@adhdev/daemon-core 1.0.18-rc.16 → 1.0.18-rc.18

package/dist/index.js

@@ -30,6 +30,62 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/providers/auto-approve-modes.ts
+function isKnownDangerousLaunchArg(arg) {
+  const normalized = arg.trim();
+  if (KNOWN_DANGEROUS_LAUNCH_ARGS.has(normalized)) return true;
+  return normalized.startsWith("--dangerously-skip-permissions=") || normalized.startsWith("--dangerously-bypass-approvals-and-sandbox=");
+}
+function deriveAutoApproveModeRisk(mode) {
+  return Array.isArray(mode.launchArgs) && mode.launchArgs.some(isKnownDangerousLaunchArg) ? "dangerous" : mode.risk;
+}
+function inactiveMode(modeId = "") {
+  return { active: false, strategy: "pty-parse-default", modeId };
+}
+function resolveConfiguredMode(provider, mode, settings) {
+  if (mode.strategy === "post-boot-command") return inactiveMode(mode.id);
+  if (settings?.launchedByCoordinator === true && settings.delegatedWorkerDangerousModeAllow !== true && deriveAutoApproveModeRisk(mode) === "dangerous") {
+    const fallback = provider.autoApproveModes?.modes.find((candidate) => candidate.strategy === "pty-parse-default" && deriveAutoApproveModeRisk(candidate) !== "dangerous");
+    return fallback ? { active: true, strategy: fallback.strategy, modeId: fallback.id } : inactiveMode(mode.id);
+  }
+  return { active: true, strategy: mode.strategy, modeId: mode.id };
+}
+function resolveProviderAutoApproveMode(provider, settings) {
+  const config = provider.autoApproveModes;
+  const explicitModeId = settings?.autoApproveMode;
+  if (typeof explicitModeId === "string") {
+    const mode = config?.modes.find((candidate) => candidate.id === explicitModeId);
+    if (!mode) return inactiveMode(explicitModeId);
+    return resolveConfiguredMode(provider, mode, settings);
+  }
+  const explicitLegacy = settings?.autoApprove;
+  const providerLegacyDefault = provider.settings?.autoApprove?.default;
+  const legacyActive = typeof explicitLegacy === "boolean" ? explicitLegacy : typeof providerLegacyDefault === "boolean" ? providerLegacyDefault : false;
+  if (!legacyActive) return inactiveMode();
+  if (!config) {
+    return { active: true, strategy: "pty-parse-default", modeId: "legacy" };
+  }
+  const defaultMode = config.modes.find((mode) => mode.id === config.default);
+  if (!defaultMode) return inactiveMode(config.default);
+  return resolveConfiguredMode(provider, defaultMode, settings);
+}
+function findProviderAutoApproveMode(provider, modeId) {
+  return provider?.autoApproveModes?.modes.find((mode) => mode.id === modeId);
+}
+var KNOWN_DANGEROUS_LAUNCH_ARGS;
+var init_auto_approve_modes = __esm({
+  "src/providers/auto-approve-modes.ts"() {
+    "use strict";
+    KNOWN_DANGEROUS_LAUNCH_ARGS = /* @__PURE__ */ new Set([
+      "--dangerously-skip-permissions",
+      "--dangerously-bypass-approvals-and-sandbox",
+      "bypassPermissions",
+      "sandbox_mode=danger-full-access",
+      "approval_policy=never"
+    ]);
+  }
+});
+
 // src/repo-mesh-types.ts
 function normalizeMeshSchedulingStrategy(value) {
   if (typeof value !== "string") return DEFAULT_MESH_SCHEDULING_STRATEGY;
@@ -116,6 +172,11 @@ function mergeAndNormalizePolicy(base, patch) {
   } else {
     delete policy.autoConvergeCodeChange;
   }
+  if (policy.delegatedWorkerDangerousModeAllow === true) {
+    policy.delegatedWorkerDangerousModeAllow = true;
+  } else {
+    delete policy.delegatedWorkerDangerousModeAllow;
+  }
   if (policy.coordinatorIdlePushPolicy === "auto_silent_on_dispatch") {
     policy.coordinatorIdlePushPolicy = "auto_silent_on_dispatch";
   } else {
@@ -123,14 +184,38 @@ function mergeAndNormalizePolicy(base, patch) {
   }
   return policy;
 }
-function resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy) {
+function resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy, provider, repoConfig, providerType) {
+  let enabled = true;
   if (typeof nodePolicy?.delegatedWorkerAutoApprove === "boolean") {
-    return nodePolicy.delegatedWorkerAutoApprove;
-  }
-  if (typeof meshPolicy?.delegatedWorkerAutoApprove === "boolean") {
-    return meshPolicy.delegatedWorkerAutoApprove;
-  }
-  return true;
+    enabled = nodePolicy.delegatedWorkerAutoApprove;
+  } else if (typeof meshPolicy?.delegatedWorkerAutoApprove === "boolean") {
+    enabled = meshPolicy.delegatedWorkerAutoApprove;
+  }
+  if (!enabled) return false;
+  const modes = provider?.autoApproveModes;
+  if (!modes) return true;
+  const requestedModeRaw = typeof providerType === "string" ? repoConfig?.providerDefaults?.autoApproveModes?.[providerType.trim()] : void 0;
+  const requestedModeId = typeof requestedModeRaw === "string" && requestedModeRaw.trim() ? requestedModeRaw.trim() : "";
+  const requestedMode = requestedModeId ? modes.modes.find((mode) => mode.id === requestedModeId) : void 0;
+  const selectedMode = requestedMode ?? modes.modes.find((mode) => mode.id === modes.default);
+  if (!selectedMode || selectedMode.strategy === "post-boot-command") return false;
+  const dangerousAllowed = resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy);
+  if (deriveAutoApproveModeRisk(selectedMode) === "dangerous" && !dangerousAllowed) {
+    const ptyFallback = modes.modes.find((mode) => mode.strategy === "pty-parse-default" && deriveAutoApproveModeRisk(mode) !== "dangerous");
+    return ptyFallback?.id || false;
+  }
+  return selectedMode.id;
+}
+function resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy) {
+  if (typeof nodePolicy?.delegatedWorkerDangerousModeAllow === "boolean") {
+    return nodePolicy.delegatedWorkerDangerousModeAllow;
+  }
+  return meshPolicy?.delegatedWorkerDangerousModeAllow === true;
+}
+function delegatedWorkerAutoApproveSettings(meshPolicy, nodePolicy, provider, repoConfig, providerType) {
+  const resolved = resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy, provider, repoConfig, providerType);
+  const delegatedWorkerDangerousModeAllow = resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy);
+  return typeof resolved === "string" ? { autoApprove: void 0, autoApproveMode: resolved, delegatedWorkerDangerousModeAllow } : { autoApprove: resolved, autoApproveMode: void 0, delegatedWorkerDangerousModeAllow };
 }
 function resolveAllowSendKeysDestructive(meshPolicy, nodePolicy) {
   if (typeof nodePolicy?.allowSendKeysDestructive === "boolean") {
@@ -160,6 +245,7 @@ var MESH_SCHEDULING_STRATEGIES, DEFAULT_MESH_SCHEDULING_STRATEGY, MESH_CONVERGE_
 var init_repo_mesh_types = __esm({
   "src/repo-mesh-types.ts"() {
     "use strict";
+    init_auto_approve_modes();
     MESH_SCHEDULING_STRATEGIES = [
       "first_eligible",
       "least_loaded",
@@ -187,6 +273,7 @@ var init_repo_mesh_types = __esm({
       // any specific session manually; that override is preserved per-device.
       spawnedSessionVisibility: "hidden",
       delegatedWorkerAutoApprove: true,
+      delegatedWorkerDangerousModeAllow: false,
       sessionCleanupOnNodeRemove: "preserve",
       // MAGI auto-launches a worker session per pinned replica target with no idle
       // session; those stay idle-LIVE after their turn. Default ON (stop_and_delete)
@@ -226,6 +313,267 @@ var init_repo_mesh_types = __esm({
   }
 });
 
+// src/config/mesh-json-config.ts
+var mesh_json_config_exports = {};
+__export(mesh_json_config_exports, {
+  MESH_JSON_CONFIG_LOCATIONS: () => MESH_JSON_CONFIG_LOCATIONS,
+  MESH_JSON_CONFIG_SCHEMA: () => MESH_JSON_CONFIG_SCHEMA,
+  MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE: () => MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE,
+  applyRepoMeshConfig: () => applyRepoMeshConfig,
+  buildMeshJsonConfigScaffold: () => buildMeshJsonConfigScaffold,
+  loadRepoMeshJsonConfig: () => loadRepoMeshJsonConfig,
+  mergeEffectiveCoordinatorConfig: () => mergeEffectiveCoordinatorConfig,
+  mergeEffectiveOperatingNotes: () => mergeEffectiveOperatingNotes,
+  normalizeRepoMeshDeclarativeConfig: () => normalizeRepoMeshDeclarativeConfig,
+  serializeMeshJsonConfigScaffold: () => serializeMeshJsonConfigScaffold
+});
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseConfigText(path46, text) {
+  if (/\.json$/i.test(path46)) return JSON.parse(text);
+  return yaml.load(text);
+}
+function normalizeOperatingNote(value) {
+  if (!isRecord(value)) return null;
+  const text = typeof value.text === "string" ? value.text.trim() : "";
+  if (!text) return null;
+  const category = value.category === "provider_quirk" || value.category === "pattern_to_avoid" || value.category === "recovery_lesson" ? value.category : void 0;
+  return {
+    text,
+    ...category ? { category } : {},
+    ...typeof value.createdAt === "string" ? { createdAt: value.createdAt } : {},
+    ...typeof value.sourceCoordinator === "string" ? { sourceCoordinator: value.sourceCoordinator } : {},
+    // Operating-notes lifecycle: a repo-declared note may pin itself or set an
+    // explicit expiry, same as a runtime-recorded one. Phase 2 (b)/(c): it may
+    // also declare supersedes/subjectKey to retire an earlier note or group
+    // same-subject notes for folding.
+    ...value.pinned === true ? { pinned: true } : {},
+    ...typeof value.expiresAt === "string" ? { expiresAt: value.expiresAt } : {},
+    ...typeof value.supersedes === "string" ? { supersedes: value.supersedes } : {},
+    ...typeof value.subjectKey === "string" ? { subjectKey: value.subjectKey } : {}
+  };
+}
+function normalizeRepoMeshDeclarativeConfig(parsed) {
+  const errors = [];
+  if (!isRecord(parsed)) return { valid: false, errors: ["config must be an object"] };
+  if (parsed.version !== 1) {
+    return { valid: false, errors: [`version must be 1 (got ${JSON.stringify(parsed.version)})`] };
+  }
+  const config = { version: 1 };
+  if (parsed.coordinator !== void 0) {
+    if (isRecord(parsed.coordinator)) {
+      const coord = {};
+      const c = parsed.coordinator;
+      if (typeof c.systemPromptOverride === "string") coord.systemPromptOverride = c.systemPromptOverride;
+      if (typeof c.systemPromptAppend === "string") coord.systemPromptAppend = c.systemPromptAppend;
+      if (Number.isFinite(Number(c.maxPromptChars))) coord.maxPromptChars = Number(c.maxPromptChars);
+      config.coordinator = coord;
+    } else {
+      errors.push("coordinator must be an object when provided");
+    }
+  }
+  if (parsed.operatingNotes !== void 0) {
+    if (Array.isArray(parsed.operatingNotes)) {
+      const notes = parsed.operatingNotes.map(normalizeOperatingNote).filter((n) => n !== null);
+      if (notes.length) config.operatingNotes = notes;
+    } else {
+      errors.push("operatingNotes must be an array when provided");
+    }
+  }
+  if (parsed.limits !== void 0) {
+    if (isRecord(parsed.limits)) {
+      const limits = {};
+      if (Number.isFinite(Number(parsed.limits.maxNoteChars))) limits.maxNoteChars = Number(parsed.limits.maxNoteChars);
+      if (Number.isFinite(Number(parsed.limits.maxNotes))) limits.maxNotes = Number(parsed.limits.maxNotes);
+      if (Object.keys(limits).length) config.limits = limits;
+    } else {
+      errors.push("limits must be an object when provided");
+    }
+  }
+  if (parsed.providerDefaults !== void 0) {
+    if (isRecord(parsed.providerDefaults)) {
+      const pd = {};
+      const rawModes = parsed.providerDefaults.autoApproveModes;
+      if (rawModes !== void 0) {
+        if (isRecord(rawModes)) {
+          const modes = {};
+          for (const [providerType, modeId] of Object.entries(rawModes)) {
+            const type = typeof providerType === "string" ? providerType.trim() : "";
+            const id = typeof modeId === "string" ? modeId.trim() : "";
+            if (type && id) modes[type] = id;
+          }
+          if (Object.keys(modes).length) pd.autoApproveModes = modes;
+        } else {
+          errors.push("providerDefaults.autoApproveModes must be an object when provided");
+        }
+      }
+      if (Object.keys(pd).length) config.providerDefaults = pd;
+    } else {
+      errors.push("providerDefaults must be an object when provided");
+    }
+  }
+  return { valid: true, config, errors };
+}
+function loadRepoMeshJsonConfig(workspace) {
+  const bases = [];
+  const ws = typeof workspace === "string" ? workspace.trim() : "";
+  if (ws) bases.push(ws);
+  let cwd = "";
+  try {
+    cwd = process.cwd();
+  } catch {
+  }
+  if (cwd && cwd !== ws) bases.push(cwd);
+  for (const base of bases) {
+    for (const relative5 of MESH_JSON_CONFIG_LOCATIONS) {
+      const configPath = (0, import_path.join)(base, relative5);
+      if (!(0, import_fs.existsSync)(configPath)) continue;
+      try {
+        const parsed = parseConfigText(configPath, (0, import_fs.readFileSync)(configPath, "utf-8"));
+        const result = normalizeRepoMeshDeclarativeConfig(parsed);
+        if (!result.valid || !result.config) {
+          return { source: relative5, sourceType: "invalid", path: configPath, error: result.errors.join("; ") };
+        }
+        return { config: result.config, source: relative5, sourceType: "repo_file", path: configPath };
+      } catch (error) {
+        return { source: relative5, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
+      }
+    }
+  }
+  return {
+    source: "unavailable",
+    sourceType: "unavailable",
+    error: `No repo mesh config found. Checked: ${MESH_JSON_CONFIG_LOCATIONS.join(", ")}`
+  };
+}
+function mergeEffectiveCoordinatorConfig(repoCoord, localCoord) {
+  const out = { ...localCoord || {} };
+  const localOverride = localCoord?.systemPromptOverride?.trim();
+  const repoOverride = repoCoord?.systemPromptOverride?.trim();
+  if (localOverride) {
+    out.systemPromptOverride = localCoord.systemPromptOverride;
+  } else if (repoOverride) {
+    out.systemPromptOverride = repoCoord.systemPromptOverride;
+  } else {
+    delete out.systemPromptOverride;
+  }
+  const repoAppend = repoCoord?.systemPromptAppend?.trim() ? repoCoord.systemPromptAppend.trim() : "";
+  const localAppendRaw = localCoord?.systemPromptAppend ?? localCoord?.systemPromptSuffix;
+  const localAppend = localAppendRaw?.trim() ? localAppendRaw.trim() : "";
+  const stacked = [repoAppend, localAppend].filter(Boolean).join("\n\n");
+  if (stacked) {
+    out.systemPromptAppend = stacked;
+    delete out.systemPromptSuffix;
+  }
+  return out;
+}
+function mergeEffectiveOperatingNotes(repoNotes, ledgerNotes) {
+  const usable = (notes) => Array.isArray(notes) ? notes.filter((n) => n && typeof n.text === "string" && n.text.trim()) : [];
+  const repo = usable(repoNotes);
+  const ledger = usable(ledgerNotes);
+  const ledgerTexts = new Set(ledger.map((n) => n.text.trim()));
+  const repoKept = repo.filter((n) => !ledgerTexts.has(n.text.trim()));
+  const merged = [...repoKept, ...ledger];
+  return merged.length ? merged : void 0;
+}
+function applyRepoMeshConfig(mesh, repoConfig) {
+  if (!repoConfig) return mesh;
+  return {
+    ...mesh,
+    coordinator: mergeEffectiveCoordinatorConfig(repoConfig.coordinator, mesh.coordinator)
+  };
+}
+function buildMeshJsonConfigScaffold(mesh) {
+  const scaffold = { version: 1 };
+  const coord = {};
+  const override = mesh.coordinator?.systemPromptOverride;
+  if (typeof override === "string" && override.trim()) coord.systemPromptOverride = override;
+  const append = mesh.coordinator?.systemPromptAppend ?? mesh.coordinator?.systemPromptSuffix;
+  if (typeof append === "string" && append.trim()) coord.systemPromptAppend = append;
+  if (Object.keys(coord).length) scaffold.coordinator = coord;
+  return scaffold;
+}
+function serializeMeshJsonConfigScaffold(config) {
+  return JSON.stringify(config, null, 2);
+}
+var import_fs, import_path, yaml, MESH_JSON_CONFIG_LOCATIONS, MESH_JSON_CONFIG_SCHEMA, MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE;
+var init_mesh_json_config = __esm({
+  "src/config/mesh-json-config.ts"() {
+    "use strict";
+    import_fs = require("fs");
+    import_path = require("path");
+    yaml = __toESM(require("js-yaml"));
+    MESH_JSON_CONFIG_LOCATIONS = [
+      ".adhdev/mesh.json",
+      ".adhdev/mesh.yaml",
+      ".adhdev/mesh.yml"
+    ];
+    MESH_JSON_CONFIG_SCHEMA = {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      title: "ADHDev Repo Mesh Declarative Config",
+      type: "object",
+      additionalProperties: false,
+      required: ["version"],
+      properties: {
+        version: { const: 1 },
+        coordinator: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            systemPromptOverride: { type: "string" },
+            systemPromptAppend: { type: "string" },
+            maxPromptChars: { type: "number", minimum: 1 }
+          }
+        },
+        operatingNotes: {
+          type: "array",
+          maxItems: 200,
+          items: {
+            type: "object",
+            additionalProperties: false,
+            required: ["text"],
+            properties: {
+              text: { type: "string", minLength: 1 },
+              category: { enum: ["provider_quirk", "pattern_to_avoid", "recovery_lesson"] },
+              createdAt: { type: "string" },
+              sourceCoordinator: { type: "string" }
+            }
+          }
+        },
+        limits: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            maxNoteChars: { type: "number", minimum: 1 },
+            maxNotes: { type: "number", minimum: 1 }
+          }
+        },
+        providerDefaults: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            // providerType → requested auto-approve mode ID. Mode IDs are
+            // validated against the live provider spec at resolve time; an
+            // unknown ID is ignored (provider default is used), so the schema
+            // only constrains the shape (string→string), not the ID values.
+            autoApproveModes: {
+              type: "object",
+              additionalProperties: { type: "string" }
+            }
+          }
+        }
+      }
+    };
+    MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE = {
+      autoApproveModes: {
+        "claude-cli": "accept-edits",
+        "codex-cli": "auto"
+      }
+    };
+  }
+});
+
 // src/git/git-executor.ts
 var git_executor_exports = {};
 __export(git_executor_exports, {
@@ -442,10 +790,10 @@ function readInjected(value) {
 }
 function getDaemonBuildInfo() {
   if (cached) return cached;
-  const commit = readInjected(true ? "74f34080bcd7c145e55fd7e5fd492a40a4942bc4" : void 0) ?? "unknown";
-  const commitShort = readInjected(true ? "74f34080" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
-  const version = readInjected(true ? "1.0.18-rc.16" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
-  const builtAt = readInjected(true ? "2026-07-23T02:29:46.281Z" : void 0);
+  const commit = readInjected(true ? "56b83deb250a8ea89ba1a7ec587720e165d20062" : void 0) ?? "unknown";
+  const commitShort = readInjected(true ? "56b83deb" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
+  const version = readInjected(true ? "1.0.18-rc.18" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
+  const builtAt = readInjected(true ? "2026-07-23T06:00:17.638Z" : void 0);
   cached = builtAt ? { commit, commitShort, version, builtAt } : { commit, commitShort, version };
   return cached;
 }
@@ -457,14 +805,14 @@ var init_build_info = __esm({
 });
 
 // src/git/change-impact-config.ts
-function isRecord(value) {
+function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((v) => typeof v === "string" && v.length > 0);
 }
 function validateTarget(value, key2, errors) {
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     errors.push(`impactTargets.${key2} must be an object`);
     return void 0;
   }
@@ -480,7 +828,7 @@ function validateTarget(value, key2, errors) {
 }
 function validateChangeImpactConfig(raw, source = "inline") {
   const errors = [];
-  if (!isRecord(raw)) {
+  if (!isRecord2(raw)) {
     return { valid: false, errors: [`${source}: config must be an object`] };
   }
   const config = {};
@@ -497,7 +845,7 @@ function validateChangeImpactConfig(raw, source = "inline") {
     else errors.push("nonRuntimeRootFilePatterns must be an array of non-empty strings");
   }
   if (raw.impactTargets !== void 0) {
-    if (!isRecord(raw.impactTargets)) {
+    if (!isRecord2(raw.impactTargets)) {
       errors.push("impactTargets must be an object");
     } else {
       const targets = {};
@@ -519,23 +867,23 @@ function validateChangeImpactConfig(raw, source = "inline") {
   }
   return { valid: errors.length === 0, errors, config: errors.length === 0 ? config : void 0 };
 }
-function parseConfigText(path46, text) {
+function parseConfigText2(path46, text) {
   if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml.load(text);
+  return yaml2.load(text);
 }
 function loadChangeImpactConfig(repoRoot) {
   for (const relative5 of CHANGE_IMPACT_CONFIG_LOCATIONS) {
-    const configPath = (0, import_path.join)(repoRoot, relative5);
-    if (!(0, import_fs.existsSync)(configPath)) continue;
+    const configPath = (0, import_path2.join)(repoRoot, relative5);
+    if (!(0, import_fs2.existsSync)(configPath)) continue;
     try {
-      const text = (0, import_fs.readFileSync)(configPath, "utf-8");
+      const text = (0, import_fs2.readFileSync)(configPath, "utf-8");
       let mtimeMs = 0;
       try {
-        mtimeMs = (0, import_fs.statSync)(configPath).mtimeMs;
+        mtimeMs = (0, import_fs2.statSync)(configPath).mtimeMs;
       } catch {
         mtimeMs = text.length;
       }
-      const parsed = parseConfigText(configPath, text);
+      const parsed = parseConfigText2(configPath, text);
       const validation = validateChangeImpactConfig(parsed, relative5);
       if (!validation.valid) {
         return {
@@ -594,7 +942,7 @@ function globToRegExp(pattern) {
 }
 function listPackageDirs(packagesRoot) {
   try {
-    return (0, import_fs.readdirSync)(packagesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
+    return (0, import_fs2.readdirSync)(packagesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
   } catch {
     return [];
   }
@@ -604,10 +952,10 @@ function suggestChangeImpactConfig(repoRoot) {
   const daemon = /* @__PURE__ */ new Set();
   const web = /* @__PURE__ */ new Set();
   const unclassified = [];
-  const roots = ["packages", (0, import_path.join)("oss", "packages")];
+  const roots = ["packages", (0, import_path2.join)("oss", "packages")];
   for (const rel of roots) {
-    const packagesRoot = (0, import_path.join)(repoRoot, rel);
-    if (!(0, import_fs.existsSync)(packagesRoot)) continue;
+    const packagesRoot = (0, import_path2.join)(repoRoot, rel);
+    if (!(0, import_fs2.existsSync)(packagesRoot)) continue;
     for (const name of listPackageDirs(packagesRoot)) {
       if (/(^web[-.]|[-.]web$)/i.test(name) || /dashboard|frontend|ui$/i.test(name)) {
         web.add(name);
@@ -649,13 +997,13 @@ function suggestChangeImpactConfig(repoRoot) {
     discoveredPackages: { daemon: daemonRuntimePackages, web: webOnlyPackages, unclassified }
   };
 }
-var import_fs, import_path, yaml, CHANGE_IMPACT_CONFIG_LOCATIONS, CHANGE_IMPACT_CONFIG_SCHEMA;
+var import_fs2, import_path2, yaml2, CHANGE_IMPACT_CONFIG_LOCATIONS, CHANGE_IMPACT_CONFIG_SCHEMA;
 var init_change_impact_config = __esm({
   "src/git/change-impact-config.ts"() {
     "use strict";
-    import_fs = require("fs");
-    import_path = require("path");
-    yaml = __toESM(require("js-yaml"));
+    import_fs2 = require("fs");
+    import_path2 = require("path");
+    yaml2 = __toESM(require("js-yaml"));
     CHANGE_IMPACT_CONFIG_LOCATIONS = [
       ".adhdev/change-impact.json",
       ".adhdev/change-impact.yaml",
@@ -1740,25 +2088,25 @@ function ensureMachineId(config) {
 }
 function getConfigDir() {
   const override = process.env.ADHDEV_CONFIG_DIR;
-  const dir = override && override.trim() ? override.trim() : (0, import_path2.join)((0, import_os.homedir)(), ".adhdev");
-  if (!(0, import_fs2.existsSync)(dir)) {
-    (0, import_fs2.mkdirSync)(dir, { recursive: true });
+  const dir = override && override.trim() ? override.trim() : (0, import_path3.join)((0, import_os.homedir)(), ".adhdev");
+  if (!(0, import_fs3.existsSync)(dir)) {
+    (0, import_fs3.mkdirSync)(dir, { recursive: true });
   }
   return dir;
 }
 function getDaemonDataDir() {
-  const dir = (0, import_path2.join)(getConfigDir(), "daemon");
-  if (!(0, import_fs2.existsSync)(dir)) {
-    (0, import_fs2.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_path3.join)(getConfigDir(), "daemon");
+  if (!(0, import_fs3.existsSync)(dir)) {
+    (0, import_fs3.mkdirSync)(dir, { recursive: true });
   }
   return dir;
 }
 function getConfigPath() {
-  return (0, import_path2.join)(getConfigDir(), "config.json");
+  return (0, import_path3.join)(getConfigDir(), "config.json");
 }
 function migrateStateToStateFile(raw) {
-  const statePath = (0, import_path2.join)(getConfigDir(), "state.json");
-  if ((0, import_fs2.existsSync)(statePath)) return;
+  const statePath = (0, import_path3.join)(getConfigDir(), "state.json");
+  if ((0, import_fs3.existsSync)(statePath)) return;
   const recentActivity = Array.isArray(raw.recentActivity) ? raw.recentActivity : [];
   const savedProviderSessions = Array.isArray(raw.savedProviderSessions) ? raw.savedProviderSessions : [];
   const legacySessionReads = isPlainObject(raw.recentSessionReads) ? raw.recentSessionReads : {};
@@ -1778,11 +2126,11 @@ function migrateStateToStateFile(raw) {
     sessionReads: mergedReads,
     sessionReadMarkers: cleanedMarkers
   };
-  (0, import_fs2.writeFileSync)(statePath, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: 384 });
+  (0, import_fs3.writeFileSync)(statePath, JSON.stringify(state, null, 2), { encoding: "utf-8", mode: 384 });
 }
 function loadConfig() {
   const configPath = getConfigPath();
-  if (!(0, import_fs2.existsSync)(configPath)) {
+  if (!(0, import_fs3.existsSync)(configPath)) {
     const initialized = ensureMachineId({ ...DEFAULT_CONFIG });
     try {
       saveConfig(initialized.config);
@@ -1791,7 +2139,7 @@ function loadConfig() {
     return initialized.config;
   }
   try {
-    const raw = (0, import_fs2.readFileSync)(configPath, "utf-8");
+    const raw = (0, import_fs3.readFileSync)(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     migrateStateToStateFile(parsed);
     const normalizedInput = normalizeConfig(parsed);
@@ -1813,12 +2161,12 @@ function saveConfig(config) {
   const configPath = getConfigPath();
   const dir = getConfigDir();
   const normalized = normalizeConfig(config);
-  if (!(0, import_fs2.existsSync)(dir)) {
-    (0, import_fs2.mkdirSync)(dir, { recursive: true, mode: 448 });
+  if (!(0, import_fs3.existsSync)(dir)) {
+    (0, import_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
   }
-  (0, import_fs2.writeFileSync)(configPath, JSON.stringify(normalized, null, 2), { encoding: "utf-8", mode: 384 });
+  (0, import_fs3.writeFileSync)(configPath, JSON.stringify(normalized, null, 2), { encoding: "utf-8", mode: 384 });
   try {
-    (0, import_fs2.chmodSync)(configPath, 384);
+    (0, import_fs3.chmodSync)(configPath, 384);
   } catch {
   }
 }
@@ -1845,13 +2193,13 @@ function isSetupComplete() {
 function resetConfig() {
   saveConfig({ ...DEFAULT_CONFIG });
 }
-var import_os, import_path2, import_fs2, import_crypto, DEFAULT_CONFIG, MACHINE_ID_PREFIX;
+var import_os, import_path3, import_fs3, import_crypto, DEFAULT_CONFIG, MACHINE_ID_PREFIX;
 var init_config = __esm({
   "src/config/config.ts"() {
     "use strict";
     import_os = require("os");
-    import_path2 = require("path");
-    import_fs2 = require("fs");
+    import_path3 = require("path");
+    import_fs3 = require("fs");
     import_crypto = require("crypto");
     DEFAULT_CONFIG = {
       serverUrl: "https://api.adhf.dev",
@@ -3283,13 +3631,13 @@ __export(mesh_config_exports, {
   updateNode: () => updateNode
 });
 function getMeshConfigPath() {
-  return (0, import_path3.join)(getConfigDir(), "meshes.json");
+  return (0, import_path4.join)(getConfigDir(), "meshes.json");
 }
 function loadMeshConfig() {
   const path46 = getMeshConfigPath();
-  if (!(0, import_fs3.existsSync)(path46)) return { meshes: [] };
+  if (!(0, import_fs4.existsSync)(path46)) return { meshes: [] };
   try {
-    const raw = JSON.parse((0, import_fs3.readFileSync)(path46, "utf-8"));
+    const raw = JSON.parse((0, import_fs4.readFileSync)(path46, "utf-8"));
     if (!raw || !Array.isArray(raw.meshes)) return { meshes: [] };
     const config = raw;
     const migrated = migrateLoadedMeshConfig(config);
@@ -3367,7 +3715,7 @@ function normalizeCapabilityTags(value) {
 }
 function saveMeshConfig(config) {
   const path46 = getMeshConfigPath();
-  (0, import_fs3.writeFileSync)(path46, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
+  (0, import_fs4.writeFileSync)(path46, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
 }
 function normalizeRepoIdentity(remoteUrl) {
   let identity = remoteUrl.trim();
@@ -3796,12 +4144,12 @@ function setDifficultyBrains(map) {
   saveMeshConfig(stored);
   return normalized;
 }
-var import_fs3, import_path3, import_crypto3, mergeMeshPolicy, MAGI_KIND_PANEL_KINDS, MAX_MAGI_KIND_SLOTS;
+var import_fs4, import_path4, import_crypto3, mergeMeshPolicy, MAGI_KIND_PANEL_KINDS, MAX_MAGI_KIND_SLOTS;
 var init_mesh_config = __esm({
   "src/config/mesh-config.ts"() {
     "use strict";
-    import_fs3 = require("fs");
-    import_path3 = require("path");
+    import_fs4 = require("fs");
+    import_path4 = require("path");
     import_crypto3 = require("crypto");
     init_hash();
     init_config();
@@ -5118,9 +5466,9 @@ function getPendingEventsPath(meshId, coordinatorDaemonId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
   if (coordinatorDaemonId) {
     const safeDaemon = coordinatorDaemonId.replace(/[^a-zA-Z0-9_-]/g, "_");
-    return (0, import_path4.join)(getLedgerDir(), `${safe}-${safeDaemon}.pending-events.jsonl`);
+    return (0, import_path5.join)(getLedgerDir(), `${safe}-${safeDaemon}.pending-events.jsonl`);
   }
-  return (0, import_path4.join)(getLedgerDir(), `${safe}.pending-events.jsonl`);
+  return (0, import_path5.join)(getLedgerDir(), `${safe}.pending-events.jsonl`);
 }
 function readPendingMeshCoordinatorEventsFromDisk(meshId, coordinatorDaemonId) {
   if (!meshId) return [];
@@ -5129,9 +5477,9 @@ function readPendingMeshCoordinatorEventsFromDisk(meshId, coordinatorDaemonId) {
   const paths = primaryDaemonId ? [getPendingEventsPath(meshId, primaryDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
   const events = [];
   for (const path46 of paths) {
-    if (!(0, import_fs4.existsSync)(path46)) continue;
+    if (!(0, import_fs5.existsSync)(path46)) continue;
     try {
-      const raw = (0, import_fs4.readFileSync)(path46, "utf-8");
+      const raw = (0, import_fs5.readFileSync)(path46, "utf-8");
       const parsed = raw.split("\n").filter(Boolean).flatMap((line) => {
         try {
           return [JSON.parse(line)];
@@ -5221,9 +5569,9 @@ function prunePendingMeshCoordinatorEventsRetention() {
 }
 function trimPendingEventsIfNeeded(path46) {
   try {
-    if (!(0, import_fs4.existsSync)(path46)) return;
-    if ((0, import_fs4.statSync)(path46).size <= MAX_PENDING_EVENTS_BYTES) return;
-    const lines = (0, import_fs4.readFileSync)(path46, "utf-8").split("\n").filter(Boolean);
+    if (!(0, import_fs5.existsSync)(path46)) return;
+    if ((0, import_fs5.statSync)(path46).size <= MAX_PENDING_EVENTS_BYTES) return;
+    const lines = (0, import_fs5.readFileSync)(path46, "utf-8").split("\n").filter(Boolean);
     if (lines.length <= MAX_PENDING_EVENTS_KEEP) return;
     const dropped = lines.slice(0, lines.length - MAX_PENDING_EVENTS_KEEP);
     for (const line of dropped) {
@@ -5259,7 +5607,7 @@ function trimPendingEventsIfNeeded(path46) {
         LOG.warn("MeshEvents", `Failed to ledger-record trim-dropped ${event.event} for mesh ${event.meshId}: ${e?.message || e}`);
       }
     }
-    (0, import_fs4.writeFileSync)(path46, lines.slice(-MAX_PENDING_EVENTS_KEEP).join("\n") + "\n", "utf-8");
+    (0, import_fs5.writeFileSync)(path46, lines.slice(-MAX_PENDING_EVENTS_KEEP).join("\n") + "\n", "utf-8");
   } catch {
   }
 }
@@ -5371,7 +5719,7 @@ function persistPendingMeshCoordinatorEvent(event) {
     try {
       const path46 = getPendingEventsPath(event.meshId, event.targetCoordinatorDaemonId);
       trimPendingEventsIfNeeded(path46);
-      (0, import_fs4.appendFileSync)(path46, JSON.stringify(event) + "\n", "utf-8");
+      (0, import_fs5.appendFileSync)(path46, JSON.stringify(event) + "\n", "utf-8");
     } catch (e) {
       if (!sqliteOk) throw e;
       LOG.warn("MeshEvents", `JSONL append failed for mesh ${event.meshId}; SQLite holds the event: ${e?.message || e}`);
@@ -5385,20 +5733,20 @@ function persistPendingMeshCoordinatorEvent(event) {
 function atomicDrainFile(path46) {
   const tmpPath = `${path46}.draining`;
   try {
-    (0, import_fs4.renameSync)(path46, tmpPath);
+    (0, import_fs5.renameSync)(path46, tmpPath);
   } catch {
     return null;
   }
   try {
-    const content = (0, import_fs4.readFileSync)(tmpPath, "utf-8");
+    const content = (0, import_fs5.readFileSync)(tmpPath, "utf-8");
     try {
-      (0, import_fs4.unlinkSync)(tmpPath);
+      (0, import_fs5.unlinkSync)(tmpPath);
     } catch {
     }
     return content;
   } catch {
     try {
-      (0, import_fs4.unlinkSync)(tmpPath);
+      (0, import_fs5.unlinkSync)(tmpPath);
     } catch {
     }
     return null;
@@ -5407,16 +5755,16 @@ function atomicDrainFile(path46) {
 function selectiveDrainFile(path46, predicate) {
   const tmpPath = `${path46}.draining`;
   try {
-    (0, import_fs4.renameSync)(path46, tmpPath);
+    (0, import_fs5.renameSync)(path46, tmpPath);
   } catch {
     return [];
   }
   let content;
   try {
-    content = (0, import_fs4.readFileSync)(tmpPath, "utf-8");
+    content = (0, import_fs5.readFileSync)(tmpPath, "utf-8");
   } catch {
     try {
-      (0, import_fs4.unlinkSync)(tmpPath);
+      (0, import_fs5.unlinkSync)(tmpPath);
     } catch {
     }
     return [];
@@ -5439,12 +5787,12 @@ function selectiveDrainFile(path46, predicate) {
   }
   try {
     if (keptLines.length > 0) {
-      (0, import_fs4.writeFileSync)(path46, keptLines.join("\n") + "\n", "utf-8");
+      (0, import_fs5.writeFileSync)(path46, keptLines.join("\n") + "\n", "utf-8");
     }
-    (0, import_fs4.unlinkSync)(tmpPath);
+    (0, import_fs5.unlinkSync)(tmpPath);
   } catch {
     try {
-      if ((0, import_fs4.existsSync)(tmpPath) && !(0, import_fs4.existsSync)(path46)) (0, import_fs4.renameSync)(tmpPath, path46);
+      if ((0, import_fs5.existsSync)(tmpPath) && !(0, import_fs5.existsSync)(path46)) (0, import_fs5.renameSync)(tmpPath, path46);
     } catch {
     }
     return [];
@@ -5672,18 +6020,18 @@ function clearPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
   }
   const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
   for (const path46 of paths) {
-    if ((0, import_fs4.existsSync)(path46)) try {
-      (0, import_fs4.unlinkSync)(path46);
+    if ((0, import_fs5.existsSync)(path46)) try {
+      (0, import_fs5.unlinkSync)(path46);
     } catch {
     }
   }
 }
-var import_fs4, import_path4, import_crypto5, REFINE_TERMINAL_EVENTS, meshV2DrainCounters, warnedV2Violations, loggedSqlitePendingDrainFailure, TERMINAL_COMPLETION_EVENTS, MAX_PENDING_EVENTS_BYTES, MAX_PENDING_EVENTS_KEEP, PENDING_EVENTS_DRAINED_RETENTION_MS, PENDING_EVENTS_UNDRAINED_RETENTION_MS;
+var import_fs5, import_path5, import_crypto5, REFINE_TERMINAL_EVENTS, meshV2DrainCounters, warnedV2Violations, loggedSqlitePendingDrainFailure, TERMINAL_COMPLETION_EVENTS, MAX_PENDING_EVENTS_BYTES, MAX_PENDING_EVENTS_KEEP, PENDING_EVENTS_DRAINED_RETENTION_MS, PENDING_EVENTS_UNDRAINED_RETENTION_MS;
 var init_mesh_events_pending = __esm({
   "src/mesh/mesh-events-pending.ts"() {
     "use strict";
-    import_fs4 = require("fs");
-    import_path4 = require("path");
+    import_fs5 = require("fs");
+    import_path5 = require("path");
     import_crypto5 = require("crypto");
     init_logger();
     init_config();
@@ -7034,15 +7382,15 @@ function safeMeshId(meshId) {
   return meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function legacyQueuePath(meshId) {
-  return (0, import_path5.join)(getLedgerDir(), `${safeMeshId(meshId)}.queue.json`);
+  return (0, import_path6.join)(getLedgerDir(), `${safeMeshId(meshId)}.queue.json`);
 }
 function cleanupStrayRootRuntimeDb(canonicalPath) {
   try {
-    const strayPath = (0, import_path5.join)(getConfigDir(), "mesh-runtime.db");
+    const strayPath = (0, import_path6.join)(getConfigDir(), "mesh-runtime.db");
     if (strayPath === canonicalPath) return;
-    if (!(0, import_fs5.existsSync)(strayPath)) return;
-    if ((0, import_fs5.statSync)(strayPath).size !== 0) return;
-    (0, import_fs5.unlinkSync)(strayPath);
+    if (!(0, import_fs6.existsSync)(strayPath)) return;
+    if ((0, import_fs6.statSync)(strayPath).size !== 0) return;
+    (0, import_fs6.unlinkSync)(strayPath);
     if (!loggedStrayCleanup) {
       loggedStrayCleanup = true;
       LOG.info("MeshRuntimeStore", `Removed stray 0-byte root mesh-runtime.db at ${strayPath}`);
@@ -7056,17 +7404,17 @@ function cleanupStrayRootRuntimeDb(canonicalPath) {
 }
 function meshRuntimeStorePath() {
   const dir = getLedgerDir();
-  const nextPath = (0, import_path5.join)(dir, "mesh-runtime.db");
+  const nextPath = (0, import_path6.join)(dir, "mesh-runtime.db");
   cleanupStrayRootRuntimeDb(nextPath);
-  if ((0, import_fs5.existsSync)(nextPath)) return nextPath;
-  const legacyPath = (0, import_path5.join)(dir, "beads.db");
-  if (!(0, import_fs5.existsSync)(legacyPath)) return nextPath;
+  if ((0, import_fs6.existsSync)(nextPath)) return nextPath;
+  const legacyPath = (0, import_path6.join)(dir, "beads.db");
+  if (!(0, import_fs6.existsSync)(legacyPath)) return nextPath;
   try {
-    (0, import_fs5.renameSync)(legacyPath, nextPath);
+    (0, import_fs6.renameSync)(legacyPath, nextPath);
     for (const suffix of ["-wal", "-shm"]) {
       const legacyCompanion = `${legacyPath}${suffix}`;
-      if ((0, import_fs5.existsSync)(legacyCompanion)) {
-        (0, import_fs5.renameSync)(legacyCompanion, `${nextPath}${suffix}`);
+      if ((0, import_fs6.existsSync)(legacyCompanion)) {
+        (0, import_fs6.renameSync)(legacyCompanion, `${nextPath}${suffix}`);
       }
     }
   } catch (err) {
@@ -7077,7 +7425,7 @@ function meshRuntimeStorePath() {
         `Legacy beads.db\u2192mesh-runtime.db migration failed; using existing DB in-place to avoid data loss: ${err?.message || err}`
       );
     }
-    return (0, import_fs5.existsSync)(nextPath) ? nextPath : legacyPath;
+    return (0, import_fs6.existsSync)(nextPath) ? nextPath : legacyPath;
   }
   return nextPath;
 }
@@ -7096,12 +7444,12 @@ function pruneMeshRuntimeRetention() {
     return { ledger: 0, toolCalls: 0, terminalQueue: 0 };
   }
 }
-var import_fs5, import_path5, DatabaseCtor, loggedMigrationFailure, loggedStrayCleanup, MeshRuntimeStore, MESH_EVENT_LEDGER_RETENTION_MS, MESH_TOOL_CALL_LOG_RETENTION_MS, MESH_TERMINAL_QUEUE_RETENTION_MS;
+var import_fs6, import_path6, DatabaseCtor, loggedMigrationFailure, loggedStrayCleanup, MeshRuntimeStore, MESH_EVENT_LEDGER_RETENTION_MS, MESH_TOOL_CALL_LOG_RETENTION_MS, MESH_TERMINAL_QUEUE_RETENTION_MS;
 var init_mesh_runtime_store = __esm({
   "src/mesh/mesh-runtime-store.ts"() {
     "use strict";
-    import_fs5 = require("fs");
-    import_path5 = require("path");
+    import_fs6 = require("fs");
+    import_path6 = require("path");
     init_logger();
     init_load_better_sqlite3();
     init_config();
@@ -7132,8 +7480,8 @@ var init_mesh_runtime_store = __esm({
       static WAL_MAX_BYTES = 50 * 1024 * 1024;
       // 50 MB
       constructor(dbPath) {
-        const dir = (0, import_path5.dirname)(dbPath);
-        if (!(0, import_fs5.existsSync)(dir)) (0, import_fs5.mkdirSync)(dir, { recursive: true });
+        const dir = (0, import_path6.dirname)(dbPath);
+        if (!(0, import_fs6.existsSync)(dir)) (0, import_fs6.mkdirSync)(dir, { recursive: true });
         this.dbPath = dbPath;
         this.db = new (loadDatabaseCtor())(dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -7512,8 +7860,8 @@ var init_mesh_runtime_store = __esm({
         this.walWriteCounter = 0;
         try {
           const walPath = `${this.dbPath}-wal`;
-          if (!(0, import_fs5.existsSync)(walPath)) return;
-          const size = (0, import_fs5.statSync)(walPath).size;
+          if (!(0, import_fs6.existsSync)(walPath)) return;
+          const size = (0, import_fs6.statSync)(walPath).size;
           if (size < _MeshRuntimeStore.WAL_MAX_BYTES) return;
           process.stderr.write(
             `[adhdev-mesh] WAL file ${Math.round(size / 1024 / 1024)}MB exceeds threshold; forcing checkpoint
@@ -7529,9 +7877,9 @@ var init_mesh_runtime_store = __esm({
         const count = this.db.prepare("SELECT COUNT(*) AS count FROM mesh_queue WHERE mesh_id = ?").get(meshId);
         if (count.count > 0) return;
         const path46 = legacyQueuePath(meshId);
-        if (!(0, import_fs5.existsSync)(path46)) return;
+        if (!(0, import_fs6.existsSync)(path46)) return;
         try {
-          const entries = JSON.parse((0, import_fs5.readFileSync)(path46, "utf-8"));
+          const entries = JSON.parse((0, import_fs6.readFileSync)(path46, "utf-8"));
           if (!Array.isArray(entries)) return;
           const insert = this.db.prepare(`
                 INSERT OR REPLACE INTO mesh_queue (
@@ -8982,41 +9330,41 @@ function isNoteExpired(note, now) {
   return now - created >= ttlDays * MS_PER_DAY;
 }
 function getLedgerDir() {
-  const dir = (0, import_path6.join)(getConfigDir(), LEDGER_DIR_NAME);
-  if (!(0, import_fs6.existsSync)(dir)) {
-    (0, import_fs6.mkdirSync)(dir, { recursive: true, mode: 448 });
+  const dir = (0, import_path7.join)(getConfigDir(), LEDGER_DIR_NAME);
+  if (!(0, import_fs7.existsSync)(dir)) {
+    (0, import_fs7.mkdirSync)(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function getLedgerPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path6.join)(getLedgerDir(), `${safe}.jsonl`);
+  return (0, import_path7.join)(getLedgerDir(), `${safe}.jsonl`);
 }
 function getRotatedPath(meshId, index) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path6.join)(getLedgerDir(), `${safe}.${index}.jsonl`);
+  return (0, import_path7.join)(getLedgerDir(), `${safe}.${index}.jsonl`);
 }
 function getArchivePath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path6.join)(getLedgerDir(), `${safe}.archive.jsonl`);
+  return (0, import_path7.join)(getLedgerDir(), `${safe}.archive.jsonl`);
 }
 function getRotatedArchivePath(meshId, index) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path6.join)(getLedgerDir(), `${safe}.archive.${index}.jsonl`);
+  return (0, import_path7.join)(getLedgerDir(), `${safe}.archive.${index}.jsonl`);
 }
 function getArchivedCountsPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path6.join)(getLedgerDir(), `${safe}.archived-counts.json`);
+  return (0, import_path7.join)(getLedgerDir(), `${safe}.archived-counts.json`);
 }
 function rotateArchiveFile(meshId, archivePath) {
   let index = 1;
-  while ((0, import_fs6.existsSync)(getRotatedArchivePath(meshId, index))) {
+  while ((0, import_fs7.existsSync)(getRotatedArchivePath(meshId, index))) {
     index++;
     if (index > 5) break;
   }
   if (index > 5) index = 5;
   try {
-    (0, import_fs6.renameSync)(archivePath, getRotatedArchivePath(meshId, index));
+    (0, import_fs7.renameSync)(archivePath, getRotatedArchivePath(meshId, index));
   } catch (e) {
     process.stderr.write(`[adhdev-mesh] Archive rotation failed for mesh ${meshId}: ${e?.message || e}
 `);
@@ -9024,9 +9372,9 @@ function rotateArchiveFile(meshId, archivePath) {
 }
 function readArchivedCounts(meshId) {
   const path46 = getArchivedCountsPath(meshId);
-  if (!(0, import_fs6.existsSync)(path46)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
+  if (!(0, import_fs7.existsSync)(path46)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
   try {
-    return JSON.parse((0, import_fs6.readFileSync)(path46, "utf-8"));
+    return JSON.parse((0, import_fs7.readFileSync)(path46, "utf-8"));
   } catch {
     return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
   }
@@ -9042,7 +9390,7 @@ function updateArchivedCounts(meshId, archived) {
   counts.totalArchived += archived.length;
   counts.lastArchivedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    (0, import_fs6.writeFileSync)(getArchivedCountsPath(meshId), JSON.stringify(counts), { encoding: "utf-8", mode: 384 });
+    (0, import_fs7.writeFileSync)(getArchivedCountsPath(meshId), JSON.stringify(counts), { encoding: "utf-8", mode: 384 });
   } catch {
   }
 }
@@ -9065,7 +9413,7 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
 }
 function compactLedger(meshId) {
   const filePath = getLedgerPath(meshId);
-  if (!(0, import_fs6.existsSync)(filePath)) return { archivedCount: 0, retainedCount: 0 };
+  if (!(0, import_fs7.existsSync)(filePath)) return { archivedCount: 0, retainedCount: 0 };
   const cutoff = Date.now() - ARCHIVE_TERMINAL_OLDER_THAN_MS;
   const entries = readLedgerEntries(meshId);
   const keep = [];
@@ -9080,11 +9428,11 @@ function compactLedger(meshId) {
   if (archive.length === 0) return { archivedCount: 0, retainedCount: keep.length };
   const archivePath = getArchivePath(meshId);
   try {
-    if ((0, import_fs6.existsSync)(archivePath) && (0, import_fs6.statSync)(archivePath).size > 50 * 1024 * 1024) {
+    if ((0, import_fs7.existsSync)(archivePath) && (0, import_fs7.statSync)(archivePath).size > 50 * 1024 * 1024) {
       rotateArchiveFile(meshId, archivePath);
     }
     const archiveLines = archive.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    (0, import_fs6.appendFileSync)(archivePath, archiveLines, { encoding: "utf-8", mode: 384 });
+    (0, import_fs7.appendFileSync)(archivePath, archiveLines, { encoding: "utf-8", mode: 384 });
     updateArchivedCounts(meshId, archive);
   } catch (e) {
     process.stderr.write(`[adhdev-mesh] Ledger archive write failed for mesh ${meshId}: ${e?.message || e}
@@ -9093,7 +9441,7 @@ function compactLedger(meshId) {
   }
   try {
     const keepLines = keep.length ? keep.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
-    (0, import_fs6.writeFileSync)(filePath, keepLines, { encoding: "utf-8", mode: 384 });
+    (0, import_fs7.writeFileSync)(filePath, keepLines, { encoding: "utf-8", mode: 384 });
     invalidateLedgerCache(meshId);
   } catch (e) {
     process.stderr.write(`[adhdev-mesh] Ledger compaction rewrite failed for mesh ${meshId}: ${e?.message || e}
@@ -9271,9 +9619,9 @@ function appendLedgerEntry(meshId, partial) {
     ...partial
   };
   const filePath = getLedgerPath(meshId);
-  if ((0, import_fs6.existsSync)(filePath)) {
+  if ((0, import_fs7.existsSync)(filePath)) {
     try {
-      const stat2 = (0, import_fs6.statSync)(filePath);
+      const stat2 = (0, import_fs7.statSync)(filePath);
       if (stat2.size >= MAX_FILE_SIZE_BYTES) {
         rotateLedgerFile(meshId, filePath);
       } else if (stat2.size >= COMPACT_THRESHOLD_BYTES) {
@@ -9298,7 +9646,7 @@ function appendLedgerEntry(meshId, partial) {
   }
   try {
     const line = JSON.stringify(entry) + "\n";
-    (0, import_fs6.appendFileSync)(filePath, line, { encoding: "utf-8", mode: 384 });
+    (0, import_fs7.appendFileSync)(filePath, line, { encoding: "utf-8", mode: 384 });
     invalidateLedgerCache(meshId);
     meshLedgerEvents.emit("append", meshId, entry);
     if (entry.kind === OPERATING_NOTE_KIND || entry.kind === OPERATING_NOTE_TOMBSTONE_KIND) {
@@ -9390,7 +9738,7 @@ function pruneOperatingNotes(meshId, keepLatest = OPERATING_NOTE_KEEP_LATEST) {
     const remaining = readLedgerFile(meshId).filter((e) => !removeIds.includes(e.id));
     const filePath = getLedgerPath(meshId);
     const lines = remaining.length ? remaining.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
-    (0, import_fs6.writeFileSync)(filePath, lines, { encoding: "utf-8", mode: 384 });
+    (0, import_fs7.writeFileSync)(filePath, lines, { encoding: "utf-8", mode: 384 });
   } catch {
   }
   invalidateLedgerCache(meshId);
@@ -9447,7 +9795,7 @@ function appendRemoteLedgerEntries(meshId, entries) {
   }
   try {
     const lines = validEntries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    (0, import_fs6.appendFileSync)(ledgerPath, lines, { encoding: "utf-8", mode: 384 });
+    (0, import_fs7.appendFileSync)(ledgerPath, lines, { encoding: "utf-8", mode: 384 });
     invalidateLedgerCache(meshId);
     for (const entry of validEntries) {
       meshLedgerEvents.emit("append", meshId, entry);
@@ -9459,10 +9807,10 @@ function appendRemoteLedgerEntries(meshId, entries) {
 }
 function readLedgerFile(meshId) {
   const filePath = getLedgerPath(meshId);
-  if (!(0, import_fs6.existsSync)(filePath)) return [];
+  if (!(0, import_fs7.existsSync)(filePath)) return [];
   let content;
   try {
-    content = (0, import_fs6.readFileSync)(filePath, "utf-8");
+    content = (0, import_fs7.readFileSync)(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -9727,24 +10075,24 @@ function getSessionRecoveryContext(meshId, opts) {
 }
 function rotateLedgerFile(meshId, currentPath) {
   let index = 1;
-  while ((0, import_fs6.existsSync)(getRotatedPath(meshId, index))) {
+  while ((0, import_fs7.existsSync)(getRotatedPath(meshId, index))) {
     index++;
     if (index > 10) break;
   }
   if (index > 10) index = 10;
   try {
-    (0, import_fs6.renameSync)(currentPath, getRotatedPath(meshId, index));
+    (0, import_fs7.renameSync)(currentPath, getRotatedPath(meshId, index));
   } catch (e) {
     process.stderr.write(`[adhdev-mesh] Ledger rotation failed for mesh ${meshId}: ${e?.message || e}. File will continue to grow.
 `);
   }
 }
-var import_fs6, import_path6, import_crypto8, import_events, LEDGER_DIR_NAME, MAX_FILE_SIZE_BYTES, COMPACT_THRESHOLD_BYTES, ARCHIVE_TERMINAL_OLDER_THAN_MS, RECENT_FAILURE_WINDOW_MS, ARCHIVABLE_KINDS, DEFAULT_LEDGER_SLICE_LIMIT, MAX_LEDGER_SLICE_LIMIT, OPERATING_NOTE_KIND, OPERATING_NOTE_TOMBSTONE_KIND, OPERATING_NOTE_DEDUPE_WINDOW, OPERATING_NOTE_KEEP_LATEST, OPERATING_NOTE_CATEGORY_TTL_DAYS, MS_PER_DAY, meshLedgerEvents, ledgerReadCache, LEDGER_CACHE_TTL_MS, ledgerImportStoreRef, ledgerImportDone;
+var import_fs7, import_path7, import_crypto8, import_events, LEDGER_DIR_NAME, MAX_FILE_SIZE_BYTES, COMPACT_THRESHOLD_BYTES, ARCHIVE_TERMINAL_OLDER_THAN_MS, RECENT_FAILURE_WINDOW_MS, ARCHIVABLE_KINDS, DEFAULT_LEDGER_SLICE_LIMIT, MAX_LEDGER_SLICE_LIMIT, OPERATING_NOTE_KIND, OPERATING_NOTE_TOMBSTONE_KIND, OPERATING_NOTE_DEDUPE_WINDOW, OPERATING_NOTE_KEEP_LATEST, OPERATING_NOTE_CATEGORY_TTL_DAYS, MS_PER_DAY, meshLedgerEvents, ledgerReadCache, LEDGER_CACHE_TTL_MS, ledgerImportStoreRef, ledgerImportDone;
 var init_mesh_ledger = __esm({
   "src/mesh/mesh-ledger.ts"() {
     "use strict";
-    import_fs6 = require("fs");
-    import_path6 = require("path");
+    import_fs7 = require("fs");
+    import_path7 = require("path");
     import_crypto8 = require("crypto");
     init_config();
     init_dist();
@@ -11129,13 +11477,13 @@ var init_mesh_coordinator = __esm({
 
 // src/mesh/coordinator-registry.ts
 function getRegistryPath() {
-  return (0, import_path7.join)(getDaemonDataDir(), "mesh-coordinators.json");
+  return (0, import_path8.join)(getDaemonDataDir(), "mesh-coordinators.json");
 }
 function loadMeshCoordinatorRegistry() {
   const path46 = getRegistryPath();
-  if (!(0, import_fs7.existsSync)(path46)) return;
+  if (!(0, import_fs8.existsSync)(path46)) return;
   try {
-    const raw = JSON.parse((0, import_fs7.readFileSync)(path46, "utf-8"));
+    const raw = JSON.parse((0, import_fs8.readFileSync)(path46, "utf-8"));
     if (!Array.isArray(raw)) return;
     _registry.clear();
     for (const entry of raw) {
@@ -11148,7 +11496,7 @@ function loadMeshCoordinatorRegistry() {
 }
 function saveRegistry() {
   try {
-    (0, import_fs7.writeFileSync)(
+    (0, import_fs8.writeFileSync)(
       getRegistryPath(),
       JSON.stringify([..._registry.values()], null, 2),
       { encoding: "utf-8", mode: 384 }
@@ -11181,12 +11529,12 @@ function getCoordinatorForSession(sessionId) {
 function listCoordinatorsForWorkspace(workspace) {
   return [..._registry.values()].filter((e) => e.workspace === workspace);
 }
-var import_path7, import_fs7, _registry;
+var import_path8, import_fs8, _registry;
 var init_coordinator_registry = __esm({
   "src/mesh/coordinator-registry.ts"() {
     "use strict";
-    import_path7 = require("path");
-    import_fs7 = require("fs");
+    import_path8 = require("path");
+    import_fs8 = require("fs");
     init_config();
     _registry = /* @__PURE__ */ new Map();
   }
@@ -11276,14 +11624,14 @@ function validateMeshRefineConfig(config, source = "inline") {
   const rejectedCommands = [];
   const deprecationWarnings = [];
   let bootstrapMode = "inherit";
-  if (!isRecord2(config)) return { valid: false, errors: ["config must be an object"], bootstrapCommands, commands, rejectedCommands, bootstrapMode, deprecationWarnings };
+  if (!isRecord3(config)) return { valid: false, errors: ["config must be an object"], bootstrapCommands, commands, rejectedCommands, bootstrapMode, deprecationWarnings };
   if (config.version !== 1) errors.push("version must be 1");
   if (config.allowAutoPublishSubmoduleMainCommits !== void 0 && typeof config.allowAutoPublishSubmoduleMainCommits !== "boolean") {
     errors.push("allowAutoPublishSubmoduleMainCommits must be a boolean when provided");
   }
   const validation = config.validation;
-  if (validation !== void 0 && !isRecord2(validation)) errors.push("validation must be an object");
-  const rawBootstrapMode = isRecord2(validation) ? validation.bootstrap : void 0;
+  if (validation !== void 0 && !isRecord3(validation)) errors.push("validation must be an object");
+  const rawBootstrapMode = isRecord3(validation) ? validation.bootstrap : void 0;
   if (rawBootstrapMode !== void 0) {
     if (rawBootstrapMode === "inherit" || rawBootstrapMode === "skip") {
       bootstrapMode = rawBootstrapMode;
@@ -11291,8 +11639,8 @@ function validateMeshRefineConfig(config, source = "inline") {
       errors.push("validation.bootstrap must be 'inherit' or 'skip' when provided");
     }
   }
-  const rawCommands = isRecord2(validation) ? validation.commands : void 0;
-  const rawBootstrapCommands = isRecord2(validation) ? validation.bootstrapCommands : void 0;
+  const rawCommands = isRecord3(validation) ? validation.commands : void 0;
+  const rawBootstrapCommands = isRecord3(validation) ? validation.bootstrapCommands : void 0;
   if (rawCommands !== void 0 && !Array.isArray(rawCommands)) errors.push("validation.commands must be an array");
   if (rawBootstrapCommands !== void 0 && !Array.isArray(rawBootstrapCommands)) errors.push("validation.bootstrapCommands must be an array");
   if (Array.isArray(rawBootstrapCommands) && rawBootstrapCommands.length > 0) {
@@ -11315,9 +11663,9 @@ function validateMeshRefineConfig(config, source = "inline") {
   if (rejectedCommands.length) errors.push("one or more validation commands are invalid");
   return { valid: errors.length === 0, errors, bootstrapCommands, commands, rejectedCommands, bootstrapMode, deprecationWarnings };
 }
-function parseConfigText2(path46, text) {
+function parseConfigText3(path46, text) {
   if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml2.load(text);
+  return yaml3.load(text);
 }
 function loadMeshRefineConfig(mesh, workspace) {
   const policy = mesh?.policy && typeof mesh.policy === "object" && !Array.isArray(mesh.policy) ? mesh.policy : {};
@@ -11328,10 +11676,10 @@ function loadMeshRefineConfig(mesh, workspace) {
     return { config: inline, source: "mesh.policy.refineConfig", sourceType: "mesh_policy" };
   }
   for (const relative5 of MESH_REFINE_CONFIG_LOCATIONS) {
-    const configPath = (0, import_path8.join)(workspace, relative5);
-    if (!(0, import_fs8.existsSync)(configPath)) continue;
+    const configPath = (0, import_path9.join)(workspace, relative5);
+    if (!(0, import_fs9.existsSync)(configPath)) continue;
     try {
-      const parsed = parseConfigText2(configPath, (0, import_fs8.readFileSync)(configPath, "utf-8"));
+      const parsed = parseConfigText3(configPath, (0, import_fs9.readFileSync)(configPath, "utf-8"));
       const validation = validateMeshRefineConfig(parsed, relative5);
       if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
       return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
@@ -11347,20 +11695,20 @@ function loadMeshRefineConfig(mesh, workspace) {
 }
 function readPackageScripts(workspace) {
   try {
-    const parsed = JSON.parse((0, import_fs8.readFileSync)((0, import_path8.join)(workspace, "package.json"), "utf-8"));
-    return isRecord2(parsed?.scripts) ? parsed.scripts : {};
+    const parsed = JSON.parse((0, import_fs9.readFileSync)((0, import_path9.join)(workspace, "package.json"), "utf-8"));
+    return isRecord3(parsed?.scripts) ? parsed.scripts : {};
   } catch {
     return {};
   }
 }
 function collectProjectContextSuggestions(mesh) {
   const commands = mesh?.projectContext?.commands;
-  if (!isRecord2(commands)) return [];
+  if (!isRecord3(commands)) return [];
   const suggestions = [];
   for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
     const entries = Array.isArray(commands[category]) ? commands[category] : [];
     for (const entry of entries) {
-      if (isRecord2(entry) && typeof entry.command === "string") suggestions.push({ command: entry.command, category });
+      if (isRecord3(entry) && typeof entry.command === "string") suggestions.push({ command: entry.command, category });
     }
   }
   return suggestions;
@@ -11422,13 +11770,13 @@ function resolveMeshRefineValidationPlan(mesh, workspace) {
     unavailableReason: validation.commands.length ? void 0 : "validation_unavailable: repo mesh/refine config has no validation.commands"
   };
 }
-var import_fs8, import_path8, yaml2, MESH_REFINE_VALIDATION_CATEGORIES, MESH_REFINE_VALIDATION_SCOPES, MESH_REFINE_CONFIG_LOCATIONS, MESH_REFINE_CONFIG_SCHEMA, SHELL_METACHAR_RE, SAFE_TOKEN_RE, SAFE_WIN32_EXEC_TOKEN_RE, isRecord2;
+var import_fs9, import_path9, yaml3, MESH_REFINE_VALIDATION_CATEGORIES, MESH_REFINE_VALIDATION_SCOPES, MESH_REFINE_CONFIG_LOCATIONS, MESH_REFINE_CONFIG_SCHEMA, SHELL_METACHAR_RE, SAFE_TOKEN_RE, SAFE_WIN32_EXEC_TOKEN_RE, isRecord3;
 var init_refine_config = __esm({
   "src/mesh/refine-config.ts"() {
     "use strict";
-    import_fs8 = require("fs");
-    import_path8 = require("path");
-    yaml2 = __toESM(require("js-yaml"));
+    import_fs9 = require("fs");
+    import_path9 = require("path");
+    yaml3 = __toESM(require("js-yaml"));
     MESH_REFINE_VALIDATION_CATEGORIES = ["typecheck", "test", "lint", "build"];
     MESH_REFINE_VALIDATION_SCOPES = ["none", "web", "daemon"];
     MESH_REFINE_CONFIG_LOCATIONS = [
@@ -11519,7 +11867,7 @@ var init_refine_config = __esm({
     SHELL_METACHAR_RE = /[;&|<>`$\n\r'"]/;
     SAFE_TOKEN_RE = /^[A-Za-z0-9_@./:=+-]+$/;
     SAFE_WIN32_EXEC_TOKEN_RE = /^[A-Za-z0-9_@./:=+\\-]+$/;
-    isRecord2 = isMeshConfigRecord;
+    isRecord3 = isMeshConfigRecord;
   }
 });
 
@@ -11538,7 +11886,7 @@ function resolveWin32GlobalBin(trimmed) {
     if (!dir) continue;
     for (const ext of WIN_EXEC_EXT) {
       const full = path10.join(dir, trimmed + ext);
-      if ((0, import_fs9.existsSync)(full)) return full;
+      if ((0, import_fs10.existsSync)(full)) return full;
     }
   }
   return null;
@@ -11555,7 +11903,7 @@ function resolveWin32Executable(command) {
   if (process.platform !== "win32") return command;
   const trimmed = (command || "").trim();
   if (!trimmed) return command;
-  if (path10.isAbsolute(trimmed) && (0, import_fs9.existsSync)(trimmed)) return trimmed;
+  if (path10.isAbsolute(trimmed) && (0, import_fs10.existsSync)(trimmed)) return trimmed;
   try {
     const out = (0, import_child_process.execFileSync)("where", [trimmed], {
       encoding: "utf8",
@@ -11603,12 +11951,12 @@ function buildWin32ExecFileSpawn(resolvedCommand, args) {
     windowsVerbatimArguments: true
   };
 }
-var import_child_process, import_fs9, path10, DIRECT_EXEC_EXT, SHIM_EXEC_EXT, WIN_EXEC_EXT;
+var import_child_process, import_fs10, path10, DIRECT_EXEC_EXT, SHIM_EXEC_EXT, WIN_EXEC_EXT;
 var init_resolve_executable = __esm({
   "src/cli-adapters/resolve-executable.ts"() {
     "use strict";
     import_child_process = require("child_process");
-    import_fs9 = require("fs");
+    import_fs10 = require("fs");
     path10 = __toESM(require("path"));
     DIRECT_EXEC_EXT = /* @__PURE__ */ new Set([".exe", ".com"]);
     SHIM_EXEC_EXT = /* @__PURE__ */ new Set([".cmd", ".bat"]);
@@ -11748,7 +12096,7 @@ function isWorktreeBootstrapStaleRunning(node, nowMs = Date.now()) {
   if (!Number.isFinite(startedMs)) return false;
   if (nowMs - startedMs <= WORKTREE_BOOTSTRAP_STALE_RUNNING_MS) return false;
   const workspace = typeof node?.workspace === "string" ? node.workspace.trim() : "";
-  if (!workspace || !(0, import_fs10.existsSync)(workspace)) return false;
+  if (!workspace || !(0, import_fs11.existsSync)(workspace)) return false;
   try {
     const out = (0, import_node_child_process3.execFileSync)(resolveWin32Executable("git"), ["status", "--porcelain"], {
       cwd: workspace,
@@ -11769,9 +12117,9 @@ function shouldDeferDispatchForBootstrap(node, nowMs = Date.now()) {
   if (node?.worktreeBootstrap?.status !== "running") return false;
   return !isWorktreeBootstrapStaleRunning(node, nowMs);
 }
-function parseConfigText3(path46, text) {
+function parseConfigText4(path46, text) {
   if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml3.load(text);
+  return yaml4.load(text);
 }
 function truncateOutput(value) {
   const text = typeof value === "string" ? value : value == null ? "" : String(value);
@@ -11811,10 +12159,10 @@ function loadMeshWorktreeBootstrapConfig(mesh, workspace) {
     return { config: inline, source: "mesh.policy.worktreeBootstrapConfig", sourceType: "mesh_policy" };
   }
   for (const relative5 of MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS) {
-    const configPath = (0, import_path9.join)(workspace, relative5);
-    if (!(0, import_fs10.existsSync)(configPath)) continue;
+    const configPath = (0, import_path10.join)(workspace, relative5);
+    if (!(0, import_fs11.existsSync)(configPath)) continue;
     try {
-      const parsed = parseConfigText3(configPath, (0, import_fs10.readFileSync)(configPath, "utf-8"));
+      const parsed = parseConfigText4(configPath, (0, import_fs11.readFileSync)(configPath, "utf-8"));
       const validation = validateMeshWorktreeBootstrapConfig(parsed, relative5);
       if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
       return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
@@ -11827,9 +12175,9 @@ function loadMeshWorktreeBootstrapConfig(mesh, workspace) {
 function computeStaleInputsDigest(workspace, staleInputs) {
   const digest = {};
   for (const relative5 of staleInputs ?? []) {
-    const filePath = (0, import_path9.join)(workspace, relative5);
+    const filePath = (0, import_path10.join)(workspace, relative5);
     try {
-      digest[relative5] = (0, import_node_crypto2.createHash)("sha256").update((0, import_fs10.readFileSync)(filePath)).digest("hex");
+      digest[relative5] = (0, import_node_crypto2.createHash)("sha256").update((0, import_fs11.readFileSync)(filePath)).digest("hex");
     } catch {
       digest[relative5] = "absent";
     }
@@ -11900,10 +12248,10 @@ async function runMeshWorktreeBootstrap(mesh, workspace) {
     staleInputs: loaded.config.staleInputs
   };
   const staleInputPaths = loaded.config.staleInputs ?? [];
-  const initiallyAbsent = staleInputPaths.filter((p) => !(0, import_fs10.existsSync)((0, import_path9.join)(workspace, p)));
+  const initiallyAbsent = staleInputPaths.filter((p) => !(0, import_fs11.existsSync)((0, import_path10.join)(workspace, p)));
   for (const command of validation.commands) {
     if (initiallyAbsent.length > 0) {
-      const appearedNow = initiallyAbsent.filter((p) => (0, import_fs10.existsSync)((0, import_path9.join)(workspace, p)));
+      const appearedNow = initiallyAbsent.filter((p) => (0, import_fs11.existsSync)((0, import_path10.join)(workspace, p)));
       if (appearedNow.length > 0) {
         state.status = "stale";
         state.completedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -11911,7 +12259,7 @@ async function runMeshWorktreeBootstrap(mesh, workspace) {
         return state;
       }
     }
-    const cwd = command.cwd ? (0, import_path9.resolve)(workspace, command.cwd) : workspace;
+    const cwd = command.cwd ? (0, import_path10.resolve)(workspace, command.cwd) : workspace;
     const startedAt = Date.now();
     state.lastCommand = command.displayCommand;
     const resolvedCommand = resolveWin32Executable(command.command);
@@ -11971,16 +12319,16 @@ async function runMeshWorktreeBootstrap(mesh, workspace) {
   }
   return state;
 }
-var import_fs10, import_path9, import_node_child_process3, import_node_crypto2, import_node_util3, yaml3, WORKTREE_BOOTSTRAP_STALE_RUNNING_MS, SUBMODULE_DEFAULT_BRANCH_FALLBACK, MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS, MESH_WORKTREE_BOOTSTRAP_CONFIG_SCHEMA, DEFAULT_TIMEOUT_MS2, DEFAULT_OUTPUT_LIMIT_BYTES, OUTPUT_SUMMARY_CHARS;
+var import_fs11, import_path10, import_node_child_process3, import_node_crypto2, import_node_util3, yaml4, WORKTREE_BOOTSTRAP_STALE_RUNNING_MS, SUBMODULE_DEFAULT_BRANCH_FALLBACK, MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS, MESH_WORKTREE_BOOTSTRAP_CONFIG_SCHEMA, DEFAULT_TIMEOUT_MS2, DEFAULT_OUTPUT_LIMIT_BYTES, OUTPUT_SUMMARY_CHARS;
 var init_worktree_bootstrap_config = __esm({
   "src/mesh/worktree-bootstrap-config.ts"() {
     "use strict";
-    import_fs10 = require("fs");
-    import_path9 = require("path");
+    import_fs11 = require("fs");
+    import_path10 = require("path");
     import_node_child_process3 = require("child_process");
     import_node_crypto2 = require("crypto");
     import_node_util3 = require("util");
-    yaml3 = __toESM(require("js-yaml"));
+    yaml4 = __toESM(require("js-yaml"));
     init_resolve_executable();
     init_refine_config();
     WORKTREE_BOOTSTRAP_STALE_RUNNING_MS = 10 * 60 * 1e3;
@@ -12032,224 +12380,6 @@ var init_worktree_bootstrap_config = __esm({
   }
 });
 
-// src/config/mesh-json-config.ts
-var mesh_json_config_exports = {};
-__export(mesh_json_config_exports, {
-  MESH_JSON_CONFIG_LOCATIONS: () => MESH_JSON_CONFIG_LOCATIONS,
-  MESH_JSON_CONFIG_SCHEMA: () => MESH_JSON_CONFIG_SCHEMA,
-  applyRepoMeshConfig: () => applyRepoMeshConfig,
-  buildMeshJsonConfigScaffold: () => buildMeshJsonConfigScaffold,
-  loadRepoMeshJsonConfig: () => loadRepoMeshJsonConfig,
-  mergeEffectiveCoordinatorConfig: () => mergeEffectiveCoordinatorConfig,
-  mergeEffectiveOperatingNotes: () => mergeEffectiveOperatingNotes,
-  normalizeRepoMeshDeclarativeConfig: () => normalizeRepoMeshDeclarativeConfig,
-  serializeMeshJsonConfigScaffold: () => serializeMeshJsonConfigScaffold
-});
-function isRecord3(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function parseConfigText4(path46, text) {
-  if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml4.load(text);
-}
-function normalizeOperatingNote(value) {
-  if (!isRecord3(value)) return null;
-  const text = typeof value.text === "string" ? value.text.trim() : "";
-  if (!text) return null;
-  const category = value.category === "provider_quirk" || value.category === "pattern_to_avoid" || value.category === "recovery_lesson" ? value.category : void 0;
-  return {
-    text,
-    ...category ? { category } : {},
-    ...typeof value.createdAt === "string" ? { createdAt: value.createdAt } : {},
-    ...typeof value.sourceCoordinator === "string" ? { sourceCoordinator: value.sourceCoordinator } : {},
-    // Operating-notes lifecycle: a repo-declared note may pin itself or set an
-    // explicit expiry, same as a runtime-recorded one. Phase 2 (b)/(c): it may
-    // also declare supersedes/subjectKey to retire an earlier note or group
-    // same-subject notes for folding.
-    ...value.pinned === true ? { pinned: true } : {},
-    ...typeof value.expiresAt === "string" ? { expiresAt: value.expiresAt } : {},
-    ...typeof value.supersedes === "string" ? { supersedes: value.supersedes } : {},
-    ...typeof value.subjectKey === "string" ? { subjectKey: value.subjectKey } : {}
-  };
-}
-function normalizeRepoMeshDeclarativeConfig(parsed) {
-  const errors = [];
-  if (!isRecord3(parsed)) return { valid: false, errors: ["config must be an object"] };
-  if (parsed.version !== 1) {
-    return { valid: false, errors: [`version must be 1 (got ${JSON.stringify(parsed.version)})`] };
-  }
-  const config = { version: 1 };
-  if (parsed.coordinator !== void 0) {
-    if (isRecord3(parsed.coordinator)) {
-      const coord = {};
-      const c = parsed.coordinator;
-      if (typeof c.systemPromptOverride === "string") coord.systemPromptOverride = c.systemPromptOverride;
-      if (typeof c.systemPromptAppend === "string") coord.systemPromptAppend = c.systemPromptAppend;
-      if (Number.isFinite(Number(c.maxPromptChars))) coord.maxPromptChars = Number(c.maxPromptChars);
-      config.coordinator = coord;
-    } else {
-      errors.push("coordinator must be an object when provided");
-    }
-  }
-  if (parsed.operatingNotes !== void 0) {
-    if (Array.isArray(parsed.operatingNotes)) {
-      const notes = parsed.operatingNotes.map(normalizeOperatingNote).filter((n) => n !== null);
-      if (notes.length) config.operatingNotes = notes;
-    } else {
-      errors.push("operatingNotes must be an array when provided");
-    }
-  }
-  if (parsed.limits !== void 0) {
-    if (isRecord3(parsed.limits)) {
-      const limits = {};
-      if (Number.isFinite(Number(parsed.limits.maxNoteChars))) limits.maxNoteChars = Number(parsed.limits.maxNoteChars);
-      if (Number.isFinite(Number(parsed.limits.maxNotes))) limits.maxNotes = Number(parsed.limits.maxNotes);
-      if (Object.keys(limits).length) config.limits = limits;
-    } else {
-      errors.push("limits must be an object when provided");
-    }
-  }
-  return { valid: true, config, errors };
-}
-function loadRepoMeshJsonConfig(workspace) {
-  const bases = [];
-  const ws = typeof workspace === "string" ? workspace.trim() : "";
-  if (ws) bases.push(ws);
-  let cwd = "";
-  try {
-    cwd = process.cwd();
-  } catch {
-  }
-  if (cwd && cwd !== ws) bases.push(cwd);
-  for (const base of bases) {
-    for (const relative5 of MESH_JSON_CONFIG_LOCATIONS) {
-      const configPath = (0, import_path10.join)(base, relative5);
-      if (!(0, import_fs11.existsSync)(configPath)) continue;
-      try {
-        const parsed = parseConfigText4(configPath, (0, import_fs11.readFileSync)(configPath, "utf-8"));
-        const result = normalizeRepoMeshDeclarativeConfig(parsed);
-        if (!result.valid || !result.config) {
-          return { source: relative5, sourceType: "invalid", path: configPath, error: result.errors.join("; ") };
-        }
-        return { config: result.config, source: relative5, sourceType: "repo_file", path: configPath };
-      } catch (error) {
-        return { source: relative5, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
-      }
-    }
-  }
-  return {
-    source: "unavailable",
-    sourceType: "unavailable",
-    error: `No repo mesh config found. Checked: ${MESH_JSON_CONFIG_LOCATIONS.join(", ")}`
-  };
-}
-function mergeEffectiveCoordinatorConfig(repoCoord, localCoord) {
-  const out = { ...localCoord || {} };
-  const localOverride = localCoord?.systemPromptOverride?.trim();
-  const repoOverride = repoCoord?.systemPromptOverride?.trim();
-  if (localOverride) {
-    out.systemPromptOverride = localCoord.systemPromptOverride;
-  } else if (repoOverride) {
-    out.systemPromptOverride = repoCoord.systemPromptOverride;
-  } else {
-    delete out.systemPromptOverride;
-  }
-  const repoAppend = repoCoord?.systemPromptAppend?.trim() ? repoCoord.systemPromptAppend.trim() : "";
-  const localAppendRaw = localCoord?.systemPromptAppend ?? localCoord?.systemPromptSuffix;
-  const localAppend = localAppendRaw?.trim() ? localAppendRaw.trim() : "";
-  const stacked = [repoAppend, localAppend].filter(Boolean).join("\n\n");
-  if (stacked) {
-    out.systemPromptAppend = stacked;
-    delete out.systemPromptSuffix;
-  }
-  return out;
-}
-function mergeEffectiveOperatingNotes(repoNotes, ledgerNotes) {
-  const usable = (notes) => Array.isArray(notes) ? notes.filter((n) => n && typeof n.text === "string" && n.text.trim()) : [];
-  const repo = usable(repoNotes);
-  const ledger = usable(ledgerNotes);
-  const ledgerTexts = new Set(ledger.map((n) => n.text.trim()));
-  const repoKept = repo.filter((n) => !ledgerTexts.has(n.text.trim()));
-  const merged = [...repoKept, ...ledger];
-  return merged.length ? merged : void 0;
-}
-function applyRepoMeshConfig(mesh, repoConfig) {
-  if (!repoConfig) return mesh;
-  return {
-    ...mesh,
-    coordinator: mergeEffectiveCoordinatorConfig(repoConfig.coordinator, mesh.coordinator)
-  };
-}
-function buildMeshJsonConfigScaffold(mesh) {
-  const scaffold = { version: 1 };
-  const coord = {};
-  const override = mesh.coordinator?.systemPromptOverride;
-  if (typeof override === "string" && override.trim()) coord.systemPromptOverride = override;
-  const append = mesh.coordinator?.systemPromptAppend ?? mesh.coordinator?.systemPromptSuffix;
-  if (typeof append === "string" && append.trim()) coord.systemPromptAppend = append;
-  if (Object.keys(coord).length) scaffold.coordinator = coord;
-  return scaffold;
-}
-function serializeMeshJsonConfigScaffold(config) {
-  return JSON.stringify(config, null, 2);
-}
-var import_fs11, import_path10, yaml4, MESH_JSON_CONFIG_LOCATIONS, MESH_JSON_CONFIG_SCHEMA;
-var init_mesh_json_config = __esm({
-  "src/config/mesh-json-config.ts"() {
-    "use strict";
-    import_fs11 = require("fs");
-    import_path10 = require("path");
-    yaml4 = __toESM(require("js-yaml"));
-    MESH_JSON_CONFIG_LOCATIONS = [
-      ".adhdev/mesh.json",
-      ".adhdev/mesh.yaml",
-      ".adhdev/mesh.yml"
-    ];
-    MESH_JSON_CONFIG_SCHEMA = {
-      $schema: "https://json-schema.org/draft/2020-12/schema",
-      title: "ADHDev Repo Mesh Declarative Config",
-      type: "object",
-      additionalProperties: false,
-      required: ["version"],
-      properties: {
-        version: { const: 1 },
-        coordinator: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            systemPromptOverride: { type: "string" },
-            systemPromptAppend: { type: "string" },
-            maxPromptChars: { type: "number", minimum: 1 }
-          }
-        },
-        operatingNotes: {
-          type: "array",
-          maxItems: 200,
-          items: {
-            type: "object",
-            additionalProperties: false,
-            required: ["text"],
-            properties: {
-              text: { type: "string", minLength: 1 },
-              category: { enum: ["provider_quirk", "pattern_to_avoid", "recovery_lesson"] },
-              createdAt: { type: "string" },
-              sourceCoordinator: { type: "string" }
-            }
-          }
-        },
-        limits: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            maxNoteChars: { type: "number", minimum: 1 },
-            maxNotes: { type: "number", minimum: 1 }
-          }
-        }
-      }
-    };
-  }
-});
-
 // src/mesh/mesh-fast-forward.ts
 async function fastForwardMeshNode(args) {
   const workspace = typeof args.workspace === "string" ? args.workspace.trim() : "";
@@ -16573,6 +16703,16 @@ function __resetIdleAutoFastForwardForTests() {
   continuousAutoFastForwardLastScan.clear();
   autoFastForwardWorkspaceLease.clear();
 }
+function loadRepoConfigForNode(node) {
+  const workspace = typeof node?.workspace === "string" && node.workspace.trim() ? node.workspace.trim() : "";
+  if (!workspace) return null;
+  try {
+    const result = loadRepoMeshJsonConfig(workspace);
+    return result.sourceType === "repo_file" && result.config ? result.config : null;
+  } catch {
+    return null;
+  }
+}
 function getMeshWithCache(components, meshId) {
   const localMesh = getMesh(meshId);
   const cachedMesh = components.router?.getCachedInlineMesh(meshId);
@@ -16832,7 +16972,13 @@ function tryAssignQueueTask(components, meshId, nodeId, sessionId, providerType)
         meshNodeFor: meshId,
         meshNodeId: nodeId,
         launchedByCoordinator: true,
-        autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+        ...delegatedWorkerAutoApproveSettings(
+          mesh?.policy,
+          node?.policy,
+          components.providerLoader?.getMeta(providerType),
+          loadRepoConfigForNode(node),
+          providerType
+        ),
         ...localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {},
         // COMPLETION-PROPAGATION F5: (re)stamp the coordinator SESSION anchor from THIS
         // task's sourceCoordinatorSessionId with PRIORITY — a manually-launched (or reused)
@@ -17270,10 +17416,10 @@ function liveSessionCountForNode(components, meshId, nodeId) {
   }
   return count;
 }
-function nodeHasLiveSessionPendingClaim(components, meshId, nodeId) {
+function nodeHasLiveSessionPendingClaim(components, meshId, nodeId, task, node) {
   if (inWindowAutoLaunchSessionIdsForNode(meshId, nodeId).length > 0) return true;
   const busySessionIds = new Set(
-    getQueue(meshId, { status: ["assigned"] }).filter((task) => daemonIdsEquivalent(task.assignedNodeId, nodeId)).map((task) => readNonEmptyString(task.assignedSessionId)).filter(Boolean)
+    getQueue(meshId, { status: ["assigned"] }).filter((task2) => daemonIdsEquivalent(task2.assignedNodeId, nodeId)).map((task2) => readNonEmptyString(task2.assignedSessionId)).filter(Boolean)
   );
   return components.instanceManager.getByCategory("cli").some((inst) => {
     const state = inst.getState();
@@ -17286,6 +17432,12 @@ function nodeHasLiveSessionPendingClaim(components, meshId, nodeId) {
     if (isTerminalSessionStatus(status)) return false;
     const sessionId = readNonEmptyString(state.instanceId);
     if (sessionId && busySessionIds.has(sessionId)) return false;
+    if (task.requiredTags?.length) {
+      const sessionProviderType = state.type || readNonEmptyString(settings.providerType);
+      if (sessionProviderType && !nodeSatisfiesRequiredTags(task.requiredTags, buildMeshNodeCapabilityTags(node, sessionProviderType))) {
+        return false;
+      }
+    }
     return true;
   });
 }
@@ -17566,7 +17718,7 @@ async function maybeAutoLaunchOneQueueSession(components, meshId, mesh) {
         sweepExpiredCooldowns();
         continue;
       }
-      if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId)) {
+      if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId, task, node)) {
         markAutoLaunch(meshId, task.id, { status: "skipped", reason: "node_has_live_session_pending_claim", nodeId });
         continue;
       }
@@ -17605,8 +17757,14 @@ async function maybeAutoLaunchOneQueueSession(components, meshId, mesh) {
           spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || "hidden",
           // Coordinator-dispatched worker: auto-approve unless mesh/node policy
           // opts out (default true). Lands in settingsOverride and beats the
-          // global per-provider-type autoApprove config (see shouldAutoApprove).
-          autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+          // global per-provider-type boolean/mode through explicit opposite-key clearing.
+          ...delegatedWorkerAutoApproveSettings(
+            mesh?.policy,
+            node?.policy,
+            components.providerLoader?.getMeta(resolved.providerType),
+            loadRepoConfigForNode(node),
+            resolved.providerType
+          ),
           launchedByCoordinator: true,
           autoLaunchedForQueueTaskId: task.id
         };
@@ -18071,6 +18229,7 @@ var init_mesh_queue_assignment = __esm({
     init_mesh_event_trace();
     init_mesh_warmup_deadline();
     init_repo_mesh_types();
+    init_mesh_json_config();
     init_dist();
     init_mesh_node_slots();
     init_mesh_events_stale();
@@ -20446,6 +20605,7 @@ function buildAvailableProviders(providerLoader) {
       ...provider.lastDetection !== void 0 ? { lastDetection: provider.lastDetection } : {},
       ...provider.lastVerification !== void 0 ? { lastVerification: provider.lastVerification } : {},
       ...provider.meshCoordinator !== void 0 ? { meshCoordinator: provider.meshCoordinator } : {},
+      ...provider.autoApproveModes !== void 0 ? { autoApproveModes: provider.autoApproveModes } : {},
       ...trust ? {
         trust,
         trustDescription: describeTrust2(trust),
@@ -21625,7 +21785,24 @@ function injectMeshSystemMessage(components, args) {
                   spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || "hidden",
                   // Coordinator-dispatched recovery relaunch: same auto-approve
                   // policy as the primary worker launch path.
-                  autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                  ...delegatedWorkerAutoApproveSettings(
+                    mesh?.policy,
+                    node?.policy,
+                    components.providerLoader?.getMeta(recoveryContext.failedProviderType),
+                    // Recovery relaunch: same repo-declared requested mode as the
+                    // primary path. node.workspace missing → null → provider default.
+                    (() => {
+                      const ws = typeof node?.workspace === "string" && node.workspace.trim() ? node.workspace.trim() : "";
+                      if (!ws) return null;
+                      try {
+                        const r = loadRepoMeshJsonConfig(ws);
+                        return r.sourceType === "repo_file" && r.config ? r.config : null;
+                      } catch {
+                        return null;
+                      }
+                    })(),
+                    recoveryContext.failedProviderType
+                  ),
                   launchedByCoordinator: true
                 }
               }).catch((e) => LOG.error("MeshRecovery", `Failed to auto-relaunch session for ${node.id}: ${e?.message}`));
@@ -22015,6 +22192,7 @@ var init_mesh_event_forwarding = __esm({
     init_mesh_event_trace();
     init_snapshot();
     init_repo_mesh_types();
+    init_mesh_json_config();
     init_dist();
     init_mesh_events_stale();
     init_mesh_task_inflight();
@@ -24279,6 +24457,20 @@ var init_provider_schema = __esm({
             }
           }
         },
+        autoApproveModes: {
+          type: "object",
+          description: "Provider-specific auto-approve choices and their launch/runtime strategy.",
+          required: ["default", "modes"],
+          additionalProperties: false,
+          properties: {
+            default: { type: "string", minLength: 1 },
+            modes: {
+              type: "array",
+              minItems: 1,
+              items: { $ref: "#/$defs/autoApproveMode" }
+            }
+          }
+        },
         sendDelayMs: {
           type: "number",
           minimum: 0,
@@ -24652,6 +24844,36 @@ var init_provider_schema = __esm({
         }
       },
       $defs: {
+        autoApproveMode: {
+          type: "object",
+          required: ["id", "label", "strategy", "risk"],
+          additionalProperties: false,
+          properties: {
+            id: { type: "string", minLength: 1 },
+            label: { type: "string", minLength: 1 },
+            strategy: { enum: ["pty-parse-default", "launch-args", "post-boot-command"] },
+            risk: { enum: ["safe", "caution", "dangerous"] },
+            warning: { type: "string", minLength: 1 },
+            launchArgs: {
+              type: "array",
+              items: { type: "string", minLength: 1 }
+            },
+            removeArgs: {
+              type: "array",
+              items: { type: "string", minLength: 1 }
+            }
+          },
+          allOf: [
+            {
+              if: { properties: { strategy: { const: "launch-args" } }, required: ["strategy"] },
+              then: { required: ["launchArgs"], properties: { launchArgs: { minItems: 1 } } }
+            },
+            {
+              if: { properties: { risk: { const: "dangerous" } }, required: ["risk"] },
+              then: { required: ["warning"] }
+            }
+          ]
+        },
         patternList: {
           type: "array",
           items: {
@@ -30415,6 +30637,9 @@ __export(index_exports, {
   MAX_LEDGER_SLICE_LIMIT: () => MAX_LEDGER_SLICE_LIMIT,
   MESH_CONVERGE_FAST_FORWARD_TAG: () => MESH_CONVERGE_FAST_FORWARD_TAG,
   MESH_CONVERGE_REFINE_TAG: () => MESH_CONVERGE_REFINE_TAG,
+  MESH_JSON_CONFIG_LOCATIONS: () => MESH_JSON_CONFIG_LOCATIONS,
+  MESH_JSON_CONFIG_SCHEMA: () => MESH_JSON_CONFIG_SCHEMA,
+  MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE: () => MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE,
   MESH_MAX_PARALLEL_TASKS_MAX: () => MESH_MAX_PARALLEL_TASKS_MAX,
   MESH_MAX_PARALLEL_TASKS_MIN: () => MESH_MAX_PARALLEL_TASKS_MIN,
   MESH_MISSION_LIST_HISTORY_ID_LIMIT: () => MESH_MISSION_LIST_HISTORY_ID_LIMIT,
@@ -30474,6 +30699,7 @@ __export(index_exports, {
   buildMeshActiveWorkSummary: () => buildMeshActiveWorkSummary,
   buildMeshAsyncRefineJobs: () => buildMeshAsyncRefineJobs,
   buildMeshHostRequiredFailure: () => buildMeshHostRequiredFailure,
+  buildMeshJsonConfigScaffold: () => buildMeshJsonConfigScaffold,
   buildMeshLedgerReconciliationEvidence: () => buildMeshLedgerReconciliationEvidence,
   buildMeshLedgerReplicaEvidence: () => buildMeshLedgerReplicaEvidence,
   buildMeshMagiActivity: () => buildMeshMagiActivity,
@@ -30524,6 +30750,7 @@ __export(index_exports, {
   createSessionDelivery: () => createSessionDelivery,
   createWorktree: () => createWorktree,
   daemonIdsEquivalent: () => daemonIdsEquivalent,
+  delegatedWorkerAutoApproveSettings: () => delegatedWorkerAutoApproveSettings,
   deleteDirectDispatchesByTaskId: () => deleteDirectDispatchesByTaskId,
   deleteMesh: () => deleteMesh,
   deriveMeshNodeHealthFromGit: () => deriveMeshNodeHealthFromGit,
@@ -30637,6 +30864,7 @@ __export(index_exports, {
   loadMeshCoordinatorRegistry: () => loadMeshCoordinatorRegistry,
   loadMeshRefineConfig: () => loadMeshRefineConfig,
   loadMeshWorktreeBootstrapConfig: () => loadMeshWorktreeBootstrapConfig,
+  loadRepoMeshJsonConfig: () => loadRepoMeshJsonConfig,
   loadRepoSettings: () => loadRepoSettings,
   loadState: () => loadState,
   logCommand: () => logCommand,
@@ -30677,6 +30905,7 @@ __export(index_exports, {
   normalizeMeshWorkerResult: () => normalizeMeshWorkerResult,
   normalizeMessageParts: () => normalizeMessageParts,
   normalizeRepoIdentity: () => normalizeRepoIdentity,
+  normalizeRepoMeshDeclarativeConfig: () => normalizeRepoMeshDeclarativeConfig,
   normalizeSessionModalFields: () => normalizeSessionModalFields,
   parsePorcelainV2Status: () => parsePorcelainV2Status,
   parseProviderSourceConfigUpdate: () => parseProviderSourceConfigUpdate,
@@ -30723,6 +30952,7 @@ __export(index_exports, {
   resolveCurrentGlobalInstallSurface: () => resolveCurrentGlobalInstallSurface,
   resolveDebugRuntimeConfig: () => resolveDebugRuntimeConfig,
   resolveDelegatedWorkerAutoApprove: () => resolveDelegatedWorkerAutoApprove,
+  resolveDelegatedWorkerDangerousModeAllow: () => resolveDelegatedWorkerDangerousModeAllow,
   resolveDeliveryDecision: () => resolveDeliveryDecision,
   resolveEffectiveMeshNodeHealth: () => resolveEffectiveMeshNodeHealth,
   resolveGitRepository: () => resolveGitRepository,
@@ -30746,6 +30976,7 @@ __export(index_exports, {
   runMeshWorktreeBootstrap: () => runMeshWorktreeBootstrap,
   saveConfig: () => saveConfig,
   saveState: () => saveState,
+  serializeMeshJsonConfigScaffold: () => serializeMeshJsonConfigScaffold,
   serializeV2EnvelopeToWire: () => serializeV2EnvelopeToWire,
   setDebugRuntimeConfig: () => setDebugRuntimeConfig,
   setLogLevel: () => setLogLevel,
@@ -31195,6 +31426,7 @@ function detectClaudeAskUserQuestionPromptFromJson(value, providerType = "claude
 
 // src/index.ts
 init_repo_mesh_types();
+init_mesh_json_config();
 
 // src/git/index.ts
 init_git_executor();
@@ -49432,6 +49664,7 @@ function formatMarkerTimestamp(timestamp) {
 }
 
 // src/providers/cli-provider-instance.ts
+init_auto_approve_modes();
 function approvalModalSignature(message, affirmativeAnchor) {
   return [typeof message === "string" ? message.trim() : "", affirmativeAnchor].join("::");
 }
@@ -51412,7 +51645,7 @@ var CliProviderInstance = class _CliProviderInstance {
    * resolveModal, so a plain turn that never saw an approval always returns false.
    */
   inApprovalResumeGrace(now = Date.now()) {
-    if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return false;
+    if (!this.isAutonomousMeshSession() || !this.shouldUsePtyAutoApprove()) return false;
     const resolvedAt = typeof this.adapter?.lastApprovalResolvedAt === "number" ? this.adapter.lastApprovalResolvedAt : 0;
     if (resolvedAt <= 0) return false;
     return now - resolvedAt < _CliProviderInstance.APPROVAL_RESUME_GRACE_MS;
@@ -51517,7 +51750,7 @@ var CliProviderInstance = class _CliProviderInstance {
       return;
     }
     const latestStatus = this.adapter.getStatus({ allowParse: false });
-    const latestAutoApproveActive = latestStatus.status === "waiting_approval" && this.shouldAutoApprove();
+    const latestAutoApproveActive = latestStatus.status === "waiting_approval" && this.shouldUsePtyAutoApprove();
     const latestVisibleStatus = latestAutoApproveActive || this.autoApproveBusy ? "generating" : latestStatus.status;
     LOG.debug("CLI", `[${this.type}] flush attempt: adapterStatus=${latestStatus.status} latestVisible=${latestVisibleStatus} generatingStartedAt=${this.generatingStartedAt} isWaitingForResponse=${!!this.adapter?.isWaitingForResponse} hasPartial=${!!this.adapter.getPartialResponse?.()}`);
     if (latestVisibleStatus !== "idle") {
@@ -51787,7 +52020,7 @@ var CliProviderInstance = class _CliProviderInstance {
    * session, where a human answers the prompt, is returned untouched).
    */
   stabilizeFlappingApprovalStatus(adapterStatus, now = Date.now()) {
-    if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return adapterStatus;
+    if (!this.isAutonomousMeshSession() || !this.shouldUsePtyAutoApprove()) return adapterStatus;
     const rawStatus = adapterStatus?.status;
     const resolvedAt = typeof this.adapter?.lastApprovalResolvedAt === "number" ? this.adapter.lastApprovalResolvedAt : 0;
     if (rawStatus === "waiting_approval") {
@@ -51817,7 +52050,11 @@ var CliProviderInstance = class _CliProviderInstance {
     return adapterStatus;
   }
   maybeAutoApproveStatus(adapterStatus, now = Date.now()) {
-    if (adapterStatus?.status === "waiting_approval" && this.shouldAutoApprove() && this.manualAttendance.isAttended(now)) {
+    if (!this.shouldUsePtyAutoApprove()) {
+      this.resetPtyAutoApproveState();
+      return false;
+    }
+    if (adapterStatus?.status === "waiting_approval" && this.shouldUsePtyAutoApprove() && this.manualAttendance.isAttended(now)) {
       this.lastAutoApprovalSignature = "";
       this.pendingAutoApprovalSignature = "";
       this.pendingAutoApprovalSince = 0;
@@ -51832,7 +52069,7 @@ var CliProviderInstance = class _CliProviderInstance {
       }, this.manualAttendance.remainingMs(now) + 20);
       return false;
     }
-    const autoApproveActive = adapterStatus?.status === "waiting_approval" && this.shouldAutoApprove();
+    const autoApproveActive = adapterStatus?.status === "waiting_approval" && this.shouldUsePtyAutoApprove();
     if (!autoApproveActive) {
       this.lastAutoApprovalSignature = "";
       if (this.pendingAutoApprovalSince) {
@@ -52527,15 +52764,34 @@ ${buttons.join("\n")}`;
   get cliName() {
     return this.provider.name;
   }
+  resolveAutoApproveMode() {
+    return resolveProviderAutoApproveMode(this.provider, this.settings);
+  }
+  /** Legacy boolean view retained for internal/test compatibility. */
   shouldAutoApprove() {
-    if (typeof this.settings.autoApprove === "boolean") {
-      return this.settings.autoApprove;
+    return this.resolveAutoApproveMode().active;
+  }
+  shouldUsePtyAutoApprove() {
+    const resolved = this.resolveAutoApproveMode();
+    return this.shouldAutoApprove() && resolved.strategy === "pty-parse-default";
+  }
+  resetPtyAutoApproveState() {
+    this.lastAutoApprovalSignature = "";
+    this.pendingAutoApprovalSignature = "";
+    this.pendingAutoApprovalSince = 0;
+    this.autoApproveInactiveSince = 0;
+    this.autoApproveMaskSince = 0;
+    this.stalledApprovalNudgeEpisode = 0;
+    this.autoApproveLastModalSeenAt = 0;
+    this.autoApproveBusy = false;
+    if (this.autoApproveSettleTimer) {
+      clearTimeout(this.autoApproveSettleTimer);
+      this.autoApproveSettleTimer = null;
     }
-    const providerDefault = this.provider.settings?.autoApprove?.default;
-    if (typeof providerDefault === "boolean") {
-      return providerDefault;
+    if (this.autoApproveBusyTimer) {
+      clearTimeout(this.autoApproveBusyTimer);
+      this.autoApproveBusyTimer = null;
     }
-    return false;
   }
   /** @see ProviderInstance.noteManualInteraction */
   noteManualInteraction(now = Date.now(), opts) {
@@ -52551,7 +52807,7 @@ ${buttons.join("\n")}`;
    * CLI-specific modal text.
    */
   autoApproveEffectivelyActive(status, now = Date.now()) {
-    return status === "waiting_approval" && this.shouldAutoApprove() && !this.manualAttendance.isAttended(now);
+    return status === "waiting_approval" && this.shouldUsePtyAutoApprove() && !this.manualAttendance.isAttended(now);
   }
   // STATUS-MISMATCH: true once the current auto-approve episode has been masking
   // waiting_approval behind `generating` for longer than AUTO_APPROVE_MASK_STALL_MS without
@@ -52561,7 +52817,7 @@ ${buttons.join("\n")}`;
   // maybeAutoApproveStatus (driven by getState + the recheck timer during a waiting episode);
   // this read is side-effect-free so getStatusMetadata can consult it too.
   autoApproveMaskStalled(now = Date.now()) {
-    return this.autoApproveMaskSince > 0 && now - this.autoApproveMaskSince > _CliProviderInstance.AUTO_APPROVE_MASK_STALL_MS;
+    return this.shouldUsePtyAutoApprove() && this.autoApproveMaskSince > 0 && now - this.autoApproveMaskSince > _CliProviderInstance.AUTO_APPROVE_MASK_STALL_MS;
   }
   /**
    * NOTIF-APPROVAL-MASKED (Q1b): surface a delegated worker's STALLED auto-approve modal
@@ -52585,6 +52841,7 @@ ${buttons.join("\n")}`;
    * mask-clock value) so a modal that flaps between parsed/unparsed states is announced once.
    */
   maybeEmitStalledApprovalNudge(adapterStatus, now) {
+    if (!this.shouldUsePtyAutoApprove()) return;
     if (!this.isMeshWorkerSession()) return;
     if (adapterStatus?.status !== "waiting_approval") return;
     if (!this.autoApproveMaskStalled(now)) return;
@@ -54125,6 +54382,7 @@ function shouldRestoreHostedRuntime(record, managerTag) {
 }
 
 // src/commands/cli-manager.ts
+init_auto_approve_modes();
 function isExplicitCommand(command) {
   const trimmed = command.trim();
   return path30.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~");
@@ -54351,6 +54609,24 @@ function expandThinkingLaunchArgs(template, level, levelMap) {
   const mapped = levelMap && typeof levelMap[raw] === "string" && levelMap[raw].trim() ? levelMap[raw].trim() : raw;
   return template.map((part) => part.includes("{{level}}") ? part.replace("{{level}}", mapped) : part);
 }
+function matchesRemovedLaunchArg(arg, removeArg) {
+  return arg === removeArg || removeArg.startsWith("--") && arg.startsWith(`${removeArg}=`);
+}
+function applyAutoApproveModeLaunchArgs(provider, cliArgs, settings) {
+  if (!provider) return { provider, cliArgs };
+  const resolved = resolveProviderAutoApproveMode(provider, settings);
+  if (!resolved.active || resolved.strategy !== "launch-args") return { provider, cliArgs };
+  const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+  if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+  const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+  const baseArgs = provider.spawn?.args;
+  const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0 ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg))) : baseArgs;
+  const launchProvider = filteredBaseArgs === baseArgs ? provider : { ...provider, spawn: { ...provider.spawn, args: filteredBaseArgs } };
+  return {
+    provider: launchProvider,
+    cliArgs: [...mode.launchArgs, ...cliArgs || []]
+  };
+}
 function readSubcommandSessionId(args, subcommands) {
   const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
   if (resumeIndex < 0) return void 0;
@@ -54781,22 +55057,30 @@ Run 'adhdev doctor' for detailed diagnostics.`
     if (provider) {
       console.log(colorize("cyan", `  \u{1F4E6} Using provider: ${provider.name} (${provider.type})`));
     }
-    const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
-    const cliArgsWithModel = modelLaunchArgs ? [...modelLaunchArgs, ...cliArgs || []] : cliArgs;
+    const launchSettings = {
+      ...this.providerLoader.getSettings(normalizedType),
+      ...options?.settingsOverride || {}
+    };
+    const versionResolvedProvider = provider ? this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider : void 0;
+    const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+    const launchProvider = autoApproveLaunch.provider || provider;
+    const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+    const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
+    const cliArgsWithModel = modelLaunchArgs ? [...modelLaunchArgs, ...cliArgsWithAutoApprove || []] : cliArgsWithAutoApprove;
     if (initialModel && !modelLaunchArgs) {
       LOG.warn("CLI", `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template \u2014 launching without model selection.`);
     }
     const initialThinkingLevel = options?.initialThinkingLevel;
-    const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+    const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
     const cliArgsWithBrain = thinkingLaunchArgs ? [...thinkingLaunchArgs, ...cliArgsWithModel || []] : cliArgsWithModel;
     if (initialThinkingLevel && !thinkingLaunchArgs) {
       LOG.warn("CLI", `[${normalizedType}] initialThinkingLevel='${initialThinkingLevel}' requested but provider declares no thinkingLaunchArgs template \u2014 launching without thinking-level selection.`);
     }
-    const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+    const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
     const resolvedCliArgs = sessionBinding.cliArgs;
     const instanceManager = this.deps.getInstanceManager();
-    if (provider && instanceManager) {
-      const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+    if (launchProvider && instanceManager) {
+      const resolvedProvider = launchProvider;
       await this.registerCliInstance(
         key2,
         normalizedType,
@@ -54804,7 +55088,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
         resolvedDir,
         resolvedCliArgs,
         resolvedProvider,
-        { ...this.providerLoader.getSettings(normalizedType), ...options?.settingsOverride || {} },
+        launchSettings,
         false,
         {
           providerSessionId: sessionBinding.providerSessionId,
@@ -55643,6 +55927,7 @@ init_hash();
 init_logger();
 
 // src/providers/provider-schema.ts
+init_auto_approve_modes();
 init_open_panel_support();
 var VALID_CAPABILITY_MEDIA_TYPES = /* @__PURE__ */ new Set(["text", "image", "audio", "video", "resource"]);
 var VALID_INPUT_STRATEGIES2 = /* @__PURE__ */ new Set(["native", "native_acp", "resource_link", "text_fallback", "paste", "upload"]);
@@ -55708,6 +55993,7 @@ var KNOWN_PROVIDER_FIELDS = /* @__PURE__ */ new Set([
   "providerVersion",
   "status",
   "details",
+  "autoApproveModes",
   "modelLaunchArgs",
   "modelOptions",
   "thinkingLaunchArgs",
@@ -55769,6 +56055,7 @@ function validateProviderDefinition(raw) {
   validateCapabilities(provider, controls, errors);
   validateNativeHistory(provider.nativeHistory, errors);
   validateMeshCoordinator(provider.meshCoordinator, errors);
+  validateAutoApproveModes(provider.autoApproveModes, errors);
   for (const control of controls) {
     validateControl(control, errors);
   }
@@ -55777,6 +56064,75 @@ function validateProviderDefinition(raw) {
   }
   return { errors, warnings };
 }
+function validateAutoApproveModes(raw, errors) {
+  if (raw === void 0) return;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    errors.push("autoApproveModes must be an object");
+    return;
+  }
+  const config = raw;
+  const defaultModeId = typeof config.default === "string" ? config.default.trim() : "";
+  if (!defaultModeId) {
+    errors.push("autoApproveModes.default must be a non-empty string");
+  } else {
+    config.default = defaultModeId;
+  }
+  if (!Array.isArray(config.modes) || config.modes.length === 0) {
+    errors.push("autoApproveModes.modes must be a non-empty array");
+    return;
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, rawMode] of config.modes.entries()) {
+    const prefix = `autoApproveModes.modes[${index}]`;
+    if (!rawMode || typeof rawMode !== "object" || Array.isArray(rawMode)) {
+      errors.push(`${prefix} must be an object`);
+      continue;
+    }
+    const mode = rawMode;
+    const id = typeof mode.id === "string" ? mode.id.trim() : "";
+    if (!id) {
+      errors.push(`${prefix}.id must be a non-empty string`);
+    } else if (ids.has(id)) {
+      errors.push(`${prefix}.id must be unique (duplicate: ${id})`);
+    } else {
+      ids.add(id);
+      mode.id = id;
+    }
+    if (typeof mode.label !== "string" || !mode.label.trim()) {
+      errors.push(`${prefix}.label must be a non-empty string`);
+    }
+    const strategy = mode.strategy;
+    if (!["pty-parse-default", "launch-args", "post-boot-command"].includes(String(strategy))) {
+      errors.push(`${prefix}.strategy must be one of: pty-parse-default, launch-args, post-boot-command`);
+    } else if (strategy === "post-boot-command") {
+      errors.push(`${prefix}.strategy post-boot-command is reserved and unsupported in v1`);
+    }
+    const risk = mode.risk;
+    if (!["safe", "caution", "dangerous"].includes(String(risk))) {
+      errors.push(`${prefix}.risk must be one of: safe, caution, dangerous`);
+    }
+    for (const field of ["launchArgs", "removeArgs"]) {
+      const value = mode[field];
+      if (value !== void 0 && (!Array.isArray(value) || value.some((arg) => typeof arg !== "string" || !arg.trim()))) {
+        errors.push(`${prefix}.${field} must be an array of non-empty strings when provided`);
+      }
+    }
+    if (strategy === "launch-args" && (!Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0)) {
+      errors.push(`${prefix}.launchArgs must be a non-empty array for launch-args strategy`);
+    }
+    if (["safe", "caution", "dangerous"].includes(String(risk)) && deriveAutoApproveModeRisk(mode) === "dangerous") {
+      mode.risk = "dangerous";
+    }
+    if (mode.risk === "dangerous" && (typeof mode.warning !== "string" || !mode.warning.trim())) {
+      errors.push(`${prefix}.warning is required for dangerous modes`);
+    } else if (mode.warning !== void 0 && (typeof mode.warning !== "string" || !mode.warning.trim())) {
+      errors.push(`${prefix}.warning must be a non-empty string when provided`);
+    }
+  }
+  if (defaultModeId && !ids.has(defaultModeId)) {
+    errors.push(`autoApproveModes.default must reference an existing mode id: ${defaultModeId}`);
+  }
+}
 function validateCapabilities(provider, controls, errors) {
   const capabilities = provider.capabilities;
   if (provider.contractVersion === 2) {
@@ -60386,6 +60742,139 @@ var meshCrudHandlers = {
       return { success: false, error: e.message };
     }
   },
+  // READ path for `.adhdev/mesh.json` — returns the currently-committed repo
+  // config (parsed + normalized) for a workspace so a UI can render/edit the
+  // existing declarative zones (notably `providerDefaults.autoApproveModes`)
+  // WITHOUT re-deriving them from the machine-local scaffold. Never writes.
+  // `config` is undefined when no repo file exists (sourceType 'unavailable') or
+  // it is unparseable (sourceType 'invalid', with the parse error surfaced).
+  read_mesh_json_config: async (_ctx, args) => {
+    const workspace = typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+    try {
+      const { loadRepoMeshJsonConfig: loadRepoMeshJsonConfig2 } = await Promise.resolve().then(() => (init_mesh_json_config(), mesh_json_config_exports));
+      const loaded = loadRepoMeshJsonConfig2(workspace);
+      return {
+        success: true,
+        workspace,
+        sourceType: loaded.sourceType,
+        source: loaded.source,
+        ...loaded.path ? { path: loaded.path } : {},
+        ...loaded.error ? { error: loaded.error } : {},
+        config: loaded.config,
+        // Convenience projection so the UI does not have to reach into config.
+        providerDefaults: loaded.config?.providerDefaults
+      };
+    } catch (e) {
+      return { success: false, error: e.message };
+    }
+  },
+  // Partial-edit WRITE path for `.adhdev/mesh.json` `providerDefaults` — a
+  // READ-MODIFY-WRITE that preserves operator hand-edits. Unlike
+  // write_mesh_json_config (which rebuilds the WHOLE file from the machine-local
+  // scaffold and can silently drop hand-edited zones), this parses the existing
+  // repo file, merges ONLY the providerDefaults.autoApproveModes zone, and
+  // re-serializes — coordinator prompt, operating notes and limits authored in
+  // the repo are carried through untouched. Defaults to dry-run.
+  //
+  // args: { workspace?, autoApproveModes: Record<providerType,modeId>, write?, merge? }
+  //   merge=true (default): per-provider merge into the existing map; a modeId of
+  //     '' | null removes that provider's entry. merge=false: REPLACE the whole
+  //     autoApproveModes map with the supplied one.
+  set_mesh_provider_defaults: async (_ctx, args) => {
+    const workspace = typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+    const write = args?.write === true;
+    const merge = args?.merge !== false;
+    const inputModes = args?.autoApproveModes;
+    if (inputModes !== void 0 && (typeof inputModes !== "object" || inputModes === null || Array.isArray(inputModes))) {
+      return { success: false, error: "autoApproveModes must be an object (providerType \u2192 modeId) when provided" };
+    }
+    try {
+      const {
+        loadRepoMeshJsonConfig: loadRepoMeshJsonConfig2,
+        normalizeRepoMeshDeclarativeConfig: normalizeRepoMeshDeclarativeConfig2,
+        MESH_JSON_CONFIG_LOCATIONS: MESH_JSON_CONFIG_LOCATIONS2
+      } = await Promise.resolve().then(() => (init_mesh_json_config(), mesh_json_config_exports));
+      const { existsSync: existsSync57, readFileSync: readFileSync44, mkdirSync: mkdirSync23, writeFileSync: writeFileSync25 } = await import("fs");
+      const { dirname: dirname19, join: join54 } = await import("path");
+      const yaml6 = await import("js-yaml");
+      const relativePath = MESH_JSON_CONFIG_LOCATIONS2[0];
+      let baseDoc = { version: 1 };
+      let existingPath = join54(workspace, relativePath);
+      let existedAsYaml = false;
+      for (const relative5 of MESH_JSON_CONFIG_LOCATIONS2) {
+        const candidate = join54(workspace, relative5);
+        if (!existsSync57(candidate)) continue;
+        try {
+          const text = readFileSync44(candidate, "utf-8");
+          const parsed = /\.json$/i.test(candidate) ? JSON.parse(text) : yaml6.load(text);
+          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            baseDoc = parsed;
+            existingPath = candidate;
+            existedAsYaml = !/\.json$/i.test(candidate);
+          }
+        } catch (e) {
+          return { success: false, error: `existing ${relative5} is unparseable, refusing to overwrite: ${e?.message || e}` };
+        }
+        break;
+      }
+      const existingPd = baseDoc.providerDefaults && typeof baseDoc.providerDefaults === "object" && !Array.isArray(baseDoc.providerDefaults) ? baseDoc.providerDefaults : {};
+      const existingModes = existingPd.autoApproveModes && typeof existingPd.autoApproveModes === "object" && !Array.isArray(existingPd.autoApproveModes) ? { ...existingPd.autoApproveModes } : {};
+      const nextModes = merge ? existingModes : {};
+      if (inputModes) {
+        for (const [providerType, modeId] of Object.entries(inputModes)) {
+          const type = typeof providerType === "string" ? providerType.trim() : "";
+          if (!type) continue;
+          const id = typeof modeId === "string" ? modeId.trim() : "";
+          if (id) nextModes[type] = id;
+          else delete nextModes[type];
+        }
+      }
+      const nextDoc = { ...baseDoc, version: 1 };
+      if (Object.keys(nextModes).length) {
+        nextDoc.providerDefaults = { ...existingPd, autoApproveModes: nextModes };
+      } else {
+        if (nextDoc.providerDefaults) {
+          const { autoApproveModes, ...restPd } = nextDoc.providerDefaults;
+          if (Object.keys(restPd).length) nextDoc.providerDefaults = restPd;
+          else delete nextDoc.providerDefaults;
+        }
+      }
+      const validation = normalizeRepoMeshDeclarativeConfig2(nextDoc);
+      if (!validation.valid) {
+        return { success: false, error: `merged mesh.json is invalid: ${validation.errors.join("; ")}` };
+      }
+      const absolutePath = existingPath;
+      const serialized = existedAsYaml ? yaml6.dump(nextDoc, { indent: 2 }) : `${JSON.stringify(nextDoc, null, 2)}
+`;
+      if (!write) {
+        return {
+          success: true,
+          written: false,
+          dryRun: true,
+          path: absolutePath,
+          relativePath,
+          merge,
+          providerDefaults: nextDoc.providerDefaults,
+          preview: serialized,
+          note: "Dry-run: nothing written. Re-run with write=true to persist. Only the providerDefaults zone is merged; other repo zones are preserved."
+        };
+      }
+      mkdirSync23(dirname19(absolutePath), { recursive: true });
+      writeFileSync25(absolutePath, serialized, "utf-8");
+      return {
+        success: true,
+        written: true,
+        dryRun: false,
+        path: absolutePath,
+        relativePath,
+        merge,
+        providerDefaults: nextDoc.providerDefaults,
+        note: "Wrote providerDefaults into .adhdev/mesh.json (read-modify-write; other zones preserved). Commit it to the repo."
+      };
+    } catch (e) {
+      return { success: false, error: e.message };
+    }
+  },
   delete_mesh: async (_ctx, args) => {
     const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
     if (!meshId) return { success: false, error: "meshId required" };
@@ -76509,6 +76998,9 @@ var V1_CONTRACT_VERSION = "1.0.0";
   MAX_LEDGER_SLICE_LIMIT,
   MESH_CONVERGE_FAST_FORWARD_TAG,
   MESH_CONVERGE_REFINE_TAG,
+  MESH_JSON_CONFIG_LOCATIONS,
+  MESH_JSON_CONFIG_SCHEMA,
+  MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE,
   MESH_MAX_PARALLEL_TASKS_MAX,
   MESH_MAX_PARALLEL_TASKS_MIN,
   MESH_MISSION_LIST_HISTORY_ID_LIMIT,
@@ -76568,6 +77060,7 @@ var V1_CONTRACT_VERSION = "1.0.0";
   buildMeshActiveWorkSummary,
   buildMeshAsyncRefineJobs,
   buildMeshHostRequiredFailure,
+  buildMeshJsonConfigScaffold,
   buildMeshLedgerReconciliationEvidence,
   buildMeshLedgerReplicaEvidence,
   buildMeshMagiActivity,
@@ -76618,6 +77111,7 @@ var V1_CONTRACT_VERSION = "1.0.0";
   createSessionDelivery,
   createWorktree,
   daemonIdsEquivalent,
+  delegatedWorkerAutoApproveSettings,
   deleteDirectDispatchesByTaskId,
   deleteMesh,
   deriveMeshNodeHealthFromGit,
@@ -76731,6 +77225,7 @@ var V1_CONTRACT_VERSION = "1.0.0";
   loadMeshCoordinatorRegistry,
   loadMeshRefineConfig,
   loadMeshWorktreeBootstrapConfig,
+  loadRepoMeshJsonConfig,
   loadRepoSettings,
   loadState,
   logCommand,
@@ -76771,6 +77266,7 @@ var V1_CONTRACT_VERSION = "1.0.0";
   normalizeMeshWorkerResult,
   normalizeMessageParts,
   normalizeRepoIdentity,
+  normalizeRepoMeshDeclarativeConfig,
   normalizeSessionModalFields,
   parsePorcelainV2Status,
   parseProviderSourceConfigUpdate,
@@ -76817,6 +77313,7 @@ var V1_CONTRACT_VERSION = "1.0.0";
   resolveCurrentGlobalInstallSurface,
   resolveDebugRuntimeConfig,
   resolveDelegatedWorkerAutoApprove,
+  resolveDelegatedWorkerDangerousModeAllow,
   resolveDeliveryDecision,
   resolveEffectiveMeshNodeHealth,
   resolveGitRepository,
@@ -76840,6 +77337,7 @@ var V1_CONTRACT_VERSION = "1.0.0";
   runMeshWorktreeBootstrap,
   saveConfig,
   saveState,
+  serializeMeshJsonConfigScaffold,
   serializeV2EnvelopeToWire,
   setDebugRuntimeConfig,
   setLogLevel,