrees are skipped (git's internal bookkeeping, not a node checkout).
+ *  - Matching is path-equality after trailing-separator normalization against the
+ *    union of every live node's `workspace` and `repoRoot`.
+ * This is DETECTION ONLY — the caller signals a cleanup_candidate; it must not delete.
+ */
+export declare function detectOrphanWorktrees(worktrees: WorktreePathLike[], liveNodes: LiveNodeWorkspaceLike[], mainWorktreePath: string): WorktreePathLike[];
+/**
+ * Prune expired legacy JSONL ledger files under ~/.adhdev/mesh-ledger/.
+ * Matches only `*.jsonl` (never the SQLite .db / -wal / -shm files). Returns the
+ * count deleted. Best-effort: individual unlink failures are logged, not thrown.
+ */
+export declare function pruneExpiredLedgerJsonl(now?: number): number;
+/**
+ * Prune expired `mesh-runtime.db.bak-*` backups under ~/.adhdev/mesh-ledger/.
+ * Never touches the live DB (only names matching the .bak- prefix). Returns count.
+ */
+export declare function pruneExpiredDbBackups(now?: number): number;
+/**
+ * Prune terminated session-host runtime files older than 14 days across every
+ * ~/.adhdev/session-host/<app>/runtimes/ directory. A LIVE runtime is never deleted
+ * regardless of age (isSessionHostLiveRuntime SSOT). Returns count deleted.
+ */
+export declare function pruneExpiredSessionHostRuntimes(now?: number): number;
+/**
+ * Run the file-deleting retention passes (JSONL ledger, DB backups, session-host
+ * runtimes) once. Each pass is isolated so one failing pass never blocks the others.
+ * Orphan-worktree DETECTION is driven separately in the reconcile loop (it needs the
+ * live mesh config + git worktree list and emits a ledger signal rather than deleting).
+ */
+export declare function runDiskRetentionSweep(now?: number): {
+    ledgerJsonl: number;
+    dbBackups: number;
+    sessionHostRuntimes: number;
+};
+/**
+ * Detect orphaned worktrees for ONE mesh and emit a `worktree_cleanup_candidate`
+ * ledger signal for each — DETECTION ONLY, never deletes. An orphan is a git worktree
+ * on disk with no matching live mesh node (compared by path). It:
+ *   1. picks a base (non-worktree) node owned by this mesh to anchor `git worktree list`;
+ *   2. diffs the reported worktrees against the union of every node's workspace/repoRoot;
+ *   3. skips the main worktree + bare entries (detectOrphanWorktrees safety);
+ *   4. suppresses a repeat for a worktreePath already signalled within the recent window
+ *      (idempotent re-emit guard), so the hourly sweep doesn't spam the ledger.
+ * Returns the list of newly-signalled orphan paths. Best-effort: git/ledger failures are
+ * logged and yield an empty result, never thrown.
+ */
+export declare function detectAndSignalOrphanWorktrees(mesh: LocalMeshEntry, now?: number): Promise<string[]>;

package/dist/mesh/mesh-ledger.d.ts

@@ -15,7 +15,7 @@
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { type MeshLedgerOriginatingCoordinatorV2 } from './contracts.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection' | 'worktree_cleanup_candidate';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;
@@ -162,6 +162,33 @@ export declare const OPERATING_NOTE_KIND: MeshLedgerKind;
 export declare const OPERATING_NOTE_TOMBSTONE_KIND: MeshLedgerKind;
 export declare const OPERATING_NOTE_DEDUPE_WINDOW = 40;
 export declare const OPERATING_NOTE_KEEP_LATEST = 100;
+export declare const OPERATING_NOTE_CATEGORY_TTL_DAYS: Readonly<Record<string, number>>;
+/**
+ * Shape isNoteExpired reads. Structural so mesh-ledger stays free of a
+ * coordinator-prompt import (CoordinatorOperatingNote satisfies this).
+ */
+export interface OperatingNoteExpiryInput {
+    category?: string;
+    pinned?: boolean;
+    createdAt?: string;
+    /** Explicit expiry override; wins over the category TTL when parseable. */
+    expiresAt?: string;
+    /** Fallback creation time (ledger entry timestamp) when createdAt absent. */
+    timestamp?: string;
+}
+/**
+ * Pure helper: is this UNPINNED operating note expired as of `now` (epoch ms)?
+ *
+ * Rules:
+ *  - pinned notes NEVER expire (always false).
+ *  - an explicit, parseable `expiresAt` in the past → expired.
+ *  - otherwise the category TTL applies; a durable category (provider_quirk,
+ *    uncategorized, or any category not in the TTL map) never expires.
+ *  - age is measured from createdAt, falling back to `timestamp` (ledger entry
+ *    time). If neither is a valid date, the note is treated as NOT expired
+ *    (never silently drop a note we cannot age).
+ */
+export declare function isNoteExpired(note: OperatingNoteExpiryInput, now: number): boolean;
 export declare function getLedgerDir(): string;
 /**
  * Footer to append to worker task messages so workers output structured results

package/dist/mesh/mesh-runtime-store.d.ts

@@ -23,6 +23,17 @@ export declare class MeshRuntimeStore {
     private static loggedGetInstanceFailure;
     static getInstance(): MeshRuntimeStore;
     static resetForTests(): void;
+    /**
+     * VACUUM the SQLite database to reclaim on-disk space. Retention prunes rows
+     * with DELETE, which frees pages inside the file but does NOT shrink it — the
+     * mesh-runtime.db grew to hundreds of MB (mission 86def38d disk-accumulation
+     * bootstrap failure) precisely because the file was never compacted. This
+     * rewrites the DB into a minimal footprint. Best-effort: a VACUUM failure (e.g.
+     * insufficient temp space, a read lock) is logged and swallowed so it can never
+     * block daemon shutdown. Called once on shutdown (see daemon-lifecycle), never
+     * on the hot path — VACUUM takes an exclusive lock and rewrites the whole file.
+     */
+    vacuum(): void;
     close(): void;
     transaction<T>(fn: () => T): T;
     private migrate;

package/dist/providers/cli-provider-instance-types.d.ts

@@ -39,6 +39,8 @@ export declare const COMPLETED_FINALIZATION_RETRY_MS = 1000;
 export declare const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30000;
 export declare const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
 export declare const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
+export declare const ANTIGRAVITY_HOLD_QUIET_DWELL_MS = 3000;
+export declare const ANTIGRAVITY_HOLD_HARD_CAP_MS: number;
 export declare const BACKGROUND_TASK_HOLD_MAX_MS: number;
 export declare const USER_INPUT_ACK_DEDUP_WINDOW_MS = 60000;
 export declare const STARTUP_GRACE_IDLE_COLLAPSE_WINDOW_MS = 12000;

package/dist/providers/cli-provider-instance.d.ts

@@ -201,6 +201,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private generatingDebounceTimer;
     private generatingDebouncePending;
     private lastApprovalEventFingerprint;
+    private lastInteractivePromptEventKey;
     private autoApproveBusy;
     private autoApproveBusyTimer;
     private lastAutoApprovalSignature;
@@ -473,6 +474,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private completionFinalSummary;
     private buildCompletedFinalizationDiagnostic;
     private hasAdapterPendingResponse;
+    private antigravityHoldPtyStillActive;
     private shouldSuppressStaleParsedBusyStatus;
     private getCompletedFinalizationBlock;
     private hasApprovalResolutionEvidence;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.1",
+  "version": "1.0.18-rc.10",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.1",
-    "@adhdev/session-host-core": "1.0.18-rc.1",
+    "@adhdev/mesh-shared": "1.0.18-rc.10",
+    "@adhdev/session-host-core": "1.0.18-rc.10",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/boot/daemon-lifecycle.ts

@@ -39,6 +39,7 @@ import type { IdeProviderInstance } from '../providers/ide-provider-instance.js'
 import { createDefaultGitCommandServices } from '../git/git-commands.js';
 import { setupMeshEventForwarding } from '../mesh/mesh-events.js';
 import { setupMeshReconcileLoop } from '../mesh/mesh-reconcile-loop.js';
+import { MeshRuntimeStore } from '../mesh/mesh-runtime-store.js';
 import { loadMeshCoordinatorRegistry } from '../mesh/coordinator-registry.js';
 import { applyProcessHardening } from './process-hardening.js';
 import { installProviderProcessShim } from '../providers/sdk/v1/sandbox/require-whitelist.js';
@@ -503,4 +504,13 @@ export async function shutdownDaemonComponents(components: DaemonComponents): Pr
         try { m.disconnect(); } catch { /* noop */ }
     }
     cdpManagers.clear();
+
+    // 7. VACUUM the mesh runtime DB. Retention prunes rows with DELETE (frees pages
+    // inside the file but never shrinks it); the mesh-runtime.db grew to hundreds of
+    // MB (mission 86def38d disk-accumulation bootstrap failure) because it was never
+    // compacted. Do this LAST, after all writers (reconcile loop, CLIs, instances)
+    // are stopped, so nothing contends for the exclusive VACUUM lock. Best-effort —
+    // vacuum() swallows its own errors; the try/catch guards the getInstance() throw
+    // when the store never opened (degraded JSONL-only mode).
+    try { MeshRuntimeStore.getInstance().vacuum(); } catch { /* store unavailable — nothing to vacuum */ }
 }

package/src/cli-adapters/cli-state-engine.ts

@@ -86,6 +86,18 @@ interface IdleFinishCandidate {
     assistantLength: number;
 }
 
+/**
+ * Minimal shape computeApprovalContentSignature / isStaleResolvedApproval
+ * actually need — deliberately narrower than the full CliBufferSnapshot so
+ * callers outside the settled-eval loop (e.g. the adapter's startup-gate
+ * modal parse in getStatus/getDebugState) can supply just these two fields
+ * without having to fabricate an entire snapshot.
+ */
+interface ApprovalSignatureSnapshot {
+    screenText?: string;
+    accumulatedBuffer?: string;
+}
+
 interface SettledEvalContext {
     now: number;
     modal: { message: string; buttons: string[] } | null;
@@ -155,6 +167,22 @@ export class CliStateEngine {
     // ── Approval ─────────────────────────────────────
     lastApprovalResolvedAt = 0;
     lastResolvedModalMessage = '';
+    /**
+     * Normalized approval-context signature captured at resolve time (see
+     * `computeApprovalContentSignature`) — the screen text with blank-line
+     * padding and any manifest-declared chrome (transcriptPty.chromePatterns,
+     * spinner.patterns) stripped out. Used by applyWaitingApproval's
+     * isStaleResolvedRepaint check to tell "the same already-answered modal,
+     * re-parsed from a screen that has not meaningfully changed" apart from
+     * "a genuinely new approval" — content-based, not time-based, because
+     * ordinary TUI chrome (status bar, context meter, blank-line repaint)
+     * keeps producing fresh PTY bytes on an otherwise-unchanged screen and
+     * defeats any output-timestamp discriminator within a few hundred ms.
+     * Cleared whenever a turn starts or the session tears down (see
+     * onTurnStarted / resetActiveTurnState / onPtyExit) so a next-turn
+     * approval is never compared against stale prior-turn state.
+     */
+    lastApprovalResolvedContentSignature = '';
     /**
      * Monotonic counter bumped every time the FSM *enters* waiting_approval
      * with a freshly captured modal (see `applyWaitingApproval`). It is the
@@ -304,12 +332,46 @@ export class CliStateEngine {
         // anchor its window on dispatch time rather than completion time.
         this.currentTurnStartedAt = Date.now();
         this.responseEpoch += 1;
+        // A new turn's own prompt echo is real new content, so the stale-repaint
+        // guard's signature would naturally drift anyway — but clear the
+        // resolve-time bookkeeping explicitly here too, so a next-turn approval
+        // that happens to share message text with a previous turn's already-
+        // resolved one is never compared against stale prior-turn state.
+        this.clearApprovalResolutionMemory();
+        // (fix: kimi K3 send→idle-looking→generating lag / missed-generating on
+        // fast tool turns) For transcriptAuthority:'provider' providers (kimi,
+        // and other native-transcript sources), the PTY-scanned parser always
+        // returns messages:[] — the provider owns the transcript, not the PTY —
+        // so evaluateSettled's shouldHoldGenerating fast-path exception
+        // (hasFinalCurrentTurnAssistant) can never release early and
+        // recent_activity_hold ends up carrying the ENTIRE "is this turn still
+        // generating" signal for these providers regardless of what the spinner
+        // script does. That fallback only fires once a settle tick actually
+        // runs, which needs PTY output to schedule — for a model that "thinks"
+        // silently for many seconds before its first repaint (observed 12-20s
+        // for Kimi K3's default "high" effort), the dashboard looks idle for
+        // that whole window even though the turn was already accepted. Worse,
+        // a turn that fully completes (tool calls + reply) within a single
+        // settle debounce window can go straight idle→idle with no visible
+        // generating state at all (observed live with a yolo tool-use turn).
+        // onTurnStarted is the authoritative "a turn was just submitted" signal
+        // — promote to generating immediately instead of waiting on PTY-driven
+        // detection. This does not weaken completion detection: applyIdle /
+        // finishResponse (authoritative settled evidence) still own the actual
+        // idle transition, unchanged. Scoped to transcriptAuthority:'provider'
+        // only, so PTY-authoritative providers (whose spinner/settled parsing
+        // already drives generating promptly) are unaffected.
+        if (this.provider.transcriptAuthority === 'provider' && this.currentStatus !== 'waiting_approval') {
+            this.setStatus('generating', 'turn_started');
+            this.callbacks.onStatusChange();
+        }
     }
 
     /** Called when PTY exits */
     onPtyExit(): void {
         this.clearAllTimers();
         this.setStatus('stopped', 'pty_exit');
+        this.clearApprovalResolutionMemory();
     }
 
     /** Called when adapter starts up successfully */
@@ -382,6 +444,11 @@ export class CliStateEngine {
         this.activeModal = null;
         this.lastApprovalResolvedAt = Date.now();
         this.lastResolvedModalMessage = currentModalMessage;
+        // Snapshot the chrome-stripped screen at the moment of resolve — the
+        // baseline applyWaitingApproval's isStaleResolvedRepaint check compares
+        // against to tell a stale re-parse of THIS modal apart from a
+        // genuinely new one, regardless of how much wall-clock time passes.
+        this.lastApprovalResolvedContentSignature = this.computeApprovalContentSignature(snap);
         this.lastResolvedEntrySeq = this.approvalEntrySeq;
         this.responseSettleIgnoreUntil = Date.now() + this.timeouts.outputSettle + 400;
         if (this.approvalExitTimeout) { clearTimeout(this.approvalExitTimeout); this.approvalExitTimeout = null; }
@@ -499,6 +566,7 @@ export class CliStateEngine {
         this.pendingScriptStatusSince = 0;
         this.approvalResumeDeferSince = 0;
         this.approvalResumeDeferEpoch = -1;
+        this.clearApprovalResolutionMemory();
     }
 
     clearIdleFinishCandidate(reason: string): void {
@@ -679,7 +747,9 @@ export class CliStateEngine {
         if (!status) return;
 
         const prevStatus = this.currentStatus;
-        const ctx: SettledEvalContext = { now, modal, status, parsedMessages, lastParsedAssistant, parsedStatus: parsedStatus || null, prevStatus };
+        const ctx: SettledEvalContext = {
+            now, modal, status, parsedMessages, lastParsedAssistant, parsedStatus: parsedStatus || null, prevStatus,
+        };
 
         if (!this.applyPendingScriptStatusDebounce(ctx)) return;
 
@@ -743,7 +813,7 @@ export class CliStateEngine {
             this.applyError(ctx, session);
             return;
         }
-        if (status === 'waiting_approval') { this.applyWaitingApproval(ctx); return; }
+        if (status === 'waiting_approval') { this.applyWaitingApproval(ctx, snap); return; }
         if (status === 'generating') { this.applyGenerating(ctx); return; }
         if (status === 'idle') { this.applyIdle(ctx, snap, now); }
     }
@@ -801,7 +871,7 @@ export class CliStateEngine {
         this.callbacks.onStatusChange();
     }
 
-    private applyWaitingApproval(ctx: SettledEvalContext): void {
+    private applyWaitingApproval(ctx: SettledEvalContext, snap: CliBufferSnapshot): void {
         const { modal } = ctx;
         this.clearIdleFinishCandidate('waiting_approval');
         const inCooldown = this.lastApprovalResolvedAt
@@ -892,6 +962,51 @@ export class CliStateEngine {
                 }
                 return;
             }
+            // (fix: kimi stale-approval re-latch, observed live on kimi-code
+            // v0.28.1/K3) A freshly-*parsed* modal is not proof the CLI is
+            // presenting it right now — parseApproval scans an accumulated
+            // raw-output window (recentOutputBuffer / window-around-question
+            // scope), which can still contain the text of an approval that was
+            // ALREADY resolved a moment ago and re-surface it on the very next
+            // settle pass, even though resolveModal() already wrote the key and
+            // cleared activeModal. Reproduced live: after approving a tool call,
+            // the FSM re-latched `waiting_approval` on the identical
+            // already-answered question with NO further genuinely new content
+            // ever arriving afterward — the dashboard stayed wedged on "waiting
+            // for approval" until the 5-minute maxResponse watchdog forced a
+            // recheck.
+            //
+            // An output-TIMESTAMP discriminator ("has any PTY byte arrived since
+            // the resolve") was tried first and found insufficient: a live
+            // standalone repro showed kimi's own idle-screen chrome (status bar,
+            // context meter, blank-line repaint) advances lastNonEmptyOutputAt
+            // within ~300ms of the resolve even though NOTHING approval-relevant
+            // changed, so the guard stopped protecting almost immediately instead
+            // of for as long as the staleness actually persisted (observed 30s+).
+            //
+            // Reject a recapture only when ALL of: (a) this is the first capture
+            // since the last resolve (`!this.activeModal` — a genuinely repeated
+            // approval re-enters this branch too, since resolveModal always nulls
+            // activeModal), (b) the message text matches the one we just
+            // resolved, AND (c) the chrome-stripped approval-context signature
+            // (computeApprovalContentSignature — screen text with blank-line
+            // padding and manifest-declared chrome removed) is UNCHANGED from
+            // the signature captured at resolve time. (c) is the load-bearing,
+            // content-based condition, deliberately not time-bounded: it keeps
+            // rejecting for as long as nothing approval-relevant changes,
+            // regardless of how many chrome-only repaints occur or how much
+            // wall-clock time passes, and it stops rejecting the instant real
+            // new content (tool output, a fresh conversational turn) appears.
+            // This also keeps consecutive-approvals-with-identical-text (e.g.
+            // two back-to-back "Allow Bash command?" prompts) working correctly:
+            // a real follow-up approval necessarily means the CLI produced real
+            // new output first (running the previous tool, then asking again),
+            // which changes the signature regardless of shared message text.
+            const isStaleResolvedRepaint = !this.activeModal && this.isStaleResolvedApproval(modal, snap);
+            if (isStaleResolvedRepaint) {
+                LOG.debug('CLI', `[${this.provider.type}] ignoring stale re-parsed approval matching the just-resolved modal (approval-context signature unchanged)`);
+                return;
+            }
             this.modalLostAt = 0;
             this.isWaitingForResponse = true;
             this.setStatus('waiting_approval', 'script_detect');
@@ -1256,6 +1371,92 @@ export class CliStateEngine {
 
     // ─── Helpers ────────────────────────────────────────────────────────────
 
+    /**
+     * Derive a stable approval-context signature from the current screen,
+     * with blank-line padding and any manifest-declared chrome stripped out.
+     *
+     * Generic by design — no kimi- or provider-specific hardcoding: it reads
+     * whatever `tui.transcriptPty.chromePatterns` and `tui.spinner.patterns`
+     * the ACTIVE provider's own manifest already declares (present on any
+     * declarative-TUI provider; simply absent/empty for scripted providers,
+     * in which case this degrades to blank-line stripping only — never worse
+     * than comparing the raw screen). Those pattern lists exist precisely to
+     * name "known volatile repaint noise" (status bar, context meter, spinner
+     * ticks, banners) — reusing them here means the SAME declared knowledge
+     * that governs transcript-chrome stripping also governs staleness
+     * detection, instead of re-encoding provider knowledge into daemon-core.
+     *
+     * Deliberately NOT a hash of the whole screen/buffer: an ordinary TUI
+     * repaints its footer/status/context-meter chrome continuously even while
+     * genuinely idle, so a raw whole-screen or whole-buffer fingerprint (or a
+     * mere "did any bytes arrive" timestamp) changes on every repaint tick
+     * regardless of whether anything approval-relevant actually happened.
+     * Stripping the declared chrome first yields a signature that only
+     * changes when the surrounding conversation/tool-output content itself
+     * changes — exactly the discriminator applyWaitingApproval's
+     * isStaleResolvedRepaint check needs.
+     */
+    private computeApprovalContentSignature(snap: ApprovalSignatureSnapshot): string {
+        const screenText = snap.screenText || snap.accumulatedBuffer || '';
+        if (!screenText) return '';
+        const tui = (this.provider as { tui?: Record<string, any> }).tui;
+        const patternSpecs: Array<{ regex?: unknown; flags?: unknown }> = [
+            ...(Array.isArray(tui?.transcriptPty?.chromePatterns) ? tui!.transcriptPty.chromePatterns : []),
+            ...(Array.isArray(tui?.spinner?.patterns) ? tui!.spinner.patterns : []),
+        ];
+        const chromeRegexes: RegExp[] = [];
+        for (const spec of patternSpecs) {
+            if (spec && typeof spec.regex === 'string') {
+                try {
+                    chromeRegexes.push(new RegExp(spec.regex, typeof spec.flags === 'string' ? spec.flags : ''));
+                } catch {
+                    // Ignore an unparseable manifest regex — signature just skips that filter.
+                }
+            }
+        }
+        const kept: string[] = [];
+        for (const rawLine of screenText.split('\n')) {
+            const line = rawLine.trim();
+            if (!line) continue; // strip blank-line repaint padding
+            if (chromeRegexes.some((re) => re.test(line))) continue; // strip declared chrome
+            kept.push(line);
+        }
+        return kept.join('\n');
+    }
+
+    /**
+     * True when `modal` is a stale re-parse of an already-resolved approval:
+     * same message text, and the chrome-stripped approval-context signature
+     * of `snap` is unchanged from the signature captured at resolve time.
+     *
+     * Public and reused verbatim by BOTH the settled-eval capture path
+     * (applyWaitingApproval, below) and any OUTSIDE re-parse the adapter
+     * performs independently of the settle loop — e.g. provider-cli-adapter's
+     * getStatus()/getDebugState() startup-gate modal detection, which reads
+     * `recentOutputBuffer` directly while `startupParseGate` is open and can
+     * re-surface the same already-resolved modal before the gate closes.
+     * Centralizing the discriminator here means there is exactly ONE
+     * definition of "stale" for the whole session — no divergent duplicate
+     * heuristic re-implemented per call site.
+     */
+    isStaleResolvedApproval(modal: { message: string; buttons: string[] } | null, snap: ApprovalSignatureSnapshot): boolean {
+        if (!modal) return false;
+        const normalizedMessage = typeof modal.message === 'string' ? modal.message.trim() : '';
+        if (!normalizedMessage) return false;
+        return this.lastApprovalResolvedAt > 0
+            && normalizedMessage === this.lastResolvedModalMessage
+            && this.computeApprovalContentSignature(snap) === this.lastApprovalResolvedContentSignature;
+    }
+
+    /** Clear all resolve-time approval bookkeeping (message, timestamp, content
+     *  signature) — called at turn/session boundaries so a next-turn or
+     *  next-session approval is never compared against stale prior state. */
+    private clearApprovalResolutionMemory(): void {
+        this.lastApprovalResolvedAt = 0;
+        this.lastResolvedModalMessage = '';
+        this.lastApprovalResolvedContentSignature = '';
+    }
+
     /**
      * Schedule one more settled evaluation while pinned to `waiting_approval`
      * with no actionable modal. The settled FSM normally only re-runs on new