@adhdev/daemon-core 1.0.18-rc.10 → 1.0.18-rc.11

package/src/mesh/mesh-work-queue.ts

@@ -1231,6 +1231,19 @@ function propagateDependencyFailure(meshId: string, failedTaskId: string): MeshW
 
 const DEPENDENCY_FAILURE_TERMINALS = new Set<MeshTaskStatus>(['failed', 'cancelled']);
 
+/**
+ * CANCEL-STICKY-TERMINAL: the terminal task statuses. A row in one of these states is a
+ * historical record — no live dispatch owns it — and must NEVER be flipped back to an
+ * active (`pending`/`assigned`) state by a late writer. The canonical live example is a
+ * cancel that races the dispatch-failure `.catch` (mesh-queue-assignment.ts): that catch
+ * fires-and-forgets an unconditional `updateTaskStatus(...,'pending')`, resolving AFTER
+ * the cancel commits, which resurrected the cancelled row → it got re-claimed and the
+ * reclaim watchdog re-drove the same prompt. Guarding the write side (see
+ * {@link updateTaskStatus}) applies the same terminal-row protection
+ * {@link reclaimStrandedAssignedTask} already enforces to EVERY status writer at once.
+ */
+const TERMINAL_TASK_STATUSES = new Set<MeshTaskStatus>(['completed', 'failed', 'cancelled']);
+
 /**
  * G3 (step ①) — fire-and-forget mission_close_candidate detection for the missions of
  * the given task ids. Called after any task-status mutation (completion / failure /
@@ -1267,12 +1280,33 @@ export function updateTaskStatus(
     meshId: string,
     taskId: string,
     status: MeshTaskStatus,
-    opts?: MeshQueueMutationOptions,
+    opts?: {
+        /**
+         * CANCEL-STICKY-TERMINAL: operator/system override to permit a terminal→non-terminal
+         * transition (e.g. an explicit operator reopen). Without this, a write that would flip
+         * a `completed`/`failed`/`cancelled` row back to `pending`/`assigned` is refused as a
+         * no-op. Terminal→terminal and any transition FROM a non-terminal state are unaffected.
+         */
+        force?: boolean;
+    } & MeshQueueMutationOptions,
 ): MeshWorkQueueEntry | null {
     requireMeshHostQueueOwner(opts);
     const result = withQueueLock(meshId, () => {
         const entry = MeshRuntimeStore.getInstance().findQueueEntryById(meshId, taskId);
         if (!entry) return null;
+        // CANCEL-STICKY-TERMINAL: never resurrect a terminal row into an active state. A late
+        // fire-and-forget writer (canonically the dispatch-failure `.catch` requeue to
+        // 'pending' in mesh-queue-assignment.ts, which resolves AFTER a cancel commits) must
+        // not undo a cancel/completion/failure — that revival let the row be re-claimed and the
+        // reclaim watchdog re-drive the same prompt. Refuse the transition as a no-op unless an
+        // explicit operator override is passed. This is the write-side sibling of the
+        // status!=='assigned' guard reclaimStrandedAssignedTask already applies.
+        if (!opts?.force
+            && TERMINAL_TASK_STATUSES.has(entry.status)
+            && !TERMINAL_TASK_STATUSES.has(status)) {
+            LOG.debug('MeshQueue', `Refusing updateTaskStatus(${taskId} → ${status}) on mesh ${meshId}: row is terminal (${entry.status}). A late writer (e.g. dispatch-failure requeue) must not resurrect a cancelled/completed/failed task. Pass force to override.`);
+            return { entry, cascaded: [] as MeshWorkQueueEntry[] };
+        }
         entry.status = status;
         MeshRuntimeStore.getInstance().updateQueueEntry(entry);
         // Any transition OFF `assigned` ends the single-flight dispatch window (terminal
@@ -1313,18 +1347,67 @@ export function cancelTask(
         const entry = MeshRuntimeStore.getInstance().findQueueEntryById(meshId, taskId);
         if (!entry) return null;
         const now = new Date().toISOString();
+        // CANCEL-STICKY-TERMINAL (authoritative cancel): capture the prior assignment BEFORE
+        // clearing it, so the caller can stop the bound live worker. Leaving assignedNodeId/
+        // SessionId/ProviderType on the cancelled row let the still-running worker keep emitting
+        // delivery/turn signals that re-ignited the reclaim watchdog (observed: nonce 6→9,
+        // needing two cancels + a manual session stop). Clearing them also drops this row from
+        // the status==='assigned' counters so it can never be treated as live again.
+        const priorAssignment: CancelledTaskAssignment | undefined = entry.assignedSessionId
+            ? {
+                sessionId: entry.assignedSessionId,
+                nodeId: entry.assignedNodeId,
+                providerType: entry.assignedProviderType,
+            }
+            : undefined;
         entry.status = 'cancelled';
         entry.cancelledAt = now;
         if (opts?.reason) entry.cancelReason = opts.reason;
+        delete entry.assignedNodeId;
+        delete entry.assignedSessionId;
+        delete entry.assignedProviderType;
+        delete entry.dispatchTimestamp;
+        // Belt-and-suspenders: bump the dispatch nonce so any in-flight inject the
+        // now-orphaned worker later echoes carries a stale nonce and is rejected by the
+        // coordinator's stale-nonce guard — same mechanism reclaimStrandedAssignedTask uses.
+        entry.dispatchNonce = (entry.dispatchNonce || 0) + 1;
         MeshRuntimeStore.getInstance().updateQueueEntry(entry);
         endTaskDispatchInFlight(meshId, taskId);
         const cascaded = propagateDependencyFailure(meshId, taskId);
-        return { entry, cascaded };
+        return { entry, cascaded, priorAssignment };
     });
     if (result) scheduleMissionCloseCandidateCheck(meshId, [result.entry, ...result.cascaded]);
+    // Surface the prior binding to the caller (out-of-band from the persisted row, so it is
+    // never serialized) so the cancel command handler — which holds DaemonComponents — can
+    // stop the now-orphaned worker via the transport-aware stopStaleMeshWorker helper.
+    if (result?.priorAssignment) lastCancelledTaskAssignment.set(`${meshId}::${taskId}`, result.priorAssignment);
     return result ? result.entry : null;
 }
 
+/**
+ * CANCEL-STICKY-TERMINAL: the assignment a task carried at cancel time, handed to the cancel
+ * command handler so it can stop the bound worker. cancelTask runs in the pure queue-store
+ * module (no DaemonComponents), so it records the binding here and the handler drains it.
+ */
+export interface CancelledTaskAssignment {
+    sessionId: string;
+    nodeId?: string;
+    providerType?: string;
+}
+
+const lastCancelledTaskAssignment = new Map<string, CancelledTaskAssignment>();
+
+/**
+ * Read-and-clear the assignment a just-cancelled task was bound to. Returns undefined when the
+ * cancelled task had no live assignment (nothing to stop). One-shot: the entry is deleted on read.
+ */
+export function takeCancelledTaskAssignment(meshId: string, taskId: string): CancelledTaskAssignment | undefined {
+    const key = `${meshId}::${taskId}`;
+    const value = lastCancelledTaskAssignment.get(key);
+    if (value) lastCancelledTaskAssignment.delete(key);
+    return value;
+}
+
 /**
  * Return a queue task to pending for retry. By default, dead session targeting
  * and assigned ownership are cleared so stale assignments do not strand again.

package/src/providers/cli-provider-instance-types.ts

@@ -66,6 +66,15 @@ export type CompletedFinalizationBlock = {
     // preamble summary (evidenceLevel=insufficient) into the append-only ledger before the
     // worker's next approval turn resumes. Independent of valley length.
     holdForTranscript?: boolean;
+    // (CANON-C EARLY-EMIT FLOOR) Set on a missing_final_assistant block whose provider has NO
+    // external transcript source to trail — a PTY-parsed provider (codex-cli) or one that merely
+    // requires a final assistant before idle. For those the CANON-C decoupled-immediate emit is a
+    // pure timing guess (no separate transcript will land to upgrade it), so it must observe the
+    // CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS floor rather than fire at the ~13s first-poll
+    // waitedMs. A native-source block (claude-cli external-native, where the transcript legitimately
+    // trails the idle transition by a write) deliberately does NOT set this — its immediate emit is
+    // correct and is upgraded by the transcript reconcile.
+    noExternalTranscriptSource?: boolean;
 };
 
 export type CompletionFinalAssistantEvidence = {
@@ -87,6 +96,25 @@ export type ExternalTranscriptProbe = {
 
 export const COMPLETED_FINALIZATION_RETRY_MS = 1000;
 export const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30_000;
+// (CANON-C EARLY-EMIT FLOOR) Minimum elapsed time before the CANON-C transcript-evidence
+// gate (allowTimeout blocks) may fire its decoupled-immediate completion for a block that
+// has NO final-assistant evidence (missing_final_assistant, finalAssistantPresent=false).
+//
+// CANON-C deliberately decouples the idle NOTIFICATION from the transcript's final-assistant
+// turn: for a native-source worker whose transcript write merely trails the idle transition,
+// emitting immediately (weak, later upgraded) is correct. But the SAME allowTimeout path also
+// carries codex/antigravity PLAIN terminal blocks whose on-screen "final" assistant never
+// landed — there the immediate emit fires at whatever tiny waitedMs the first completion-gate
+// poll observed (~13s live), stamping evidenceLevel=insufficient and racing the transcript
+// before it can catch up or the 180s mesh-worker stall watchdog can arm. Requiring a minimum
+// dwell gives the transcript a window to land (clearing the block for a GENUINE emit) and lets
+// the stall watchdog own long turns, while still emitting a weak completion promptly once the
+// floor is met so a genuinely-answerless turn is never wedged. A block WITH final-assistant
+// evidence present is unaffected (it takes the normal emit path, not this floor). Scoped (at
+// the call site) to the missing_final_assistant transcript-evidence gate on mesh workers.
+// Sized so a short transcript-write lag resolves under it while staying well below the 30s
+// COMPLETED_FINALIZATION_MAX_WAIT_MS cap that force-releases the weak completion regardless.
+export const CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS = 20_000;
 // (FALSEIDLE-BGCHILD-a) Minimum generating→idle settle window for native-history mesh worker
 // sessions. Native-history providers (e.g. claude-cli) normally flush the completion with
 // flushDelay=0 — the transcript is authoritative, so there is no reason to wait. But a worker

package/src/providers/cli-provider-instance.ts

@@ -12,7 +12,7 @@ import * as fs from 'fs';
 import { normalizeInputEnvelope, type ProviderModule, flattenContent, type InputEnvelope } from './contracts.js';
 import { assertProviderSupportsDeclaredInput, getEffectiveMessageInputSupport } from './provider-input-support.js';
 import type { ProviderInstance, ProviderState, ProviderEvent, InstanceContext, ProviderErrorReason, HotChatSessionState, SessionModalState } from './provider-instance.js';
-import { normalizeInteractivePrompt, normalizeInteractivePromptResponse, type InteractivePrompt } from './types/interactive-prompt.js';
+import { normalizeInteractivePrompt, normalizeInteractivePromptResponse, resolveInteractivePromptResponse, type InteractivePrompt } from './types/interactive-prompt.js';
 import { ProviderCliAdapter } from '../cli-adapters/provider-cli-adapter.js';
 import { shortHash } from '../system/hash.js';
 import type { CliProviderModule } from '../cli-adapters/provider-cli-adapter.js';
@@ -56,6 +56,7 @@ import {
     STATUS_HYDRATION_TAIL_LIMIT,
     COMPLETED_FINALIZATION_RETRY_MS,
     COMPLETED_FINALIZATION_MAX_WAIT_MS,
+    CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS,
     NATIVE_HISTORY_MESH_IDLE_SETTLE_MS,
     PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS,
     ANTIGRAVITY_HOLD_QUIET_DWELL_MS,
@@ -376,10 +377,12 @@ export class CliProviderInstance implements ProviderInstance {
     // `waiting_choice` overlay in getState(); the raw adapter status stays idle/generating,
     // so detectStatusTransition()'s status-keyed arms never fire and no push-worthy
     // agent:* event is emitted — the owner misses the "ACTION REQUIRED" prompt when the
-    // app is backgrounded. We emit one agent:waiting_approval on ENTRY into the prompt
-    // state (reusing the existing server push path, no cloud change) and dedupe on this
-    // key so repeated status ticks with the same prompt do not re-fire. '' means no
-    // prompt is currently active (cleared when the prompt is answered/gone).
+    // app is backgrounded. We emit one agent:waiting_choice on ENTRY into the prompt
+    // state (its own coordinator event, NOT the approval channel — a multi-choice
+    // question is answered with mesh_answer_question, never mesh_approve) carrying the
+    // FULL InteractivePrompt payload, and dedupe on this key so repeated status ticks
+    // with the same prompt do not re-fire. '' means no prompt is currently active
+    // (cleared when the prompt is answered/gone).
     private lastInteractivePromptEventKey = '';
     private autoApproveBusy = false;
     private autoApproveBusyTimer: NodeJS.Timeout | null = null;
@@ -1272,7 +1275,16 @@ export class CliProviderInstance implements ProviderInstance {
             }
         } else if (event === 'interactive_prompt_response' && data) {
             try {
-                const response = normalizeInteractivePromptResponse(data);
+                // mesh_answer_question (mission f1d25e11) sends a coordinator-friendly answer
+                // form (per-question select by label/index) that must be resolved against the
+                // AUTHORITATIVE active prompt held here. When the active prompt is present and
+                // the promptId matches, resolve it; otherwise fall back to the strict keyed
+                // form (dashboard local answers already send that shape).
+                const response = (this.activeInteractivePrompt
+                    && this.activeInteractivePrompt.promptId === (data as { promptId?: unknown })?.promptId
+                    && Array.isArray((data as { answers?: unknown })?.answers))
+                    ? resolveInteractivePromptResponse(this.activeInteractivePrompt, data)
+                    : normalizeInteractivePromptResponse(data);
                 if (this.activeInteractivePrompt?.promptId === response.promptId) {
                     this.activeInteractivePrompt = null;
                 }
@@ -2084,6 +2096,11 @@ export class CliProviderInstance implements ProviderInstance {
                     reason: 'missing_final_assistant',
                     terminal: (this.provider as any).requiresFinalAssistantBeforeIdle === true,
                     allowTimeout: allowMissingAssistantTimeout,
+                    // PTY-parsed provider (codex-cli): no external transcript trails the idle
+                    // transition, so the CANON-C decoupled emit must observe the min-elapsed floor
+                    // rather than fire at the first-poll waitedMs. (claude-cli's external-native
+                    // branch above is exempt — its transcript legitimately lands moments later.)
+                    noExternalTranscriptSource: true,
                 };
             }
         }
@@ -2790,6 +2807,43 @@ export class CliProviderInstance implements ProviderInstance {
                 this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
                 return;
             }
+            // (CANON-C EARLY-EMIT FLOOR) The transcript-evidence gate would otherwise fire its
+            // decoupled-immediate completion at ANY waitedMs — including the ~13s a codex PLAIN
+            // terminal `missing_final_assistant` block reaches on the first completion-gate poll,
+            // with NO final assistant ever observed. That stamps a weak evidenceLevel=insufficient
+            // completion the coordinator marks reviewRecommended but does not auto-hold, racing the
+            // transcript before it can land and pre-empting the 180s mesh-worker stall watchdog.
+            // Impose a minimum dwell — but ONLY for the no-external-transcript case
+            // (noExternalTranscriptSource): a PTY-parsed provider has no separate transcript that
+            // will land to upgrade the weak emit, so firing immediately is a pure timing guess. A
+            // native-source block (claude-cli external-native) is deliberately NOT floored: its
+            // transcript legitimately trails the idle transition by a write and the CANON-C
+            // immediate emit is correct (upgraded by the reconcile). Keep holding (re-probe each
+            // retry — the block clears for a GENUINE emit the moment the assistant turn lands) until
+            // either the floor is met or the 30s cap force-releases the weak completion below.
+            // Scoped to mesh worker sessions (the only place allowTimeout is set), so interactive
+            // completion timing is untouched.
+            if (isTranscriptEvidenceGate
+                && blockReason === 'missing_final_assistant'
+                && block.noExternalTranscriptSource === true
+                && waitedMs < CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS) {
+                if (pending.loggedBlockReason !== 'canon_c_min_elapsed_floor') {
+                    LOG.info('CLI', `[${this.type}] holding CANON-C decoupled emit until min-elapsed floor (waitedMs=${waitedMs} floor=${CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS}); no final assistant yet (${blockReason})`);
+                    if (this.isMeshWorkerSession()) {
+                        traceMeshEventDrop('completion_gate_hold', this.meshTraceCtx(), `canon_c_min_elapsed_floor waited=${waitedMs}ms`);
+                    }
+                    if (this.completionTraceOn()) this.recordCompletionGateTrace('hold', {
+                        blockReason,
+                        latestVisibleStatus,
+                        terminal: block.terminal === true,
+                        canonCMinElapsedFloor: true,
+                        waitedMs,
+                    });
+                    pending.loggedBlockReason = 'canon_c_min_elapsed_floor';
+                }
+                this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
+                return;
+            }
             // (ANTIGRAVITY-30S-CAP-PREMATURE) The 30s cap has been reached for an antigravity
             // `holdForTranscript` block. The cap releases on ELAPSED TIME, not proof-of-idle — but
             // antigravity is native-source (assistant answer in native-history) with a PTY-derived
@@ -3960,24 +4014,38 @@ export class CliProviderInstance implements ProviderInstance {
             this.lastStatus = newStatus;
         }
 
-        // INTERACTIVE-PROMPT-PUSH: fire a push-worthy notification when the session
-        // ENTERS an AskUserQuestion / waiting_choice state. This is orthogonal to the
-        // status-change block above: an AskUserQuestion prompt is surfaced only as a
+        // INTERACTIVE-QUESTION-EMIT: fire a coordinator/push-worthy notification when the
+        // session ENTERS an AskUserQuestion / waiting_choice state. This is orthogonal to
+        // the status-change block above: an AskUserQuestion prompt is surfaced only as a
         // display-only `waiting_choice` overlay in getState() (mirrored here off
         // adapterStatus.activeInteractivePrompt, the exact signal getState uses), while
         // the raw adapter status stays idle/generating — so none of the status-keyed
         // arms above ever emit an agent:* event for it and the owner gets no web-push.
         //
-        // We REUSE agent:waiting_approval (the question message as modalMessage, the
-        // choice labels as modalButtons) so the existing server push path fires with
-        // zero cloud change — the semantics ("the agent needs your input") match.
+        // MESH-QUESTION-ANSWER-PATH (mission f1d25e11): this used to REUSE
+        // agent:waiting_approval (question as modalMessage, choice labels as modalButtons).
+        // That mis-classified a multi-choice QUESTION as an approval — the coordinator saw
+        // a task_approval_needed ledger row and tried mesh_approve, which cannot answer a
+        // question (it resolves a yes/no modal). We now emit a DISTINCT
+        // agent:waiting_choice event carrying the FULL InteractivePrompt payload
+        // (promptId + every question's header/question/multiSelect and each option's
+        // label/description) so the coordinator can render the choices and answer with the
+        // dedicated mesh_answer_question tool. The rich payload survives the cross-machine
+        // relay (see buildRelayMetadataEvent) so a REMOTE worker's question reaches the
+        // coordinator with its options intact.
+        //
+        // We keep modalMessage/modalButtons on the event too so the existing server
+        // web-push path (which reads those two fields) still fires with no cloud change —
+        // but the payload's `interactivePrompt` is the authoritative, structured signal.
         //
         // Edge-triggered: emit exactly once on entry, keyed on promptId + question text,
         // and reset the key when the prompt clears so a fresh prompt re-fires and a later
         // real completion still flows through the idle arm normally. We do NOT emit when
         // the session is ALSO in a genuine approval state (newStatus === 'waiting_approval'):
-        // that arm already emits agent:waiting_approval, and firing here too would double
-        // up on the same modal.
+        // that arm already emits agent:waiting_approval. A question (waiting_choice) and a
+        // real approval (waiting_approval) therefore NEVER both fire for the same tick —
+        // the approval arm wins and this arm yields (owner requirement: the two are
+        // mutually exclusive).
         const interactivePrompt = adapterStatus.activeInteractivePrompt ?? null;
         if (interactivePrompt && newStatus !== 'waiting_approval') {
             const firstQuestion = interactivePrompt.questions?.[0];
@@ -3991,7 +4059,14 @@ export class CliProviderInstance implements ProviderInstance {
                     : undefined;
                 const modalButtons = firstQuestion?.options?.map((option: { label: string }) => option.label);
                 this.pushEvent({
-                    event: 'agent:waiting_approval', chatTitle, timestamp: now,
+                    event: 'agent:waiting_choice', chatTitle, timestamp: now,
+                    // Structured, authoritative payload — the coordinator renders these and
+                    // answers via mesh_answer_question. Carried whole (all questions, all
+                    // options) so multi-question / multi-select prompts round-trip fully.
+                    interactivePrompt,
+                    promptId: interactivePrompt.promptId,
+                    multiSelect: firstQuestion?.multiSelect === true,
+                    // Push-notification-friendly projection (server push path reads these).
                     modalMessage,
                     modalButtons,
                 });

package/src/providers/sdk/v1/builders/cli/detect-status.ts

@@ -210,10 +210,33 @@ function buttonBlockApprovalCue(spec: ModalSpec, text: string): boolean {
   return hasNegativeApprovalOption(labels);
 }
 
+/**
+ * APPROVAL-PICKER-MISROUTE (mission f1d25e11) defense-in-depth: an
+ * AskUserQuestion multi-choice picker is NOT an approval modal. Its option rows
+ * ("❯ 1. label") can otherwise satisfy the approval button cue and get
+ * mis-classified as `waiting_approval`, so the worker's question is surfaced to
+ * the coordinator as a task_approval_needed (→ mesh_approve, which cannot answer
+ * it). The picker carries a distinctive signature the approval FSM never does:
+ * the claude TUI select footer ("Enter to select … Esc to cancel") together with
+ * the freeform escape hatch ("Type something" / "Chat about this"). When both are
+ * present the screen is a question picker — surfaced separately as
+ * waiting_choice — so the approval matchers must yield. Mirrors the legacy
+ * looksLikeSelectionPicker guard (cli-provider-instance.ts) ported to SDK-v1.
+ */
+export function isAskUserQuestionPickerSignature(text: string): boolean {
+  if (!text) return false;
+  const hasSelectFooter = /Enter to select/i.test(text) && /Esc to cancel/i.test(text);
+  if (!hasSelectFooter) return false;
+  return /Type something\.?|Chat about this/i.test(text);
+}
+
 function modalMatches(spec: ModalSpec, input: CliStatusInput): boolean {
   // Status-level modal detection is cue-only — does the question appear at all?
   // Button extraction lives in buildParseApprovalFromTui.
   const text = input.screenText ?? '';
+  // A question picker (AskUserQuestion) is never an approval — bail before any
+  // approval cue can match its numbered option rows (mission f1d25e11).
+  if (isAskUserQuestionPickerSignature(text)) return false;
   const question = compile(spec.questionPattern, spec.questionFlags ?? 'i');
   if (question.test(text)) return true;
   for (const variant of spec.questionVariants ?? []) {

package/src/providers/sdk/v1/builders/cli/parse-approval.ts

@@ -78,6 +78,22 @@ function compile(re: string, flags?: string): RegExp {
   }
 }
 
+/**
+ * APPROVAL-PICKER-MISROUTE (mission f1d25e11) defense-in-depth: mirror
+ * detect-status.isAskUserQuestionPickerSignature at the button-parse layer. A
+ * multi-choice AskUserQuestion picker is not an approval modal; its numbered
+ * option rows can otherwise be extracted as approval buttons and produce a
+ * spurious approval modal. When the picker signature (claude TUI select footer +
+ * "Type something"/"Chat about this" freeform escape hatch) is present, return
+ * null early so the screen is surfaced as waiting_choice, never approval.
+ */
+function isAskUserQuestionPickerSignature(text: string): boolean {
+  if (!text) return false;
+  const hasSelectFooter = /Enter to select/i.test(text) && /Esc to cancel/i.test(text);
+  if (!hasSelectFooter) return false;
+  return /Type something\.?|Chat about this/i.test(text);
+}
+
 function findQuestionLineIndex(
   spec: ModalTuiSpec,
   lines: string[],
@@ -268,6 +284,10 @@ export function buildParseApprovalFromTui(
   return function parseApproval(input: CliApprovalInput): CliApprovalModal | null {
     const rawText = input.screenText ?? input.buffer ?? '';
     if (!rawText) return null;
+    // An AskUserQuestion picker is not an approval — never extract its option
+    // rows as approval buttons (mission f1d25e11). Check the raw text before any
+    // visible-region scoping trims the footer that identifies the picker.
+    if (isAskUserQuestionPickerSignature(rawText)) return null;
     const text = visibleRegion ? applyVisibleRegion(visibleRegion, rawText) : rawText;
     const lines = text.split('\n');
     const question = findQuestionLineIndex(spec, lines);

package/src/providers/types/interactive-prompt.ts

@@ -117,6 +117,83 @@ export function normalizeInteractivePromptResponse(raw: unknown): InteractivePro
   return { promptId, answers };
 }
 
+/**
+ * Resolve a coordinator-friendly answer form into the strict, questionId-keyed
+ * InteractivePromptResponse the TUI/answer machinery consumes (mission f1d25e11).
+ *
+ * mesh_answer_question lets the coordinator answer against the option LABELS or
+ * 1-based INDEXES it saw in the agent:waiting_choice event, without having to
+ * reconstruct the exact questionId → selectedLabels map. This resolves that
+ * ergonomic form against the AUTHORITATIVE active prompt (the daemon holds it),
+ * so index/label resolution and question ordering are correct by construction.
+ *
+ * Accepted `raw` shapes:
+ *   - The strict form ({ promptId, answers: { [questionId]: { selectedLabels } } })
+ *     — passed straight to normalizeInteractivePromptResponse (back-compat).
+ *   - The friendly form ({ promptId, answers: [ { questionId?, select?, freeform? } ] })
+ *     — entries map to questions by questionId, else by array position. `select`
+ *     is a label (string) / 1-based index (number) / array of either.
+ */
+export function resolveInteractivePromptResponse(
+  prompt: InteractivePrompt,
+  raw: unknown,
+): InteractivePromptResponse {
+  if (!raw || typeof raw !== 'object') throw new Error('Interactive prompt response must be an object');
+  const record = raw as Record<string, unknown>;
+  const promptId = readString(record.promptId);
+  if (!promptId) throw new Error('promptId must be a non-empty string');
+  if (promptId !== prompt.promptId) throw new Error('Interactive prompt response does not match active prompt');
+  // Strict (keyed-object) form → existing normalizer.
+  if (record.answers && typeof record.answers === 'object' && !Array.isArray(record.answers)) {
+    return normalizeInteractivePromptResponse(record);
+  }
+  if (!Array.isArray(record.answers)) throw new Error('answers must be an array or a questionId-keyed object');
+
+  const resolveOneLabel = (question: InteractiveQuestion, sel: unknown): string => {
+    if (typeof sel === 'number' && Number.isFinite(sel)) {
+      const idx = Math.trunc(sel) - 1; // 1-based
+      const option = question.options[idx];
+      if (!option) throw new Error(`Option index ${sel} out of range for ${question.questionId}`);
+      return option.label;
+    }
+    const label = readString(sel);
+    if (!label) throw new Error(`Empty selection for ${question.questionId}`);
+    // Exact label match first; fall back to a numeric string index.
+    const exact = question.options.find((o) => o.label === label);
+    if (exact) return exact.label;
+    const asIndex = Number(label);
+    if (Number.isInteger(asIndex)) {
+      const option = question.options[asIndex - 1];
+      if (option) return option.label;
+    }
+    throw new Error(`Unknown option for ${question.questionId}: ${label}`);
+  };
+
+  const answers: Record<string, InteractiveAnswer> = {};
+  const entries = record.answers as unknown[];
+  entries.forEach((entryRaw, index) => {
+    if (!entryRaw || typeof entryRaw !== 'object' || Array.isArray(entryRaw)) return;
+    const entry = entryRaw as Record<string, unknown>;
+    const questionId = readString(entry.questionId);
+    const question = (questionId ? prompt.questions.find((q) => q.questionId === questionId) : undefined)
+      ?? prompt.questions[index];
+    if (!question) throw new Error(`No matching question for answer entry ${index}`);
+    const freeformText = readString(entry.freeform) ?? readString(entry.freeformText);
+    const selectedLabels: string[] = [];
+    const select = entry.select;
+    if (Array.isArray(select)) {
+      for (const sel of select) selectedLabels.push(resolveOneLabel(question, sel));
+    } else if (select !== undefined && select !== null) {
+      selectedLabels.push(resolveOneLabel(question, select));
+    }
+    answers[question.questionId] = {
+      selectedLabels,
+      ...(freeformText ? { freeformText } : {}),
+    };
+  });
+  return { promptId, answers };
+}
+
 export function buildClaudeInteractiveToolResult(response: InteractivePromptResponse): string {
     return JSON.stringify({
     type: 'user',