@adhdev/daemon-core 1.0.18-rc.16 → 1.0.18-rc.17

package/dist/providers/auto-approve-modes.d.ts

@@ -0,0 +1,14 @@
+import type { AutoApproveMode, AutoApproveModeRisk, AutoApproveModeStrategy, ProviderModule } from './contracts.js';
+export interface ResolvedAutoApproveMode {
+    active: boolean;
+    strategy: AutoApproveModeStrategy;
+    modeId: string;
+}
+/** Runtime defense-in-depth for provider definitions that bypass schema validation. */
+export declare function deriveAutoApproveModeRisk(mode: Pick<AutoApproveMode, 'risk' | 'launchArgs'>): AutoApproveModeRisk;
+/**
+ * Resolve new mode settings before the legacy boolean. A stale/unknown explicit
+ * mode id fails closed instead of falling through to an enabled legacy setting.
+ */
+export declare function resolveProviderAutoApproveMode(provider: ProviderModule, settings: Record<string, unknown> | undefined): ResolvedAutoApproveMode;
+export declare function findProviderAutoApproveMode(provider: ProviderModule | undefined, modeId: string): AutoApproveMode | undefined;

package/dist/providers/cli-provider-instance.d.ts

@@ -810,7 +810,11 @@ export declare class CliProviderInstance implements ProviderInstance {
     getAdapter(): ProviderCliAdapter;
     get cliType(): string;
     get cliName(): string;
+    private resolveAutoApproveMode;
+    /** Legacy boolean view retained for internal/test compatibility. */
     private shouldAutoApprove;
+    private shouldUsePtyAutoApprove;
+    private resetPtyAutoApproveState;
     /** @see ProviderInstance.noteManualInteraction */
     noteManualInteraction(now?: number, opts?: {
         passive?: boolean;

package/dist/providers/contracts.d.ts

@@ -389,6 +389,21 @@ export interface ProviderCompatibilityEntry {
     ideVersion: string;
     scriptDir: string;
 }
+export type AutoApproveModeStrategy = 'pty-parse-default' | 'launch-args' | 'post-boot-command';
+export type AutoApproveModeRisk = 'safe' | 'caution' | 'dangerous';
+export interface AutoApproveMode {
+    id: string;
+    label: string;
+    strategy: AutoApproveModeStrategy;
+    risk: AutoApproveModeRisk;
+    warning?: string;
+    launchArgs?: string[];
+    removeArgs?: string[];
+}
+export interface AutoApproveModesConfig {
+    default: string;
+    modes: AutoApproveMode[];
+}
 export interface ProviderModule {
     /** Unique identifier (e.g. 'cline', 'cursor', 'gemini-cli') */
     type: string;
@@ -418,6 +433,8 @@ export interface ProviderModule {
     status?: string;
     /** Inventory/support detail string maintained in adhdev-providers */
     details?: string;
+    /** Provider-specific auto-approve choices and their launch/runtime strategy. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** Install instructions (shown when command is missing) */
     install?: string;
     /** Custom version detection command (e.g. 'cursor --version', 'claude -v') */

package/dist/providers/provider-schema.d.ts

@@ -3,3 +3,4 @@ export interface ProviderValidationResult {
     warnings: string[];
 }
 export declare function validateProviderDefinition(raw: unknown): ProviderValidationResult;
+export declare function validateAutoApproveModes(raw: unknown, errors: string[]): void;

package/dist/repo-mesh-types.d.ts

@@ -14,6 +14,7 @@ import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
 import type { MagiKindPanelMap, DifficultyBrainMap, NodeCapabilitySlot } from '@adhdev/mesh-shared';
+import type { ProviderModule } from './providers/contracts.js';
 export interface RepoMesh {
     id: string;
     name: string;
@@ -255,6 +256,8 @@ export interface RepoMeshPolicy {
      * A node policy may override this per-node (RepoMeshNodePolicy.delegatedWorkerAutoApprove).
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Explicit opt-in required before delegated workers may use a dangerous provider mode. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): opt-in to allow the coordinator to inject
      * DESTRUCTIVE keys (CTRL_C / ESC) into a worker PTY via mesh_send_keys. These
@@ -406,6 +409,8 @@ export interface RepoMeshNodePolicy {
      * precedence over the mesh-level policy for worker sessions launched onto this node.
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Per-node override for dangerous delegated worker mode authorization. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): per-node override for
      * RepoMeshPolicy.allowSendKeysDestructive.
@@ -524,13 +529,18 @@ export declare function normalizeAutoFastForwardPolicy(value: unknown): NonNulla
  */
 export declare function mergeAndNormalizePolicy(base: RepoMeshPolicy | undefined, patch: Partial<RepoMeshPolicy> | undefined): RepoMeshPolicy;
 /**
- * Resolve whether a delegated worker session launched onto `nodePolicy` (within a mesh
- * governed by `meshPolicy`) should auto-approve. Precedence: node override → mesh policy
- * → default true. The result is stamped into the worker launch settings envelope as
- * `autoApprove`; it wins over the global per-provider-type autoApprove config because the
- * launch path merges the envelope as a settingsOverride on top of the provider defaults.
+ * Resolve delegated worker auto-approve. Legacy providers return a boolean. Providers
+ * with modes return the default mode id, except a dangerous default is downgraded to a
+ * non-dangerous PTY mode unless mesh/node policy explicitly opts in.
  */
-export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove'> | null): boolean;
+export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null): boolean | string;
+export declare function resolveDelegatedWorkerDangerousModeAllow(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerDangerousModeAllow'> | null): boolean;
+/** Shape a boolean-or-mode resolution for the settings precedence contract. */
+export declare function delegatedWorkerAutoApproveSettings(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null): {
+    autoApprove: boolean | undefined;
+    autoApproveMode: string | undefined;
+    delegatedWorkerDangerousModeAllow: boolean;
+};
 /**
  * MESH-SEND-KEYS (feature 3): resolve whether DESTRUCTIVE key injection
  * (CTRL_C/ESC via mesh_send_keys) is permitted for a node. Node policy overrides

package/dist/shared-types.d.ts

@@ -13,7 +13,7 @@ export type { ProviderState, ProviderStatus, ActiveChatData, IdeProviderState, C
 export type { ProviderErrorReason } from './providers/provider-instance.js';
 import type { ActiveChatData as _ActiveChatData, ProviderErrorReason as _ProviderErrorReason } from './providers/provider-instance.js';
 import type { WorkspaceEntry } from './config/workspaces.js';
-import type { ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
+import type { AutoApproveModesConfig, ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
 import type { GitCompactSummary, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams } from './git/git-types.js';
 import type { InteractivePrompt } from './providers/types/interactive-prompt.js';
 export type { GitCommandName, GitCompactSummary, GitDiffSummary, GitFailureReason, GitFileChange, GitFileChangeStatus, GitRepoIdentity, GitRepoStatus, GitSnapshot, GitSnapshotCompareSummary, GitSnapshotReason, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams, } from './git/git-types.js';
@@ -428,6 +428,8 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
+    /** Provider-declared auto-approve choices shown by session launch UIs. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** BRAIN-ROUTING: suggested model values for the new-session model dropdown. */
     modelOptions?: string[];
     /** BRAIN-ROUTING: reasoning-effort values for the new-session thinking dropdown. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.16",
+  "version": "1.0.18-rc.17",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.16",
-    "@adhdev/session-host-core": "1.0.18-rc.16",
+    "@adhdev/mesh-shared": "1.0.18-rc.17",
+    "@adhdev/session-host-core": "1.0.18-rc.17",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/cli-manager.ts

@@ -34,6 +34,7 @@ import type { SessionRegistry } from '../sessions/registry.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { LOG } from '../logging/logger.js';
 import { shouldRestoreHostedRuntime } from './hosted-runtime-restore.js';
+import { findProviderAutoApproveMode, resolveProviderAutoApproveMode } from '../providers/auto-approve-modes.js';
 
 // ─── external dependency interface ──────────────────────────
 
@@ -452,6 +453,40 @@ export function expandThinkingLaunchArgs(
     return template.map((part) => part.includes('{{level}}') ? part.replace('{{level}}', mapped) : part);
 }
 
+function matchesRemovedLaunchArg(arg: string, removeArg: string): boolean {
+    return arg === removeArg || (removeArg.startsWith('--') && arg.startsWith(`${removeArg}=`));
+}
+
+/**
+ * Apply a selected launch-args auto-approve mode without mutating provider metadata.
+ * removeArgs only targets provider-owned base spawn.args; launchArgs are prepended to
+ * per-launch args beside model/thinking args, making conflict removal order-independent.
+ */
+export function applyAutoApproveModeLaunchArgs(
+    provider: ProviderModule | undefined,
+    cliArgs: string[] | undefined,
+    settings: Record<string, unknown> | undefined,
+): { provider: ProviderModule | undefined; cliArgs: string[] | undefined } {
+    if (!provider) return { provider, cliArgs };
+    const resolved = resolveProviderAutoApproveMode(provider, settings);
+    if (!resolved.active || resolved.strategy !== 'launch-args') return { provider, cliArgs };
+    const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+    if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+
+    const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+    const baseArgs = provider.spawn?.args;
+    const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0
+        ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg)))
+        : baseArgs;
+    const launchProvider = filteredBaseArgs === baseArgs
+        ? provider
+        : { ...provider, spawn: { ...provider.spawn!, args: filteredBaseArgs } };
+    return {
+        provider: launchProvider,
+        cliArgs: [...mode.launchArgs, ...(cliArgs || [])],
+    };
+}
+
 function readSubcommandSessionId(args: string[], subcommands: string[]): string | undefined {
     const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
     if (resumeIndex < 0) return undefined;
@@ -1048,6 +1083,17 @@ export class DaemonCliManager {
             console.log(colorize('cyan', `  📦 Using provider: ${provider.name} (${provider.type})`));
         }
 
+        const launchSettings = {
+            ...this.providerLoader.getSettings(normalizedType),
+            ...(options?.settingsOverride || {}),
+        };
+        const versionResolvedProvider = provider
+            ? (this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider)
+            : undefined;
+        const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+        const launchProvider = autoApproveLaunch.provider || provider;
+        const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+
  // ─── Model axis (MAGI kind-panel): expand initialModel → launch args ───
  // For a plain CLI provider the model is selected at spawn time via the manifest's
  // modelLaunchArgs template ('{{model}}' → the requested model). ACP providers took
@@ -1055,10 +1101,10 @@ export class DaemonCliManager {
  // or no requested model, is a no-op — model selection is best-effort and must never
  // fail a launch. The model args are prepended so a caller's explicit cliArgs (e.g. a
  // resume flag) still win positionally where order matters.
-        const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
+        const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
         const cliArgsWithModel = modelLaunchArgs
-            ? [...modelLaunchArgs, ...(cliArgs || [])]
-            : cliArgs;
+            ? [...modelLaunchArgs, ...(cliArgsWithAutoApprove || [])]
+            : cliArgsWithAutoApprove;
         if (initialModel && !modelLaunchArgs) {
             LOG.warn('CLI', `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template — launching without model selection.`);
         }
@@ -1069,7 +1115,7 @@ export class DaemonCliManager {
  // Best-effort; a provider with no template (or no requested level) is a no-op. ACP
  // providers route thinking through setConfigOption('thought_level') above.
         const initialThinkingLevel = options?.initialThinkingLevel;
-        const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+        const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
         const cliArgsWithBrain = thinkingLaunchArgs
             ? [...thinkingLaunchArgs, ...(cliArgsWithModel || [])]
             : cliArgsWithModel;
@@ -1078,13 +1124,13 @@ export class DaemonCliManager {
         }
 
  // ─── Resolve launch options → provider session binding ───
-        const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+        const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
         const resolvedCliArgs = sessionBinding.cliArgs;
 
  // If InstanceManager exists, manage as CliProviderInstance unified
         const instanceManager = this.deps.getInstanceManager();
-        if (provider && instanceManager) {
-            const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+        if (launchProvider && instanceManager) {
+            const resolvedProvider = launchProvider;
             await this.registerCliInstance(
                 key,
                 normalizedType,
@@ -1092,7 +1138,7 @@ export class DaemonCliManager {
                 resolvedDir,
                 resolvedCliArgs,
                 resolvedProvider,
-                { ...this.providerLoader.getSettings(normalizedType), ...(options?.settingsOverride || {}) },
+                launchSettings,
                 false,
                 {
                     providerSessionId: sessionBinding.providerSessionId,

package/src/index.ts

@@ -143,6 +143,8 @@ export type {
 export {
   DEFAULT_MESH_POLICY,
   resolveDelegatedWorkerAutoApprove,
+  delegatedWorkerAutoApproveSettings,
+  resolveDelegatedWorkerDangerousModeAllow,
   resolveAllowSendKeysDestructive,
   resolveMagiSessionCleanupMode,
   magiAutoLaunchedSessionCleanupDecision,
@@ -489,7 +491,7 @@ export { ProviderInstanceManager } from './providers/provider-instance-manager.j
 export { IdeProviderInstance } from './providers/ide-provider-instance.js';
 export { CliProviderInstance } from './providers/cli-provider-instance.js';
 export { AcpProviderInstance } from './providers/acp-provider-instance.js';
-export type { ProviderModule, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
+export type { ProviderModule, AutoApproveMode, AutoApproveModesConfig, AutoApproveModeRisk, AutoApproveModeStrategy, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
 export type { ProviderSourceConfigSnapshot, ProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { parseProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { normalizeInputEnvelope, normalizeMessageParts, flattenMessageParts } from './providers/io-contracts.js';

package/src/mesh/mesh-event-forwarding.ts

@@ -16,7 +16,7 @@ import { resolveMeshHostStatus } from './mesh-host-ownership.js';
 import { enqueueUnresolvedDelegateForward, nudgeUnresolvedForwardRetry } from './mesh-unresolved-forward-outbox.js';
 import { traceMeshEventStage, traceMeshEventDrop } from './mesh-event-trace.js';
 import { getLastDisplayMessage } from '../status/snapshot.js';
-import { resolveDelegatedWorkerAutoApprove } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings } from '../repo-mesh-types.js';
 import { meshNodeIdMatches, daemonIdsEquivalent, expandDaemonIdForms, sessionIdsEquivalent, withStatusProbeMarker, type MeshNodeIdentified } from '@adhdev/mesh-shared';
 import {
     findRecentTerminalLedgerEvidence,
@@ -1614,7 +1614,11 @@ function injectMeshSystemMessage(components: DaemonComponents, args: {
                                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                                     // Coordinator-dispatched recovery relaunch: same auto-approve
                                     // policy as the primary worker launch path.
-                                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                                    ...delegatedWorkerAutoApproveSettings(
+                                        mesh?.policy,
+                                        node?.policy,
+                                        components.providerLoader?.getMeta(recoveryContext.failedProviderType),
+                                    ),
                                     launchedByCoordinator: true,
                                 }
                             }).catch((e: any) => LOG.error('MeshRecovery', `Failed to auto-relaunch session for ${node.id}: ${e?.message}`));

package/src/mesh/mesh-queue-assignment.ts

@@ -13,7 +13,7 @@ import { createSessionDelivery, updateSessionDeliveryStatus } from './mesh-deliv
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { traceMeshEventDrop } from './mesh-event-trace.js';
 import { awaitWithWarmupDeadline, resolveWarmupDeadlineOpts } from './mesh-warmup-deadline.js';
-import { resolveDelegatedWorkerAutoApprove, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
+import { delegatedWorkerAutoApproveSettings, resolveProviderMaxParallel, resolveNodeSchedulingPriority, normalizeMeshSchedulingStrategy, resolveMaxParallelTasks, resolveMaxReadonlyParallelTasks, resolveCoordinatorIdlePushPolicy } from '../repo-mesh-types.js';
 import type { RepoMeshSchedulingStrategy } from '../repo-mesh-types.js';
 import { normalizeMeshNodeId, meshNodeIdMatches, daemonIdsEquivalent, canonicalDaemonId, expandDaemonIdForms, normalizeMeshWorkspaceForCompare, meshWorkspacesEquivalent, sessionIdsEquivalent, normalizeNodeCapabilitySlots, isMeshTaskDifficulty, withStatusProbeMarker, type MeshNodeIdentified, type NodeCapabilitySlot, type MeshTaskDifficulty } from '@adhdev/mesh-shared';
 import { resolveNodeCapabilitySlots } from './mesh-node-slots.js';
@@ -690,7 +690,7 @@ export function tryAssignQueueTask(
         if (inst && typeof inst.updateSettings === 'function') {
             // Adopting a (possibly manually-opened) local session as a worker: apply the
             // delegated-worker auto-approve policy here too, so a session that was launched
-            // without autoApprove still auto-approves once the coordinator dispatches a task
+            // without an auto-approve boolean/mode still resolves the delegated policy once dispatched
             // to it (the "approval notification fires only for certain delegated sessions"
             // case). updateSettings preserves runtime mesh keys; passing autoApprove keeps it.
             //
@@ -704,7 +704,11 @@ export function tryAssignQueueTask(
                 meshNodeFor: meshId,
                 meshNodeId: nodeId,
                 launchedByCoordinator: true,
-                autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                ...delegatedWorkerAutoApproveSettings(
+                    mesh?.policy,
+                    node?.policy,
+                    components.providerLoader?.getMeta(providerType),
+                ),
                 ...(localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {}),
                 // COMPLETION-PROPAGATION F5: (re)stamp the coordinator SESSION anchor from THIS
                 // task's sourceCoordinatorSessionId with PRIORITY — a manually-launched (or reused)
@@ -2318,8 +2322,12 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                     spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || 'hidden',
                     // Coordinator-dispatched worker: auto-approve unless mesh/node policy
                     // opts out (default true). Lands in settingsOverride and beats the
-                    // global per-provider-type autoApprove config (see shouldAutoApprove).
-                    autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                    // global per-provider-type boolean/mode through explicit opposite-key clearing.
+                    ...delegatedWorkerAutoApproveSettings(
+                        mesh?.policy,
+                        node?.policy,
+                        components.providerLoader?.getMeta(resolved.providerType),
+                    ),
                     launchedByCoordinator: true,
                     autoLaunchedForQueueTaskId: task.id,
                 };
@@ -2984,4 +2992,3 @@ export function runIdleMaintenanceThenAssignQueue(components: DaemonComponents,
             });
     });
 }
-

package/src/providers/auto-approve-modes.ts

@@ -0,0 +1,97 @@
+import type {
+  AutoApproveMode,
+  AutoApproveModeRisk,
+  AutoApproveModeStrategy,
+  ProviderModule,
+} from './contracts.js';
+
+const KNOWN_DANGEROUS_LAUNCH_ARGS = new Set([
+  '--dangerously-skip-permissions',
+  '--dangerously-bypass-approvals-and-sandbox',
+  'bypassPermissions',
+  'sandbox_mode=danger-full-access',
+  'approval_policy=never',
+]);
+
+export interface ResolvedAutoApproveMode {
+  active: boolean;
+  strategy: AutoApproveModeStrategy;
+  modeId: string;
+}
+
+function isKnownDangerousLaunchArg(arg: string): boolean {
+  const normalized = arg.trim();
+  if (KNOWN_DANGEROUS_LAUNCH_ARGS.has(normalized)) return true;
+  return normalized.startsWith('--dangerously-skip-permissions=')
+    || normalized.startsWith('--dangerously-bypass-approvals-and-sandbox=');
+}
+
+/** Runtime defense-in-depth for provider definitions that bypass schema validation. */
+export function deriveAutoApproveModeRisk(mode: Pick<AutoApproveMode, 'risk' | 'launchArgs'>): AutoApproveModeRisk {
+  return Array.isArray(mode.launchArgs) && mode.launchArgs.some(isKnownDangerousLaunchArg)
+    ? 'dangerous'
+    : mode.risk;
+}
+
+function inactiveMode(modeId = ''): ResolvedAutoApproveMode {
+  return { active: false, strategy: 'pty-parse-default', modeId };
+}
+
+function resolveConfiguredMode(
+  provider: ProviderModule,
+  mode: AutoApproveMode,
+  settings: Record<string, unknown> | undefined,
+): ResolvedAutoApproveMode {
+  if (mode.strategy === 'post-boot-command') return inactiveMode(mode.id);
+  if (settings?.launchedByCoordinator === true
+      && settings.delegatedWorkerDangerousModeAllow !== true
+      && deriveAutoApproveModeRisk(mode) === 'dangerous') {
+    const fallback = provider.autoApproveModes?.modes.find((candidate) =>
+      candidate.strategy === 'pty-parse-default'
+      && deriveAutoApproveModeRisk(candidate) !== 'dangerous');
+    return fallback
+      ? { active: true, strategy: fallback.strategy, modeId: fallback.id }
+      : inactiveMode(mode.id);
+  }
+  return { active: true, strategy: mode.strategy, modeId: mode.id };
+}
+
+/**
+ * Resolve new mode settings before the legacy boolean. A stale/unknown explicit
+ * mode id fails closed instead of falling through to an enabled legacy setting.
+ */
+export function resolveProviderAutoApproveMode(
+  provider: ProviderModule,
+  settings: Record<string, unknown> | undefined,
+): ResolvedAutoApproveMode {
+  const config = provider.autoApproveModes;
+  const explicitModeId = settings?.autoApproveMode;
+  if (typeof explicitModeId === 'string') {
+    const mode = config?.modes.find((candidate) => candidate.id === explicitModeId);
+    if (!mode) return inactiveMode(explicitModeId);
+    return resolveConfiguredMode(provider, mode, settings);
+  }
+
+  const explicitLegacy = settings?.autoApprove;
+  const providerLegacyDefault = provider.settings?.autoApprove?.default;
+  const legacyActive = typeof explicitLegacy === 'boolean'
+    ? explicitLegacy
+    : typeof providerLegacyDefault === 'boolean'
+      ? providerLegacyDefault
+      : false;
+  if (!legacyActive) return inactiveMode();
+
+  if (!config) {
+    return { active: true, strategy: 'pty-parse-default', modeId: 'legacy' };
+  }
+  const defaultMode = config.modes.find((mode) => mode.id === config.default);
+  if (!defaultMode) return inactiveMode(config.default);
+  return resolveConfiguredMode(provider, defaultMode, settings);
+}
+
+export function findProviderAutoApproveMode(
+  provider: ProviderModule | undefined,
+  modeId: string,
+): AutoApproveMode | undefined {
+  return provider?.autoApproveModes?.modes.find((mode) => mode.id === modeId);
+}

package/src/providers/cli-provider-instance.ts

@@ -75,6 +75,7 @@ import type {
 } from './cli-provider-instance-types.js';
 import { mergeConversationMessages, buildExternalTranscriptProbe } from './cli-provider-transcript-merge.js';
 import { getEffectDedupKey, formatApprovalRequestMessage, formatMarkerTimestamp } from './cli-provider-effect-format.js';
+import { resolveProviderAutoApproveMode, type ResolvedAutoApproveMode } from './auto-approve-modes.js';
 
 // Re-export moved public symbols so existing importers (index.ts, tests) keep
 // their `./cli-provider-instance.js` path. Pure move — no behavior change.
@@ -2780,7 +2781,7 @@ export class CliProviderInstance implements ProviderInstance {
      * resolveModal, so a plain turn that never saw an approval always returns false.
      */
     private inApprovalResumeGrace(now = Date.now()): boolean {
-        if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return false;
+        if (!this.isAutonomousMeshSession() || !this.shouldUsePtyAutoApprove()) return false;
         const resolvedAt = typeof (this.adapter as any)?.lastApprovalResolvedAt === 'number'
             ? (this.adapter as any).lastApprovalResolvedAt as number
             : 0;
@@ -2897,7 +2898,7 @@ export class CliProviderInstance implements ProviderInstance {
         }
 
         const latestStatus = this.adapter.getStatus({ allowParse: false });
-        const latestAutoApproveActive = latestStatus.status === 'waiting_approval' && this.shouldAutoApprove();
+        const latestAutoApproveActive = latestStatus.status === 'waiting_approval' && this.shouldUsePtyAutoApprove();
         const latestVisibleStatus = latestAutoApproveActive || this.autoApproveBusy ? 'generating' : latestStatus.status;
         LOG.debug('CLI', `[${this.type}] flush attempt: adapterStatus=${latestStatus.status} latestVisible=${latestVisibleStatus} generatingStartedAt=${this.generatingStartedAt} isWaitingForResponse=${!!(this.adapter as any)?.isWaitingForResponse} hasPartial=${!!this.adapter.getPartialResponse?.()}`);
         if (latestVisibleStatus !== 'idle') {
@@ -3300,7 +3301,7 @@ export class CliProviderInstance implements ProviderInstance {
     private stabilizeFlappingApprovalStatus(adapterStatus: any, now = Date.now()): any {
         // Only autonomous auto-approving mesh sessions are subject to the delegated flap;
         // never overlay for attended/foreground/non-mesh sessions.
-        if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return adapterStatus;
+        if (!this.isAutonomousMeshSession() || !this.shouldUsePtyAutoApprove()) return adapterStatus;
 
         const rawStatus = adapterStatus?.status;
         const resolvedAt = typeof (this.adapter as any)?.lastApprovalResolvedAt === 'number'
@@ -3347,6 +3348,13 @@ export class CliProviderInstance implements ProviderInstance {
     }
 
     private maybeAutoApproveStatus(adapterStatus: any, now = Date.now()): boolean {
+        // launch-args modes grant approval in the CLI process itself and therefore
+        // must never enter the PTY modal parser/fire/settle/mask/nudge subsystem.
+        // post-boot-command is reserved and resolves inactive in v1.
+        if (!this.shouldUsePtyAutoApprove()) {
+            this.resetPtyAutoApproveState();
+            return false;
+        }
         // Manual-attendance suppression (provider-common): when a human is
         // Manual-attendance suppression (provider-common): when a human is
         // actively driving this session from the dashboard, hold auto-approve so
@@ -3358,7 +3366,7 @@ export class CliProviderInstance implements ProviderInstance {
         // would otherwise never re-drive this decision. Background mesh workers
         // are never attended, so their delegated auto-approve is untouched.
         if (adapterStatus?.status === 'waiting_approval'
-            && this.shouldAutoApprove()
+            && this.shouldUsePtyAutoApprove()
             && this.manualAttendance.isAttended(now)) {
             this.lastAutoApprovalSignature = '';
             this.pendingAutoApprovalSignature = '';
@@ -3376,7 +3384,7 @@ export class CliProviderInstance implements ProviderInstance {
             }, this.manualAttendance.remainingMs(now) + 20);
             return false;
         }
-        const autoApproveActive = adapterStatus?.status === 'waiting_approval' && this.shouldAutoApprove();
+        const autoApproveActive = adapterStatus?.status === 'waiting_approval' && this.shouldUsePtyAutoApprove();
         // Guard re-entry: onStatusChange/getState can observe the same modal multiple
         // times while the PTY absorbs the approval key. Without this flag, repeated
         // snapshots would write stray keys into the input once the modal dismisses.
@@ -4652,15 +4660,37 @@ export class CliProviderInstance implements ProviderInstance {
     get cliType(): string { return this.type; }
     get cliName(): string { return this.provider.name; }
 
+    private resolveAutoApproveMode(): ResolvedAutoApproveMode {
+        return resolveProviderAutoApproveMode(this.provider, this.settings);
+    }
+
+    /** Legacy boolean view retained for internal/test compatibility. */
     private shouldAutoApprove(): boolean {
-        if (typeof this.settings.autoApprove === 'boolean') {
-            return this.settings.autoApprove;
+        return this.resolveAutoApproveMode().active;
+    }
+
+    private shouldUsePtyAutoApprove(): boolean {
+        const resolved = this.resolveAutoApproveMode();
+        return this.shouldAutoApprove() && resolved.strategy === 'pty-parse-default';
+    }
+
+    private resetPtyAutoApproveState(): void {
+        this.lastAutoApprovalSignature = '';
+        this.pendingAutoApprovalSignature = '';
+        this.pendingAutoApprovalSince = 0;
+        this.autoApproveInactiveSince = 0;
+        this.autoApproveMaskSince = 0;
+        this.stalledApprovalNudgeEpisode = 0;
+        this.autoApproveLastModalSeenAt = 0;
+        this.autoApproveBusy = false;
+        if (this.autoApproveSettleTimer) {
+            clearTimeout(this.autoApproveSettleTimer);
+            this.autoApproveSettleTimer = null;
         }
-        const providerDefault = this.provider.settings?.autoApprove?.default;
-        if (typeof providerDefault === 'boolean') {
-            return providerDefault;
+        if (this.autoApproveBusyTimer) {
+            clearTimeout(this.autoApproveBusyTimer);
+            this.autoApproveBusyTimer = null;
         }
-        return false;
     }
 
     /** @see ProviderInstance.noteManualInteraction */
@@ -4687,7 +4717,7 @@ export class CliProviderInstance implements ProviderInstance {
      */
     private autoApproveEffectivelyActive(status: string | undefined, now = Date.now()): boolean {
         return status === 'waiting_approval'
-            && this.shouldAutoApprove()
+            && this.shouldUsePtyAutoApprove()
             && !this.manualAttendance.isAttended(now);
     }
 
@@ -4699,7 +4729,8 @@ export class CliProviderInstance implements ProviderInstance {
     // maybeAutoApproveStatus (driven by getState + the recheck timer during a waiting episode);
     // this read is side-effect-free so getStatusMetadata can consult it too.
     private autoApproveMaskStalled(now = Date.now()): boolean {
-        return this.autoApproveMaskSince > 0
+        return this.shouldUsePtyAutoApprove()
+            && this.autoApproveMaskSince > 0
             && now - this.autoApproveMaskSince > CliProviderInstance.AUTO_APPROVE_MASK_STALL_MS;
     }
 
@@ -4725,6 +4756,7 @@ export class CliProviderInstance implements ProviderInstance {
      * mask-clock value) so a modal that flaps between parsed/unparsed states is announced once.
      */
     private maybeEmitStalledApprovalNudge(adapterStatus: any, now: number): void {
+        if (!this.shouldUsePtyAutoApprove()) return;
         if (!this.isMeshWorkerSession()) return;
         if (adapterStatus?.status !== 'waiting_approval') return;
         if (!this.autoApproveMaskStalled(now)) return;

package/src/providers/contracts.ts

@@ -488,6 +488,28 @@ export interface ProviderCompatibilityEntry {
   scriptDir: string;
 }
 
+export type AutoApproveModeStrategy =
+  | 'pty-parse-default'
+  | 'launch-args'
+  | 'post-boot-command';
+
+export type AutoApproveModeRisk = 'safe' | 'caution' | 'dangerous';
+
+export interface AutoApproveMode {
+  id: string;
+  label: string;
+  strategy: AutoApproveModeStrategy;
+  risk: AutoApproveModeRisk;
+  warning?: string;
+  launchArgs?: string[];
+  removeArgs?: string[];
+}
+
+export interface AutoApproveModesConfig {
+  default: string;
+  modes: AutoApproveMode[];
+}
+
 export interface ProviderModule {
  /** Unique identifier (e.g. 'cline', 'cursor', 'gemini-cli') */
   type: string;
@@ -519,7 +541,9 @@ export interface ProviderModule {
   status?: string;
  /** Inventory/support detail string maintained in adhdev-providers */
   details?: string;
- /** Install instructions (shown when command is missing) */
+  /** Provider-specific auto-approve choices and their launch/runtime strategy. */
+  autoApproveModes?: AutoApproveModesConfig;
+  /** Install instructions (shown when command is missing) */
   install?: string;
  /** Custom version detection command (e.g. 'cursor --version', 'claude -v') */
   versionCommand?: ProviderVersionCommand;