@adhdev/daemon-core 1.0.18-rc.15 → 1.0.18-rc.17

package/dist/providers/auto-approve-modes.d.ts

@@ -0,0 +1,14 @@
+import type { AutoApproveMode, AutoApproveModeRisk, AutoApproveModeStrategy, ProviderModule } from './contracts.js';
+export interface ResolvedAutoApproveMode {
+    active: boolean;
+    strategy: AutoApproveModeStrategy;
+    modeId: string;
+}
+/** Runtime defense-in-depth for provider definitions that bypass schema validation. */
+export declare function deriveAutoApproveModeRisk(mode: Pick<AutoApproveMode, 'risk' | 'launchArgs'>): AutoApproveModeRisk;
+/**
+ * Resolve new mode settings before the legacy boolean. A stale/unknown explicit
+ * mode id fails closed instead of falling through to an enabled legacy setting.
+ */
+export declare function resolveProviderAutoApproveMode(provider: ProviderModule, settings: Record<string, unknown> | undefined): ResolvedAutoApproveMode;
+export declare function findProviderAutoApproveMode(provider: ProviderModule | undefined, modeId: string): AutoApproveMode | undefined;

package/dist/providers/chat-message-normalization.d.ts

@@ -58,6 +58,28 @@ export declare function extractFinalAssistantSummaryEvidence(messages: ChatMessa
  * grace gate) on top of this structural check.
  */
 export declare function selectFinalAssistantTurnEndMessage(messages: ChatMessage[] | null | undefined): ChatMessage | null;
+/**
+ * EARLY-IDLE-COMPLETION-FALSE-POSITIVE — trailing tool/terminal activity detector.
+ *
+ * True when the transcript's LAST non-empty user-facing assistant bubble is followed
+ * by one or more TOOL / TERMINAL activity bubbles (a tool_use/command the assistant
+ * fired AFTER its text) — i.e. the assistant emitted a preamble ("Let me explore…"),
+ * then started running Read/Grep, so the turn is still executing and its answer has
+ * not landed. Callers that would otherwise promote that preamble to a turn-end summary
+ * off a momentary (startup-grace / inter-tool) idle read use this as a veto.
+ *
+ * Deliberately NARROW so the pure-PTY completion rescue is preserved:
+ *   - Only TOOL/TERMINAL activity trailing the assistant vetoes. A trailing THOUGHT or
+ *     status bubble does NOT (a finished turn can end on an internal thought), matching
+ *     selectFinalAssistantTurnEndMessage's skip set minus the "still-working" signals.
+ *   - A genuinely FINISHED worker (final assistant last, no trailing tool activity —
+ *     the kimi pure-PTY continuous-idle shape) returns false, so its early completion
+ *     is untouched.
+ *
+ * Returns false when there is no final assistant bubble at all (the caller's
+ * selectFinalAssistantTurnEndMessage already handles that as "not a turn end").
+ */
+export declare function hasTrailingToolActivityAfterFinalAssistant(messages: ChatMessage[] | null | undefined): boolean;
 export declare const BUILTIN_CHAT_MESSAGE_KINDS: readonly ["standard", "thought", "tool", "terminal", "system"];
 export type BuiltinChatMessageKind = typeof BUILTIN_CHAT_MESSAGE_KINDS[number];
 export type ChatMessageKind = BuiltinChatMessageKind | (string & {});

package/dist/providers/cli-provider-instance.d.ts

@@ -810,7 +810,11 @@ export declare class CliProviderInstance implements ProviderInstance {
     getAdapter(): ProviderCliAdapter;
     get cliType(): string;
     get cliName(): string;
+    private resolveAutoApproveMode;
+    /** Legacy boolean view retained for internal/test compatibility. */
     private shouldAutoApprove;
+    private shouldUsePtyAutoApprove;
+    private resetPtyAutoApproveState;
     /** @see ProviderInstance.noteManualInteraction */
     noteManualInteraction(now?: number, opts?: {
         passive?: boolean;

package/dist/providers/contracts.d.ts

@@ -389,6 +389,21 @@ export interface ProviderCompatibilityEntry {
     ideVersion: string;
     scriptDir: string;
 }
+export type AutoApproveModeStrategy = 'pty-parse-default' | 'launch-args' | 'post-boot-command';
+export type AutoApproveModeRisk = 'safe' | 'caution' | 'dangerous';
+export interface AutoApproveMode {
+    id: string;
+    label: string;
+    strategy: AutoApproveModeStrategy;
+    risk: AutoApproveModeRisk;
+    warning?: string;
+    launchArgs?: string[];
+    removeArgs?: string[];
+}
+export interface AutoApproveModesConfig {
+    default: string;
+    modes: AutoApproveMode[];
+}
 export interface ProviderModule {
     /** Unique identifier (e.g. 'cline', 'cursor', 'gemini-cli') */
     type: string;
@@ -418,6 +433,8 @@ export interface ProviderModule {
     status?: string;
     /** Inventory/support detail string maintained in adhdev-providers */
     details?: string;
+    /** Provider-specific auto-approve choices and their launch/runtime strategy. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** Install instructions (shown when command is missing) */
     install?: string;
     /** Custom version detection command (e.g. 'cursor --version', 'claude -v') */

package/dist/providers/provider-schema.d.ts

@@ -3,3 +3,4 @@ export interface ProviderValidationResult {
     warnings: string[];
 }
 export declare function validateProviderDefinition(raw: unknown): ProviderValidationResult;
+export declare function validateAutoApproveModes(raw: unknown, errors: string[]): void;

package/dist/repo-mesh-types.d.ts

@@ -14,6 +14,7 @@ import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
 import type { MagiKindPanelMap, DifficultyBrainMap, NodeCapabilitySlot } from '@adhdev/mesh-shared';
+import type { ProviderModule } from './providers/contracts.js';
 export interface RepoMesh {
     id: string;
     name: string;
@@ -255,6 +256,8 @@ export interface RepoMeshPolicy {
      * A node policy may override this per-node (RepoMeshNodePolicy.delegatedWorkerAutoApprove).
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Explicit opt-in required before delegated workers may use a dangerous provider mode. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): opt-in to allow the coordinator to inject
      * DESTRUCTIVE keys (CTRL_C / ESC) into a worker PTY via mesh_send_keys. These
@@ -406,6 +409,8 @@ export interface RepoMeshNodePolicy {
      * precedence over the mesh-level policy for worker sessions launched onto this node.
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Per-node override for dangerous delegated worker mode authorization. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): per-node override for
      * RepoMeshPolicy.allowSendKeysDestructive.
@@ -524,13 +529,18 @@ export declare function normalizeAutoFastForwardPolicy(value: unknown): NonNulla
  */
 export declare function mergeAndNormalizePolicy(base: RepoMeshPolicy | undefined, patch: Partial<RepoMeshPolicy> | undefined): RepoMeshPolicy;
 /**
- * Resolve whether a delegated worker session launched onto `nodePolicy` (within a mesh
- * governed by `meshPolicy`) should auto-approve. Precedence: node override → mesh policy
- * → default true. The result is stamped into the worker launch settings envelope as
- * `autoApprove`; it wins over the global per-provider-type autoApprove config because the
- * launch path merges the envelope as a settingsOverride on top of the provider defaults.
+ * Resolve delegated worker auto-approve. Legacy providers return a boolean. Providers
+ * with modes return the default mode id, except a dangerous default is downgraded to a
+ * non-dangerous PTY mode unless mesh/node policy explicitly opts in.
  */
-export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove'> | null): boolean;
+export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null): boolean | string;
+export declare function resolveDelegatedWorkerDangerousModeAllow(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerDangerousModeAllow'> | null): boolean;
+/** Shape a boolean-or-mode resolution for the settings precedence contract. */
+export declare function delegatedWorkerAutoApproveSettings(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null): {
+    autoApprove: boolean | undefined;
+    autoApproveMode: string | undefined;
+    delegatedWorkerDangerousModeAllow: boolean;
+};
 /**
  * MESH-SEND-KEYS (feature 3): resolve whether DESTRUCTIVE key injection
  * (CTRL_C/ESC via mesh_send_keys) is permitted for a node. Node policy overrides

package/dist/shared-types.d.ts

@@ -13,7 +13,7 @@ export type { ProviderState, ProviderStatus, ActiveChatData, IdeProviderState, C
 export type { ProviderErrorReason } from './providers/provider-instance.js';
 import type { ActiveChatData as _ActiveChatData, ProviderErrorReason as _ProviderErrorReason } from './providers/provider-instance.js';
 import type { WorkspaceEntry } from './config/workspaces.js';
-import type { ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
+import type { AutoApproveModesConfig, ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
 import type { GitCompactSummary, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams } from './git/git-types.js';
 import type { InteractivePrompt } from './providers/types/interactive-prompt.js';
 export type { GitCommandName, GitCompactSummary, GitDiffSummary, GitFailureReason, GitFileChange, GitFileChangeStatus, GitRepoIdentity, GitRepoStatus, GitSnapshot, GitSnapshotCompareSummary, GitSnapshotReason, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams, } from './git/git-types.js';
@@ -428,6 +428,8 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
+    /** Provider-declared auto-approve choices shown by session launch UIs. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** BRAIN-ROUTING: suggested model values for the new-session model dropdown. */
     modelOptions?: string[];
     /** BRAIN-ROUTING: reasoning-effort values for the new-session thinking dropdown. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.15",
+  "version": "1.0.18-rc.17",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.15",
-    "@adhdev/session-host-core": "1.0.18-rc.15",
+    "@adhdev/mesh-shared": "1.0.18-rc.17",
+    "@adhdev/session-host-core": "1.0.18-rc.17",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/cli-manager.ts

@@ -34,6 +34,7 @@ import type { SessionRegistry } from '../sessions/registry.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { LOG } from '../logging/logger.js';
 import { shouldRestoreHostedRuntime } from './hosted-runtime-restore.js';
+import { findProviderAutoApproveMode, resolveProviderAutoApproveMode } from '../providers/auto-approve-modes.js';
 
 // ─── external dependency interface ──────────────────────────
 
@@ -452,6 +453,40 @@ export function expandThinkingLaunchArgs(
     return template.map((part) => part.includes('{{level}}') ? part.replace('{{level}}', mapped) : part);
 }
 
+function matchesRemovedLaunchArg(arg: string, removeArg: string): boolean {
+    return arg === removeArg || (removeArg.startsWith('--') && arg.startsWith(`${removeArg}=`));
+}
+
+/**
+ * Apply a selected launch-args auto-approve mode without mutating provider metadata.
+ * removeArgs only targets provider-owned base spawn.args; launchArgs are prepended to
+ * per-launch args beside model/thinking args, making conflict removal order-independent.
+ */
+export function applyAutoApproveModeLaunchArgs(
+    provider: ProviderModule | undefined,
+    cliArgs: string[] | undefined,
+    settings: Record<string, unknown> | undefined,
+): { provider: ProviderModule | undefined; cliArgs: string[] | undefined } {
+    if (!provider) return { provider, cliArgs };
+    const resolved = resolveProviderAutoApproveMode(provider, settings);
+    if (!resolved.active || resolved.strategy !== 'launch-args') return { provider, cliArgs };
+    const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+    if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+
+    const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+    const baseArgs = provider.spawn?.args;
+    const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0
+        ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg)))
+        : baseArgs;
+    const launchProvider = filteredBaseArgs === baseArgs
+        ? provider
+        : { ...provider, spawn: { ...provider.spawn!, args: filteredBaseArgs } };
+    return {
+        provider: launchProvider,
+        cliArgs: [...mode.launchArgs, ...(cliArgs || [])],
+    };
+}
+
 function readSubcommandSessionId(args: string[], subcommands: string[]): string | undefined {
     const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
     if (resumeIndex < 0) return undefined;
@@ -1048,6 +1083,17 @@ export class DaemonCliManager {
             console.log(colorize('cyan', `  📦 Using provider: ${provider.name} (${provider.type})`));
         }
 
+        const launchSettings = {
+            ...this.providerLoader.getSettings(normalizedType),
+            ...(options?.settingsOverride || {}),
+        };
+        const versionResolvedProvider = provider
+            ? (this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider)
+            : undefined;
+        const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+        const launchProvider = autoApproveLaunch.provider || provider;
+        const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+
  // ─── Model axis (MAGI kind-panel): expand initialModel → launch args ───
  // For a plain CLI provider the model is selected at spawn time via the manifest's
  // modelLaunchArgs template ('{{model}}' → the requested model). ACP providers took
@@ -1055,10 +1101,10 @@ export class DaemonCliManager {
  // or no requested model, is a no-op — model selection is best-effort and must never
  // fail a launch. The model args are prepended so a caller's explicit cliArgs (e.g. a
  // resume flag) still win positionally where order matters.
-        const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
+        const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
         const cliArgsWithModel = modelLaunchArgs
-            ? [...modelLaunchArgs, ...(cliArgs || [])]
-            : cliArgs;
+            ? [...modelLaunchArgs, ...(cliArgsWithAutoApprove || [])]
+            : cliArgsWithAutoApprove;
         if (initialModel && !modelLaunchArgs) {
             LOG.warn('CLI', `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template — launching without model selection.`);
         }
@@ -1069,7 +1115,7 @@ export class DaemonCliManager {
  // Best-effort; a provider with no template (or no requested level) is a no-op. ACP
  // providers route thinking through setConfigOption('thought_level') above.
         const initialThinkingLevel = options?.initialThinkingLevel;
-        const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+        const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
         const cliArgsWithBrain = thinkingLaunchArgs
             ? [...thinkingLaunchArgs, ...(cliArgsWithModel || [])]
             : cliArgsWithModel;
@@ -1078,13 +1124,13 @@ export class DaemonCliManager {
         }
 
  // ─── Resolve launch options → provider session binding ───
-        const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+        const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
         const resolvedCliArgs = sessionBinding.cliArgs;
 
  // If InstanceManager exists, manage as CliProviderInstance unified
         const instanceManager = this.deps.getInstanceManager();
-        if (provider && instanceManager) {
-            const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+        if (launchProvider && instanceManager) {
+            const resolvedProvider = launchProvider;
             await this.registerCliInstance(
                 key,
                 normalizedType,
@@ -1092,7 +1138,7 @@ export class DaemonCliManager {
                 resolvedDir,
                 resolvedCliArgs,
                 resolvedProvider,
-                { ...this.providerLoader.getSettings(normalizedType), ...(options?.settingsOverride || {}) },
+                launchSettings,
                 false,
                 {
                     providerSessionId: sessionBinding.providerSessionId,

package/src/index.ts

@@ -143,6 +143,8 @@ export type {
 export {
   DEFAULT_MESH_POLICY,
   resolveDelegatedWorkerAutoApprove,
+  delegatedWorkerAutoApproveSettings,
+  resolveDelegatedWorkerDangerousModeAllow,
   resolveAllowSendKeysDestructive,
   resolveMagiSessionCleanupMode,
   magiAutoLaunchedSessionCleanupDecision,
@@ -489,7 +491,7 @@ export { ProviderInstanceManager } from './providers/provider-instance-manager.j
 export { IdeProviderInstance } from './providers/ide-provider-instance.js';
 export { CliProviderInstance } from './providers/cli-provider-instance.js';
 export { AcpProviderInstance } from './providers/acp-provider-instance.js';
-export type { ProviderModule, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
+export type { ProviderModule, AutoApproveMode, AutoApproveModesConfig, AutoApproveModeRisk, AutoApproveModeStrategy, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
 export type { ProviderSourceConfigSnapshot, ProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { parseProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { normalizeInputEnvelope, normalizeMessageParts, flattenMessageParts } from './providers/io-contracts.js';

package/src/mesh/mesh-completion-synthesis.ts

@@ -26,7 +26,7 @@ import { getActiveDirectDispatches, getQueue } from './mesh-work-queue.js';
 import { readLedgerEntries } from './mesh-ledger.js';
 import { pruneStaleDirectDispatches } from './mesh-active-work.js';
 import { reconcileDirectDispatchCompletionFromTranscript } from './mesh-events-stale.js';
-import { extractFinalAssistantSummaryEvidence } from '../providers/chat-message-normalization.js';
+import { extractFinalAssistantSummaryEvidence, hasTrailingToolActivityAfterFinalAssistant } from '../providers/chat-message-normalization.js';
 import type { ChatMessage } from '../types.js';
 import {
     getMeshV2BackstopCounters,
@@ -483,6 +483,17 @@ export async function pollAssignedTaskTerminalEvidence(
     const evidence = extractFinalAssistantSummaryEvidence(messages);
     if (!evidence.finalSummary) return null; // idle but no assistant result yet → not a turn-end
 
+    // EARLY-IDLE-COMPLETION-FALSE-POSITIVE (poll defense-in-depth): a momentary idle read
+    // (startup-grace, or the sliver between an assistant preamble and the tool it fires) can
+    // show an assistant "Let me explore…" bubble FOLLOWED by trailing Read/Grep tool_use — a
+    // turn that is still executing, not a turn-end. selectFinalAssistantTurnEndMessage skips
+    // those trailing tool bubbles and would promote the preamble, so guard here: if a
+    // tool/terminal activity bubble trails the final assistant message, the worker is mid-turn
+    // — refuse the completion (fall through to the caller's reclaim/grace path). A genuinely
+    // finished pure-PTY worker ends on its final assistant with no trailing tool activity, so
+    // the kimi rescue is preserved.
+    if (hasTrailingToolActivityAfterFinalAssistant(messages)) return null;
+
     // Stale-summary guard (same bar as PHASE 4): a reused session's transcript tail may hold a
     // PRIOR task's summary. Require the final assistant message to be dated at/after THIS task's
     // dispatch. When either timestamp is unusable, do NOT short-circuit — fall through so we never

package/src/mesh/mesh-event-forwarding.ts

@@ -16,7 +16,7 @@ import { resolveMeshHostStatus } from './mesh-host-ownership.js';
 import { enqueueUnresolvedDelegateForward, nudgeUnresolvedForwardRetry } from './mesh-unresolved-forward-outbox.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { getLastDisplayMessage } from '../status/snapshot.js';
-import { resolveDelegatedWorkerAutoApprove } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings } from '../repo-mesh-types.js';
 import { meshNodeIdMatches, daemonIdsEquivalent, expandDaemonIdForms, sessionIdsEquivalent, withStatusProbeMarker, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
@@ -1614,7 +1614,11 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
                                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                                     // Coordinator-dispatched recovery relaunch: same auto-approve
                                     // policy as the primary worker launch path.
-                                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                                    ...delegatedWorkerAutoApproveSettings(
+                                        mesh?.policy,
+                                        node?.policy,
+                                        components.providerLoader?.getMeta(recoveryContext.failedProviderType),
+                                    ),
                                     launchedByCoordinator: true,
                                 }
                             }).catch((e: any) => LOG.error('MeshRecovery', `Failed to auto-relaunch session for ${node.id}: ${e?.message}`));

package/src/mesh/mesh-queue-assignment.ts

@@ -13,7 +13,7 @@ import { createSessionDelivery, updateSessionDeliveryStatus } from './mesh-deliv
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { traceMeshEventDrop } from './mesh-event-trace.js';
 import { awaitWithWarmupDeadline, resolveWarmupDeadlineOpts } from './mesh-warmup-deadline.js';
-import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, canonicalDaemonId, expandDaemonIdForms, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, sessionIdsEquivalent, normalizeNodeCapabilitySlots, isMeshTaskDifficulty, withStatusProbeMarker, type MeshNodeIdentified, type NodeCapabilitySlot, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
 import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
@@ -690,7 +690,7 @@ export function tryAssignQueueTask(
         if (inst && typeof inst.updateSettings === 'function') {
             // Adopting a (possibly manually-opened) local session as a worker: apply the
             // delegated-worker auto-approve policy here too, so a session that was launched
-            // without autoApprove still auto-approves once the coordinator dispatches a task
+            // without an auto-approve boolean/mode still resolves the delegated policy once dispatched
             // to it (the "approval notification fires only for certain delegated sessions"
             // case). updateSettings preserves runtime mesh keys; passing autoApprove keeps it.
             //
@@ -704,7 +704,11 @@ export function tryAssignQueueTask(
                 meshNodeFor: meshId,
                 meshNodeId: nodeId,
                 launchedByCoordinator: true,
-                autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                ...delegatedWorkerAutoApproveSettings(
+                    mesh?.policy,
+                    node?.policy,
+                    components.providerLoader?.getMeta(providerType),
+                ),
                 ...(localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {}),
                 // COMPLETION-PROPAGATION F5: (re)stamp the coordinator SESSION anchor from THIS
                 // task's sourceCoordinatorSessionId with PRIORITY — a manually-launched (or reused)
@@ -2318,8 +2322,12 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                     // Coordinator-dispatched worker: auto-approve unless mesh/node policy
                     // opts out (default true). Lands in settingsOverride and beats the
-                    // global per-provider-type autoApprove config (see shouldAutoApprove).
-                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                    // global per-provider-type boolean/mode through explicit opposite-key clearing.
+                    ...delegatedWorkerAutoApproveSettings(
+                        mesh?.policy,
+                        node?.policy,
+                        components.providerLoader?.getMeta(resolved.providerType),
+                    ),
                     launchedByCoordinator: true,
                     autoLaunchedForQueueTaskId: task.id,
                 };
@@ -2984,4 +2992,3 @@ export function runIdleMaintenanceThenAssignQueue(components: DaemonComponents,
             });
     });
 }
-

package/src/mesh/mesh-reconcile-loop.ts

@@ -69,13 +69,15 @@ import {
     resolveCoordinatorDaemonIds,
     daemonHostsMesh,
     resolveCoordinatorSelfIds,
+    daemonIdListIncludes,
 } from './mesh-reconcile-identity.js';
 import {
     resolveAutoPruneMinAgeMs,
     resolvePendingHeldDrainEscalateMs,
     resolveReconcileIntervalMs,
 } from './mesh-reconcile-config.js';
-import { pullRemoteNodeQueues, pullPendingEventsFromNode } from './mesh-remote-event-pull.js';
+import { pullRemoteNodeQueues, pullPendingEventsFromNode, reprobeWorkerStatus } from './mesh-remote-event-pull.js';
+import { isPurePtyTranscriptProvider } from '../cli-adapters/provider-cli-shared.js';
 import { runDiskRetentionSweep, detectAndSignalOrphanWorktrees } from './mesh-disk-retention.js';
 import {
     reconcileUnterminatedDirectDispatches,
@@ -787,6 +789,118 @@ function assignedRowLiveStatusIsAwaitingApproval(
     }
 }
 
+// EARLY-IDLE-COMPLETION-FALSE-POSITIVE — resolve whether the assigned session's provider is
+// the pure-PTY transcript class (kimi and kin — no native history, no provider authority), from
+// the LOCAL instance when it is present. Returns:
+//   true      → local instance is a pure-PTY provider (the class the early rescue exists for)
+//   false     → local instance is NOT pure-PTY (native / provider-authoritative)
+//   undefined → no local instance (remote worker / gone / id-form skew) — pure-PTY unknowable here
+// A remote pure-PTY worker is handled by the reprobe path (a fresh-idle read positively confirms
+// the session is settled before the streak accrues), not by this local-only capability check.
+function resolveLocalSessionPurePty(components: DaemonComponents, sessionId: string): boolean | undefined {
+    try {
+        const instances = components.instanceManager?.getByCategory?.('cli') || [];
+        const inst = instances.find((i: any) => {
+            const sid = readNonEmptyString(i?.getState?.().instanceId);
+            return sid && sessionIdsEquivalent(sid, sessionId);
+        }) as { provider?: unknown } | undefined;
+        if (!inst) return undefined; // remote / gone / id-form skew — not locally observable
+        const provider = inst.provider;
+        if (!provider || typeof provider !== 'object') return undefined;
+        return isPurePtyTranscriptProvider(provider as Parameters<typeof isPurePtyTranscriptProvider>[0]);
+    } catch {
+        return undefined;
+    }
+}
+
+// EARLY-IDLE-COMPLETION-FALSE-POSITIVE — decide whether the early transcript-evidence completion
+// streak may ACCRUE this tick for an assigned row. This hardens the original arm gate, which only
+// checked `resolveSessionBusyVerdict(...) !== 'GENERATING'` — a gate a REMOTE worker (local verdict
+// UNKNOWN, not GENERATING) passed unconditionally, so its "8s continuous idle" streak degenerated to
+// 8s of wall-clock even while the worker was genuinely mid-turn, and a startup-grace boot-window idle
+// (before the first turn ever started) also passed. The row was then early-completed off a preamble.
+//
+// Two added requirements, defense-in-depth on top of the existing confirmed-delivery / no-terminal-
+// ledger / bound-session gate the caller applies:
+//   (a) POSITIVE idle evidence, not merely "not GENERATING". A LOCAL IDLE_CONFIRMED verdict qualifies
+//       directly. A remote/UNKNOWN verdict is RE-PROBED with a fresh read_chat status this tick: only
+//       a definitively 'idle' read lets the streak accrue; any active status (generating/waiting/…),
+//       or an inconclusive read, resets it. This is what stops the remote worker's mid-turn busy from
+//       silently passing as "continuous idle".
+//   (b) TURN-START evidence, so a boot-window / never-consumed idle cannot early-complete a preamble.
+//       taskDeliveryConsumed===true (the worker emitted agent:generating_started) satisfies it. When
+//       the delivery was never consumed, only a LOCAL pure-PTY provider — the exact class that never
+//       emits generating_started and that this rescue exists for — is still allowed; a native/
+//       provider-authoritative worker that hasn't started its turn is NOT armed (it will complete via
+//       its own emit or the normal grace). A remote-not-consumed worker whose provider class is
+//       unknowable locally falls back to the reprobe: it may accrue only once (a) reads it positively
+//       idle, and the poll's post-dispatch + trailing-tool-activity guards remain the final net.
+async function evaluateEarlyIdleTranscriptArm(
+    components: DaemonComponents,
+    mesh: { id: string; nodes?: Array<{ id: string; daemonId?: string; workspace?: string }> },
+    store: MeshRuntimeStore,
+    row: { id: string; assignedSessionId?: string; assignedNodeId?: string; assignedProviderType?: string },
+    localDaemonId?: string,
+    selfIds: string[] = [],
+): Promise<boolean> {
+    const sessionId = readNonEmptyString(row.assignedSessionId);
+    if (!sessionId) return false;
+
+    // (a) POSITIVE idle evidence.
+    const verdict = resolveSessionBusyVerdict(components, sessionId);
+    if (verdict === 'GENERATING') return false; // locally observed mid-turn — never accrue
+    if (verdict === 'UNKNOWN') {
+        // Remote / gone / id-form skew. First consult the LIVE mesh node snapshot (the same
+        // cross-daemon status feed the approval-hold guard and mesh_status use): if it already
+        // reports a definitively NON-idle status (generating / waiting_approval / awaiting_choice /
+        // …), the worker is not settled — reset the streak WITHOUT a read_chat. This keeps the
+        // streak the cheap per-tick gate for the common case and avoids probing a worker the graph
+        // already knows is busy or parked at an approval.
+        const nodeId = readNonEmptyString(row.assignedNodeId);
+        const node = (mesh.nodes ?? []).find(n => n.id === nodeId);
+        const liveStatus = nodeId
+            ? readNonEmptyString(sessionStatusFromNodes(mesh.nodes, nodeId, sessionId).status).toLowerCase()
+            : '';
+        if (liveStatus && liveStatus !== 'idle') return false; // live graph says non-idle → not a turn-end
+        if (!liveStatus) {
+            // No live snapshot for this session — re-probe the worker's own status this tick so a
+            // genuinely busy remote worker breaks the streak instead of coasting through as "not
+            // GENERATING". getInstance may be absent on some component surfaces (tests / standalone),
+            // so guard it.
+            const nodeDaemonId = readNonEmptyString(node?.daemonId);
+            const isLocalNode = !nodeDaemonId
+                || daemonIdsEquivalent(nodeDaemonId, localDaemonId)
+                || daemonIdListIncludes(selfIds, nodeDaemonId)
+                || !!components.instanceManager?.getInstance?.(sessionId);
+            const providerType = readNonEmptyString(row.assignedProviderType);
+            const readArgs: Record<string, unknown> = {
+                sessionId,
+                targetSessionId: sessionId,
+                tailLimit: 1,
+                ...(node?.workspace ? { workspace: node.workspace } : {}),
+                ...(providerType ? { agentType: providerType, providerType } : {}),
+            };
+            const probedStatus = await reprobeWorkerStatus(components, { isLocalNode, nodeDaemonId, readArgs });
+            // Only a positively-idle re-probe lets the streak accrue. A non-idle status (the worker
+            // IS busy) or an inconclusive read (null — transport error / no payload) resets it: we
+            // never treat "couldn't tell" as idle for this early-completion path.
+            if (probedStatus !== 'idle') return false;
+        }
+    }
+
+    // (b) TURN-START evidence (guards the boot-window / preamble false positive).
+    if (store.taskDeliveryConsumed(mesh.id, row.id)) return true; // worker emitted generating_started
+    // Delivery never consumed. Preserve the kimi rescue ONLY for the LOCAL pure-PTY class (which
+    // never emits generating_started); a native/provider-authoritative local worker that hasn't
+    // started its turn must NOT be armed off a boot-window idle. For a remote worker (pure-PTY
+    // unknowable here) the positive-idle reprobe in (a) is the gate — allow accrual and let the poll
+    // enforce post-dispatch + trailing-tool-activity finality.
+    const localPurePty = resolveLocalSessionPurePty(components, sessionId);
+    if (localPurePty === true) return true;   // local pure-PTY — the class this rescue targets
+    if (localPurePty === false) return false; // local native/provider-owned, turn not started — hold
+    return verdict === 'UNKNOWN';             // remote, unknowable class — trust the (a) reprobe
+}
+
 // PHASE 2.5 — assigned-stranded dispatch watchdog (Bug B). claimNextTask atomically
 // flips a row to 'assigned' BEFORE the fire-and-forget dispatch runs. If that dispatch
 // neither rejects (→ no .catch requeue) nor is confirmed delivered — a relay that hangs
@@ -840,12 +954,18 @@ async function recoverStrandedAssignedDispatches(
         // elapses. pollAssignedTaskTerminalEvidence enforces idle + final-assistant-after-dispatch, so
         // a mid-turn / stale-tail / unreadable worker is never falsely completed — a non-qualifying
         // tick clears the streak below.
-        if (
+        // EARLY-IDLE-COMPLETION-FALSE-POSITIVE: the arm gate now requires POSITIVE idle evidence
+        // (a fresh-idle reprobe for a remote/UNKNOWN worker, not merely "not GENERATING") AND
+        // turn-start evidence (delivery consumed, or the local pure-PTY class this rescue targets),
+        // so a mid-turn remote worker or a boot-window preamble can no longer coast the continuous-
+        // idle streak to a false completion. See evaluateEarlyIdleTranscriptArm.
+        const earlyArm =
             store.taskHasConfirmedDelivery(meshId, row.id)
             && !findTerminalLedgerEvidenceForTask({ meshId, taskId: row.id })
             && readNonEmptyString(row.assignedSessionId)
-            && resolveSessionBusyVerdict(components, row.assignedSessionId!) !== 'GENERATING'
-        ) {
+                ? await evaluateEarlyIdleTranscriptArm(components, mesh, store, row, localDaemonId, selfIds)
+                : false;
+        if (earlyArm) {
             const since = assignedIdleFinalAssistantSince.get(idleTranscriptStreakKey);
             if (since === undefined) {
                 assignedIdleFinalAssistantSince.set(idleTranscriptStreakKey, nowMs);