@adhdev/daemon-core 1.0.18-rc.16 → 1.0.18-rc.18

package/dist/index.mjs

@@ -25,6 +25,62 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/providers/auto-approve-modes.ts
+function isKnownDangerousLaunchArg(arg) {
+  const normalized = arg.trim();
+  if (KNOWN_DANGEROUS_LAUNCH_ARGS.has(normalized)) return true;
+  return normalized.startsWith("--dangerously-skip-permissions=") || normalized.startsWith("--dangerously-bypass-approvals-and-sandbox=");
+}
+function deriveAutoApproveModeRisk(mode) {
+  return Array.isArray(mode.launchArgs) && mode.launchArgs.some(isKnownDangerousLaunchArg) ? "dangerous" : mode.risk;
+}
+function inactiveMode(modeId = "") {
+  return { active: false, strategy: "pty-parse-default", modeId };
+}
+function resolveConfiguredMode(provider, mode, settings) {
+  if (mode.strategy === "post-boot-command") return inactiveMode(mode.id);
+  if (settings?.launchedByCoordinator === true && settings.delegatedWorkerDangerousModeAllow !== true && deriveAutoApproveModeRisk(mode) === "dangerous") {
+    const fallback = provider.autoApproveModes?.modes.find((candidate) => candidate.strategy === "pty-parse-default" && deriveAutoApproveModeRisk(candidate) !== "dangerous");
+    return fallback ? { active: true, strategy: fallback.strategy, modeId: fallback.id } : inactiveMode(mode.id);
+  }
+  return { active: true, strategy: mode.strategy, modeId: mode.id };
+}
+function resolveProviderAutoApproveMode(provider, settings) {
+  const config = provider.autoApproveModes;
+  const explicitModeId = settings?.autoApproveMode;
+  if (typeof explicitModeId === "string") {
+    const mode = config?.modes.find((candidate) => candidate.id === explicitModeId);
+    if (!mode) return inactiveMode(explicitModeId);
+    return resolveConfiguredMode(provider, mode, settings);
+  }
+  const explicitLegacy = settings?.autoApprove;
+  const providerLegacyDefault = provider.settings?.autoApprove?.default;
+  const legacyActive = typeof explicitLegacy === "boolean" ? explicitLegacy : typeof providerLegacyDefault === "boolean" ? providerLegacyDefault : false;
+  if (!legacyActive) return inactiveMode();
+  if (!config) {
+    return { active: true, strategy: "pty-parse-default", modeId: "legacy" };
+  }
+  const defaultMode = config.modes.find((mode) => mode.id === config.default);
+  if (!defaultMode) return inactiveMode(config.default);
+  return resolveConfiguredMode(provider, defaultMode, settings);
+}
+function findProviderAutoApproveMode(provider, modeId) {
+  return provider?.autoApproveModes?.modes.find((mode) => mode.id === modeId);
+}
+var KNOWN_DANGEROUS_LAUNCH_ARGS;
+var init_auto_approve_modes = __esm({
+  "src/providers/auto-approve-modes.ts"() {
+    "use strict";
+    KNOWN_DANGEROUS_LAUNCH_ARGS = /* @__PURE__ */ new Set([
+      "--dangerously-skip-permissions",
+      "--dangerously-bypass-approvals-and-sandbox",
+      "bypassPermissions",
+      "sandbox_mode=danger-full-access",
+      "approval_policy=never"
+    ]);
+  }
+});
+
 // src/repo-mesh-types.ts
 function normalizeMeshSchedulingStrategy(value) {
   if (typeof value !== "string") return DEFAULT_MESH_SCHEDULING_STRATEGY;
@@ -111,6 +167,11 @@ function mergeAndNormalizePolicy(base, patch) {
   } else {
     delete policy.autoConvergeCodeChange;
   }
+  if (policy.delegatedWorkerDangerousModeAllow === true) {
+    policy.delegatedWorkerDangerousModeAllow = true;
+  } else {
+    delete policy.delegatedWorkerDangerousModeAllow;
+  }
   if (policy.coordinatorIdlePushPolicy === "auto_silent_on_dispatch") {
     policy.coordinatorIdlePushPolicy = "auto_silent_on_dispatch";
   } else {
@@ -118,14 +179,38 @@ function mergeAndNormalizePolicy(base, patch) {
   }
   return policy;
 }
-function resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy) {
+function resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy, provider, repoConfig, providerType) {
+  let enabled = true;
   if (typeof nodePolicy?.delegatedWorkerAutoApprove === "boolean") {
-    return nodePolicy.delegatedWorkerAutoApprove;
-  }
-  if (typeof meshPolicy?.delegatedWorkerAutoApprove === "boolean") {
-    return meshPolicy.delegatedWorkerAutoApprove;
-  }
-  return true;
+    enabled = nodePolicy.delegatedWorkerAutoApprove;
+  } else if (typeof meshPolicy?.delegatedWorkerAutoApprove === "boolean") {
+    enabled = meshPolicy.delegatedWorkerAutoApprove;
+  }
+  if (!enabled) return false;
+  const modes = provider?.autoApproveModes;
+  if (!modes) return true;
+  const requestedModeRaw = typeof providerType === "string" ? repoConfig?.providerDefaults?.autoApproveModes?.[providerType.trim()] : void 0;
+  const requestedModeId = typeof requestedModeRaw === "string" && requestedModeRaw.trim() ? requestedModeRaw.trim() : "";
+  const requestedMode = requestedModeId ? modes.modes.find((mode) => mode.id === requestedModeId) : void 0;
+  const selectedMode = requestedMode ?? modes.modes.find((mode) => mode.id === modes.default);
+  if (!selectedMode || selectedMode.strategy === "post-boot-command") return false;
+  const dangerousAllowed = resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy);
+  if (deriveAutoApproveModeRisk(selectedMode) === "dangerous" && !dangerousAllowed) {
+    const ptyFallback = modes.modes.find((mode) => mode.strategy === "pty-parse-default" && deriveAutoApproveModeRisk(mode) !== "dangerous");
+    return ptyFallback?.id || false;
+  }
+  return selectedMode.id;
+}
+function resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy) {
+  if (typeof nodePolicy?.delegatedWorkerDangerousModeAllow === "boolean") {
+    return nodePolicy.delegatedWorkerDangerousModeAllow;
+  }
+  return meshPolicy?.delegatedWorkerDangerousModeAllow === true;
+}
+function delegatedWorkerAutoApproveSettings(meshPolicy, nodePolicy, provider, repoConfig, providerType) {
+  const resolved = resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy, provider, repoConfig, providerType);
+  const delegatedWorkerDangerousModeAllow = resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy);
+  return typeof resolved === "string" ? { autoApprove: void 0, autoApproveMode: resolved, delegatedWorkerDangerousModeAllow } : { autoApprove: resolved, autoApproveMode: void 0, delegatedWorkerDangerousModeAllow };
 }
 function resolveAllowSendKeysDestructive(meshPolicy, nodePolicy) {
   if (typeof nodePolicy?.allowSendKeysDestructive === "boolean") {
@@ -155,6 +240,7 @@ var MESH_SCHEDULING_STRATEGIES, DEFAULT_MESH_SCHEDULING_STRATEGY, MESH_CONVERGE_
 var init_repo_mesh_types = __esm({
   "src/repo-mesh-types.ts"() {
     "use strict";
+    init_auto_approve_modes();
     MESH_SCHEDULING_STRATEGIES = [
       "first_eligible",
       "least_loaded",
@@ -182,6 +268,7 @@ var init_repo_mesh_types = __esm({
       // any specific session manually; that override is preserved per-device.
       spawnedSessionVisibility: "hidden",
       delegatedWorkerAutoApprove: true,
+      delegatedWorkerDangerousModeAllow: false,
       sessionCleanupOnNodeRemove: "preserve",
       // MAGI auto-launches a worker session per pinned replica target with no idle
       // session; those stay idle-LIVE after their turn. Default ON (stop_and_delete)
@@ -221,6 +308,267 @@ var init_repo_mesh_types = __esm({
   }
 });
 
+// src/config/mesh-json-config.ts
+var mesh_json_config_exports = {};
+__export(mesh_json_config_exports, {
+  MESH_JSON_CONFIG_LOCATIONS: () => MESH_JSON_CONFIG_LOCATIONS,
+  MESH_JSON_CONFIG_SCHEMA: () => MESH_JSON_CONFIG_SCHEMA,
+  MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE: () => MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE,
+  applyRepoMeshConfig: () => applyRepoMeshConfig,
+  buildMeshJsonConfigScaffold: () => buildMeshJsonConfigScaffold,
+  loadRepoMeshJsonConfig: () => loadRepoMeshJsonConfig,
+  mergeEffectiveCoordinatorConfig: () => mergeEffectiveCoordinatorConfig,
+  mergeEffectiveOperatingNotes: () => mergeEffectiveOperatingNotes,
+  normalizeRepoMeshDeclarativeConfig: () => normalizeRepoMeshDeclarativeConfig,
+  serializeMeshJsonConfigScaffold: () => serializeMeshJsonConfigScaffold
+});
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import * as yaml from "js-yaml";
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseConfigText(path46, text) {
+  if (/\.json$/i.test(path46)) return JSON.parse(text);
+  return yaml.load(text);
+}
+function normalizeOperatingNote(value) {
+  if (!isRecord(value)) return null;
+  const text = typeof value.text === "string" ? value.text.trim() : "";
+  if (!text) return null;
+  const category = value.category === "provider_quirk" || value.category === "pattern_to_avoid" || value.category === "recovery_lesson" ? value.category : void 0;
+  return {
+    text,
+    ...category ? { category } : {},
+    ...typeof value.createdAt === "string" ? { createdAt: value.createdAt } : {},
+    ...typeof value.sourceCoordinator === "string" ? { sourceCoordinator: value.sourceCoordinator } : {},
+    // Operating-notes lifecycle: a repo-declared note may pin itself or set an
+    // explicit expiry, same as a runtime-recorded one. Phase 2 (b)/(c): it may
+    // also declare supersedes/subjectKey to retire an earlier note or group
+    // same-subject notes for folding.
+    ...value.pinned === true ? { pinned: true } : {},
+    ...typeof value.expiresAt === "string" ? { expiresAt: value.expiresAt } : {},
+    ...typeof value.supersedes === "string" ? { supersedes: value.supersedes } : {},
+    ...typeof value.subjectKey === "string" ? { subjectKey: value.subjectKey } : {}
+  };
+}
+function normalizeRepoMeshDeclarativeConfig(parsed) {
+  const errors = [];
+  if (!isRecord(parsed)) return { valid: false, errors: ["config must be an object"] };
+  if (parsed.version !== 1) {
+    return { valid: false, errors: [`version must be 1 (got ${JSON.stringify(parsed.version)})`] };
+  }
+  const config = { version: 1 };
+  if (parsed.coordinator !== void 0) {
+    if (isRecord(parsed.coordinator)) {
+      const coord = {};
+      const c = parsed.coordinator;
+      if (typeof c.systemPromptOverride === "string") coord.systemPromptOverride = c.systemPromptOverride;
+      if (typeof c.systemPromptAppend === "string") coord.systemPromptAppend = c.systemPromptAppend;
+      if (Number.isFinite(Number(c.maxPromptChars))) coord.maxPromptChars = Number(c.maxPromptChars);
+      config.coordinator = coord;
+    } else {
+      errors.push("coordinator must be an object when provided");
+    }
+  }
+  if (parsed.operatingNotes !== void 0) {
+    if (Array.isArray(parsed.operatingNotes)) {
+      const notes = parsed.operatingNotes.map(normalizeOperatingNote).filter((n) => n !== null);
+      if (notes.length) config.operatingNotes = notes;
+    } else {
+      errors.push("operatingNotes must be an array when provided");
+    }
+  }
+  if (parsed.limits !== void 0) {
+    if (isRecord(parsed.limits)) {
+      const limits = {};
+      if (Number.isFinite(Number(parsed.limits.maxNoteChars))) limits.maxNoteChars = Number(parsed.limits.maxNoteChars);
+      if (Number.isFinite(Number(parsed.limits.maxNotes))) limits.maxNotes = Number(parsed.limits.maxNotes);
+      if (Object.keys(limits).length) config.limits = limits;
+    } else {
+      errors.push("limits must be an object when provided");
+    }
+  }
+  if (parsed.providerDefaults !== void 0) {
+    if (isRecord(parsed.providerDefaults)) {
+      const pd = {};
+      const rawModes = parsed.providerDefaults.autoApproveModes;
+      if (rawModes !== void 0) {
+        if (isRecord(rawModes)) {
+          const modes = {};
+          for (const [providerType, modeId] of Object.entries(rawModes)) {
+            const type = typeof providerType === "string" ? providerType.trim() : "";
+            const id = typeof modeId === "string" ? modeId.trim() : "";
+            if (type && id) modes[type] = id;
+          }
+          if (Object.keys(modes).length) pd.autoApproveModes = modes;
+        } else {
+          errors.push("providerDefaults.autoApproveModes must be an object when provided");
+        }
+      }
+      if (Object.keys(pd).length) config.providerDefaults = pd;
+    } else {
+      errors.push("providerDefaults must be an object when provided");
+    }
+  }
+  return { valid: true, config, errors };
+}
+function loadRepoMeshJsonConfig(workspace) {
+  const bases = [];
+  const ws = typeof workspace === "string" ? workspace.trim() : "";
+  if (ws) bases.push(ws);
+  let cwd = "";
+  try {
+    cwd = process.cwd();
+  } catch {
+  }
+  if (cwd && cwd !== ws) bases.push(cwd);
+  for (const base of bases) {
+    for (const relative5 of MESH_JSON_CONFIG_LOCATIONS) {
+      const configPath = join(base, relative5);
+      if (!existsSync(configPath)) continue;
+      try {
+        const parsed = parseConfigText(configPath, readFileSync(configPath, "utf-8"));
+        const result = normalizeRepoMeshDeclarativeConfig(parsed);
+        if (!result.valid || !result.config) {
+          return { source: relative5, sourceType: "invalid", path: configPath, error: result.errors.join("; ") };
+        }
+        return { config: result.config, source: relative5, sourceType: "repo_file", path: configPath };
+      } catch (error) {
+        return { source: relative5, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
+      }
+    }
+  }
+  return {
+    source: "unavailable",
+    sourceType: "unavailable",
+    error: `No repo mesh config found. Checked: ${MESH_JSON_CONFIG_LOCATIONS.join(", ")}`
+  };
+}
+function mergeEffectiveCoordinatorConfig(repoCoord, localCoord) {
+  const out = { ...localCoord || {} };
+  const localOverride = localCoord?.systemPromptOverride?.trim();
+  const repoOverride = repoCoord?.systemPromptOverride?.trim();
+  if (localOverride) {
+    out.systemPromptOverride = localCoord.systemPromptOverride;
+  } else if (repoOverride) {
+    out.systemPromptOverride = repoCoord.systemPromptOverride;
+  } else {
+    delete out.systemPromptOverride;
+  }
+  const repoAppend = repoCoord?.systemPromptAppend?.trim() ? repoCoord.systemPromptAppend.trim() : "";
+  const localAppendRaw = localCoord?.systemPromptAppend ?? localCoord?.systemPromptSuffix;
+  const localAppend = localAppendRaw?.trim() ? localAppendRaw.trim() : "";
+  const stacked = [repoAppend, localAppend].filter(Boolean).join("\n\n");
+  if (stacked) {
+    out.systemPromptAppend = stacked;
+    delete out.systemPromptSuffix;
+  }
+  return out;
+}
+function mergeEffectiveOperatingNotes(repoNotes, ledgerNotes) {
+  const usable = (notes) => Array.isArray(notes) ? notes.filter((n) => n && typeof n.text === "string" && n.text.trim()) : [];
+  const repo = usable(repoNotes);
+  const ledger = usable(ledgerNotes);
+  const ledgerTexts = new Set(ledger.map((n) => n.text.trim()));
+  const repoKept = repo.filter((n) => !ledgerTexts.has(n.text.trim()));
+  const merged = [...repoKept, ...ledger];
+  return merged.length ? merged : void 0;
+}
+function applyRepoMeshConfig(mesh, repoConfig) {
+  if (!repoConfig) return mesh;
+  return {
+    ...mesh,
+    coordinator: mergeEffectiveCoordinatorConfig(repoConfig.coordinator, mesh.coordinator)
+  };
+}
+function buildMeshJsonConfigScaffold(mesh) {
+  const scaffold = { version: 1 };
+  const coord = {};
+  const override = mesh.coordinator?.systemPromptOverride;
+  if (typeof override === "string" && override.trim()) coord.systemPromptOverride = override;
+  const append = mesh.coordinator?.systemPromptAppend ?? mesh.coordinator?.systemPromptSuffix;
+  if (typeof append === "string" && append.trim()) coord.systemPromptAppend = append;
+  if (Object.keys(coord).length) scaffold.coordinator = coord;
+  return scaffold;
+}
+function serializeMeshJsonConfigScaffold(config) {
+  return JSON.stringify(config, null, 2);
+}
+var MESH_JSON_CONFIG_LOCATIONS, MESH_JSON_CONFIG_SCHEMA, MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE;
+var init_mesh_json_config = __esm({
+  "src/config/mesh-json-config.ts"() {
+    "use strict";
+    MESH_JSON_CONFIG_LOCATIONS = [
+      ".adhdev/mesh.json",
+      ".adhdev/mesh.yaml",
+      ".adhdev/mesh.yml"
+    ];
+    MESH_JSON_CONFIG_SCHEMA = {
+      $schema: "https://json-schema.org/draft/2020-12/schema",
+      title: "ADHDev Repo Mesh Declarative Config",
+      type: "object",
+      additionalProperties: false,
+      required: ["version"],
+      properties: {
+        version: { const: 1 },
+        coordinator: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            systemPromptOverride: { type: "string" },
+            systemPromptAppend: { type: "string" },
+            maxPromptChars: { type: "number", minimum: 1 }
+          }
+        },
+        operatingNotes: {
+          type: "array",
+          maxItems: 200,
+          items: {
+            type: "object",
+            additionalProperties: false,
+            required: ["text"],
+            properties: {
+              text: { type: "string", minLength: 1 },
+              category: { enum: ["provider_quirk", "pattern_to_avoid", "recovery_lesson"] },
+              createdAt: { type: "string" },
+              sourceCoordinator: { type: "string" }
+            }
+          }
+        },
+        limits: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            maxNoteChars: { type: "number", minimum: 1 },
+            maxNotes: { type: "number", minimum: 1 }
+          }
+        },
+        providerDefaults: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            // providerType → requested auto-approve mode ID. Mode IDs are
+            // validated against the live provider spec at resolve time; an
+            // unknown ID is ignored (provider default is used), so the schema
+            // only constrains the shape (string→string), not the ID values.
+            autoApproveModes: {
+              type: "object",
+              additionalProperties: { type: "string" }
+            }
+          }
+        }
+      }
+    };
+    MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE = {
+      autoApproveModes: {
+        "claude-cli": "accept-edits",
+        "codex-cli": "auto"
+      }
+    };
+  }
+});
+
 // src/git/git-executor.ts
 var git_executor_exports = {};
 __export(git_executor_exports, {
@@ -437,10 +785,10 @@ function readInjected(value) {
 }
 function getDaemonBuildInfo() {
   if (cached) return cached;
-  const commit = readInjected(true ? "74f34080bcd7c145e55fd7e5fd492a40a4942bc4" : void 0) ?? "unknown";
-  const commitShort = readInjected(true ? "74f34080" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
-  const version = readInjected(true ? "1.0.18-rc.16" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
-  const builtAt = readInjected(true ? "2026-07-23T02:29:46.281Z" : void 0);
+  const commit = readInjected(true ? "56b83deb250a8ea89ba1a7ec587720e165d20062" : void 0) ?? "unknown";
+  const commitShort = readInjected(true ? "56b83deb" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
+  const version = readInjected(true ? "1.0.18-rc.18" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
+  const builtAt = readInjected(true ? "2026-07-23T06:00:17.638Z" : void 0);
   cached = builtAt ? { commit, commitShort, version, builtAt } : { commit, commitShort, version };
   return cached;
 }
@@ -452,17 +800,17 @@ var init_build_info = __esm({
 });
 
 // src/git/change-impact-config.ts
-import { existsSync, readdirSync, readFileSync, statSync } from "fs";
-import { join } from "path";
-import * as yaml from "js-yaml";
-function isRecord(value) {
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { join as join2 } from "path";
+import * as yaml2 from "js-yaml";
+function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((v) => typeof v === "string" && v.length > 0);
 }
 function validateTarget(value, key2, errors) {
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     errors.push(`impactTargets.${key2} must be an object`);
     return void 0;
   }
@@ -478,7 +826,7 @@ function validateTarget(value, key2, errors) {
 }
 function validateChangeImpactConfig(raw, source = "inline") {
   const errors = [];
-  if (!isRecord(raw)) {
+  if (!isRecord2(raw)) {
     return { valid: false, errors: [`${source}: config must be an object`] };
   }
   const config = {};
@@ -495,7 +843,7 @@ function validateChangeImpactConfig(raw, source = "inline") {
     else errors.push("nonRuntimeRootFilePatterns must be an array of non-empty strings");
   }
   if (raw.impactTargets !== void 0) {
-    if (!isRecord(raw.impactTargets)) {
+    if (!isRecord2(raw.impactTargets)) {
       errors.push("impactTargets must be an object");
     } else {
       const targets = {};
@@ -517,23 +865,23 @@ function validateChangeImpactConfig(raw, source = "inline") {
   }
   return { valid: errors.length === 0, errors, config: errors.length === 0 ? config : void 0 };
 }
-function parseConfigText(path46, text) {
+function parseConfigText2(path46, text) {
   if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml.load(text);
+  return yaml2.load(text);
 }
 function loadChangeImpactConfig(repoRoot) {
   for (const relative5 of CHANGE_IMPACT_CONFIG_LOCATIONS) {
-    const configPath = join(repoRoot, relative5);
-    if (!existsSync(configPath)) continue;
+    const configPath = join2(repoRoot, relative5);
+    if (!existsSync2(configPath)) continue;
     try {
-      const text = readFileSync(configPath, "utf-8");
+      const text = readFileSync2(configPath, "utf-8");
       let mtimeMs = 0;
       try {
         mtimeMs = statSync(configPath).mtimeMs;
       } catch {
         mtimeMs = text.length;
       }
-      const parsed = parseConfigText(configPath, text);
+      const parsed = parseConfigText2(configPath, text);
       const validation = validateChangeImpactConfig(parsed, relative5);
       if (!validation.valid) {
         return {
@@ -602,10 +950,10 @@ function suggestChangeImpactConfig(repoRoot) {
   const daemon = /* @__PURE__ */ new Set();
   const web = /* @__PURE__ */ new Set();
   const unclassified = [];
-  const roots = ["packages", join("oss", "packages")];
+  const roots = ["packages", join2("oss", "packages")];
   for (const rel of roots) {
-    const packagesRoot = join(repoRoot, rel);
-    if (!existsSync(packagesRoot)) continue;
+    const packagesRoot = join2(repoRoot, rel);
+    if (!existsSync2(packagesRoot)) continue;
     for (const name of listPackageDirs(packagesRoot)) {
       if (/(^web[-.]|[-.]web$)/i.test(name) || /dashboard|frontend|ui$/i.test(name)) {
         web.add(name);
@@ -693,7 +1041,7 @@ var init_change_impact_config = __esm({
 });
 
 // src/git/git-status.ts
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function statusCacheKey(workspace, options) {
   const includeSubmodules = options.includeSubmodules !== false;
   const refreshUpstream = options.refreshUpstream === true;
@@ -876,7 +1224,7 @@ async function refineVerdictThroughSubmodules(repoPath, fromRef, toRef, options,
     }
     let subVerdict;
     try {
-      subVerdict = await classifyChangedPackages(join2(repoPath, subPath), range.from, range.to, {
+      subVerdict = await classifyChangedPackages(join3(repoPath, subPath), range.from, range.to, {
         ...options,
         // Do not force the root's injected config onto the submodule — let it resolve
         // its own .adhdev/change-impact.* (or fall back to defaults).
@@ -1641,8 +1989,8 @@ __export(config_exports, {
   updateConfig: () => updateConfig
 });
 import { homedir } from "os";
-import { join as join3 } from "path";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync, chmodSync } from "fs";
+import { join as join4 } from "path";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync, chmodSync } from "fs";
 import { randomUUID } from "crypto";
 function resolveProviderSourceMode(providerSourceMode, legacyDisableUpstream) {
   if (providerSourceMode === "normal" || providerSourceMode === "no-upstream") {
@@ -1739,25 +2087,25 @@ function ensureMachineId(config) {
 }
 function getConfigDir() {
   const override = process.env.ADHDEV_CONFIG_DIR;
-  const dir = override && override.trim() ? override.trim() : join3(homedir(), ".adhdev");
-  if (!existsSync2(dir)) {
+  const dir = override && override.trim() ? override.trim() : join4(homedir(), ".adhdev");
+  if (!existsSync3(dir)) {
     mkdirSync(dir, { recursive: true });
   }
   return dir;
 }
 function getDaemonDataDir() {
-  const dir = join3(getConfigDir(), "daemon");
-  if (!existsSync2(dir)) {
+  const dir = join4(getConfigDir(), "daemon");
+  if (!existsSync3(dir)) {
     mkdirSync(dir, { recursive: true });
   }
   return dir;
 }
 function getConfigPath() {
-  return join3(getConfigDir(), "config.json");
+  return join4(getConfigDir(), "config.json");
 }
 function migrateStateToStateFile(raw) {
-  const statePath = join3(getConfigDir(), "state.json");
-  if (existsSync2(statePath)) return;
+  const statePath = join4(getConfigDir(), "state.json");
+  if (existsSync3(statePath)) return;
   const recentActivity = Array.isArray(raw.recentActivity) ? raw.recentActivity : [];
   const savedProviderSessions = Array.isArray(raw.savedProviderSessions) ? raw.savedProviderSessions : [];
   const legacySessionReads = isPlainObject(raw.recentSessionReads) ? raw.recentSessionReads : {};
@@ -1781,7 +2129,7 @@ function migrateStateToStateFile(raw) {
 }
 function loadConfig() {
   const configPath = getConfigPath();
-  if (!existsSync2(configPath)) {
+  if (!existsSync3(configPath)) {
     const initialized = ensureMachineId({ ...DEFAULT_CONFIG });
     try {
       saveConfig(initialized.config);
@@ -1790,7 +2138,7 @@ function loadConfig() {
     return initialized.config;
   }
   try {
-    const raw = readFileSync2(configPath, "utf-8");
+    const raw = readFileSync3(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     migrateStateToStateFile(parsed);
     const normalizedInput = normalizeConfig(parsed);
@@ -1812,7 +2160,7 @@ function saveConfig(config) {
   const configPath = getConfigPath();
   const dir = getConfigDir();
   const normalized = normalizeConfig(config);
-  if (!existsSync2(dir)) {
+  if (!existsSync3(dir)) {
     mkdirSync(dir, { recursive: true, mode: 448 });
   }
   writeFileSync(configPath, JSON.stringify(normalized, null, 2), { encoding: "utf-8", mode: 384 });
@@ -1888,7 +2236,7 @@ __export(git_worktree_exports, {
 });
 import * as path4 from "path";
 import { mkdir } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 function resolveWorktreePath(repoRoot, meshName, branch) {
@@ -1981,7 +2329,7 @@ async function createWorktree(opts) {
   const { repoRoot, branch, baseBranch, meshName } = opts;
   const remote = (opts.remote || "origin").trim() || "origin";
   const targetDir = opts.targetDir || resolveWorktreePath(repoRoot, meshName, branch);
-  if (existsSync3(targetDir)) {
+  if (existsSync4(targetDir)) {
     throw new Error(`Worktree target directory already exists: ${targetDir}`);
   }
   await mkdir(path4.dirname(targetDir), { recursive: true });
@@ -2006,7 +2354,7 @@ async function createWorktree(opts) {
   } catch (error) {
     const stderr = typeof error.stderr === "string" ? error.stderr : "";
     if (/already exists/i.test(stderr)) {
-      if (existsSync3(targetDir)) {
+      if (existsSync4(targetDir)) {
         throw new Error(`Worktree target directory was created concurrently: ${targetDir}`);
       }
       throw new Error(`Branch '${branch}' already exists or is checked out in another worktree`);
@@ -2021,7 +2369,7 @@ async function createWorktree(opts) {
   };
 }
 async function removeWorktree(repoRoot, worktreePath, opts = {}) {
-  if (!existsSync3(worktreePath)) {
+  if (!existsSync4(worktreePath)) {
     await pruneWorktrees(repoRoot);
     return { success: true, removedPath: worktreePath };
   }
@@ -3276,17 +3624,17 @@ __export(mesh_config_exports, {
   updateMesh: () => updateMesh,
   updateNode: () => updateNode
 });
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join7 } from "path";
 import { randomBytes, randomUUID as randomUUID3 } from "crypto";
 function getMeshConfigPath() {
-  return join6(getConfigDir(), "meshes.json");
+  return join7(getConfigDir(), "meshes.json");
 }
 function loadMeshConfig() {
   const path46 = getMeshConfigPath();
-  if (!existsSync5(path46)) return { meshes: [] };
+  if (!existsSync6(path46)) return { meshes: [] };
   try {
-    const raw = JSON.parse(readFileSync3(path46, "utf-8"));
+    const raw = JSON.parse(readFileSync4(path46, "utf-8"));
     if (!raw || !Array.isArray(raw.meshes)) return { meshes: [] };
     const config = raw;
     const migrated = migrateLoadedMeshConfig(config);
@@ -4890,8 +5238,8 @@ var init_contracts = __esm({
 });
 
 // src/mesh/mesh-events-pending.ts
-import { appendFileSync, existsSync as existsSync7, readFileSync as readFileSync4, renameSync as renameSync2, statSync as statSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join8 } from "path";
+import { appendFileSync, existsSync as existsSync8, readFileSync as readFileSync5, renameSync as renameSync2, statSync as statSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join9 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 function normalizeCoordinatorDaemonIds(coordinatorDaemonId) {
   return expandDaemonIdForms(coordinatorDaemonId);
@@ -5114,9 +5462,9 @@ function getPendingEventsPath(meshId, coordinatorDaemonId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
   if (coordinatorDaemonId) {
     const safeDaemon = coordinatorDaemonId.replace(/[^a-zA-Z0-9_-]/g, "_");
-    return join8(getLedgerDir(), `${safe}-${safeDaemon}.pending-events.jsonl`);
+    return join9(getLedgerDir(), `${safe}-${safeDaemon}.pending-events.jsonl`);
   }
-  return join8(getLedgerDir(), `${safe}.pending-events.jsonl`);
+  return join9(getLedgerDir(), `${safe}.pending-events.jsonl`);
 }
 function readPendingMeshCoordinatorEventsFromDisk(meshId, coordinatorDaemonId) {
   if (!meshId) return [];
@@ -5125,9 +5473,9 @@ function readPendingMeshCoordinatorEventsFromDisk(meshId, coordinatorDaemonId) {
   const paths = primaryDaemonId ? [getPendingEventsPath(meshId, primaryDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
   const events = [];
   for (const path46 of paths) {
-    if (!existsSync7(path46)) continue;
+    if (!existsSync8(path46)) continue;
     try {
-      const raw = readFileSync4(path46, "utf-8");
+      const raw = readFileSync5(path46, "utf-8");
       const parsed = raw.split("\n").filter(Boolean).flatMap((line) => {
         try {
           return [JSON.parse(line)];
@@ -5217,9 +5565,9 @@ function prunePendingMeshCoordinatorEventsRetention() {
 }
 function trimPendingEventsIfNeeded(path46) {
   try {
-    if (!existsSync7(path46)) return;
+    if (!existsSync8(path46)) return;
     if (statSync4(path46).size <= MAX_PENDING_EVENTS_BYTES) return;
-    const lines = readFileSync4(path46, "utf-8").split("\n").filter(Boolean);
+    const lines = readFileSync5(path46, "utf-8").split("\n").filter(Boolean);
     if (lines.length <= MAX_PENDING_EVENTS_KEEP) return;
     const dropped = lines.slice(0, lines.length - MAX_PENDING_EVENTS_KEEP);
     for (const line of dropped) {
@@ -5386,7 +5734,7 @@ function atomicDrainFile(path46) {
     return null;
   }
   try {
-    const content = readFileSync4(tmpPath, "utf-8");
+    const content = readFileSync5(tmpPath, "utf-8");
     try {
       unlinkSync2(tmpPath);
     } catch {
@@ -5409,7 +5757,7 @@ function selectiveDrainFile(path46, predicate) {
   }
   let content;
   try {
-    content = readFileSync4(tmpPath, "utf-8");
+    content = readFileSync5(tmpPath, "utf-8");
   } catch {
     try {
       unlinkSync2(tmpPath);
@@ -5440,7 +5788,7 @@ function selectiveDrainFile(path46, predicate) {
     unlinkSync2(tmpPath);
   } catch {
     try {
-      if (existsSync7(tmpPath) && !existsSync7(path46)) renameSync2(tmpPath, path46);
+      if (existsSync8(tmpPath) && !existsSync8(path46)) renameSync2(tmpPath, path46);
     } catch {
     }
     return [];
@@ -5668,7 +6016,7 @@ function clearPendingMeshCoordinatorEvents(meshId, coordinatorDaemonId) {
   }
   const paths = coordinatorDaemonId ? [getPendingEventsPath(meshId, coordinatorDaemonId), getPendingEventsPath(meshId)] : [getPendingEventsPath(meshId)];
   for (const path46 of paths) {
-    if (existsSync7(path46)) try {
+    if (existsSync8(path46)) try {
       unlinkSync2(path46);
     } catch {
     }
@@ -7018,8 +7366,8 @@ var init_mesh_work_queue = __esm({
 });
 
 // src/mesh/mesh-runtime-store.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, statSync as statSync5, unlinkSync as unlinkSync3 } from "fs";
-import { dirname as dirname2, join as join9 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync3, statSync as statSync5, unlinkSync as unlinkSync3 } from "fs";
+import { dirname as dirname2, join as join10 } from "path";
 function loadDatabaseCtor() {
   if (DatabaseCtor) return DatabaseCtor;
   DatabaseCtor = loadBetterSqlite3();
@@ -7029,13 +7377,13 @@ function safeMeshId(meshId) {
   return meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function legacyQueuePath(meshId) {
-  return join9(getLedgerDir(), `${safeMeshId(meshId)}.queue.json`);
+  return join10(getLedgerDir(), `${safeMeshId(meshId)}.queue.json`);
 }
 function cleanupStrayRootRuntimeDb(canonicalPath) {
   try {
-    const strayPath = join9(getConfigDir(), "mesh-runtime.db");
+    const strayPath = join10(getConfigDir(), "mesh-runtime.db");
     if (strayPath === canonicalPath) return;
-    if (!existsSync8(strayPath)) return;
+    if (!existsSync9(strayPath)) return;
     if (statSync5(strayPath).size !== 0) return;
     unlinkSync3(strayPath);
     if (!loggedStrayCleanup) {
@@ -7051,16 +7399,16 @@ function cleanupStrayRootRuntimeDb(canonicalPath) {
 }
 function meshRuntimeStorePath() {
   const dir = getLedgerDir();
-  const nextPath = join9(dir, "mesh-runtime.db");
+  const nextPath = join10(dir, "mesh-runtime.db");
   cleanupStrayRootRuntimeDb(nextPath);
-  if (existsSync8(nextPath)) return nextPath;
-  const legacyPath = join9(dir, "beads.db");
-  if (!existsSync8(legacyPath)) return nextPath;
+  if (existsSync9(nextPath)) return nextPath;
+  const legacyPath = join10(dir, "beads.db");
+  if (!existsSync9(legacyPath)) return nextPath;
   try {
     renameSync3(legacyPath, nextPath);
     for (const suffix of ["-wal", "-shm"]) {
       const legacyCompanion = `${legacyPath}${suffix}`;
-      if (existsSync8(legacyCompanion)) {
+      if (existsSync9(legacyCompanion)) {
         renameSync3(legacyCompanion, `${nextPath}${suffix}`);
       }
     }
@@ -7072,7 +7420,7 @@ function meshRuntimeStorePath() {
         `Legacy beads.db\u2192mesh-runtime.db migration failed; using existing DB in-place to avoid data loss: ${err?.message || err}`
       );
     }
-    return existsSync8(nextPath) ? nextPath : legacyPath;
+    return existsSync9(nextPath) ? nextPath : legacyPath;
   }
   return nextPath;
 }
@@ -7126,7 +7474,7 @@ var init_mesh_runtime_store = __esm({
       // 50 MB
       constructor(dbPath) {
         const dir = dirname2(dbPath);
-        if (!existsSync8(dir)) mkdirSync4(dir, { recursive: true });
+        if (!existsSync9(dir)) mkdirSync4(dir, { recursive: true });
         this.dbPath = dbPath;
         this.db = new (loadDatabaseCtor())(dbPath);
         this.db.pragma("journal_mode = WAL");
@@ -7505,7 +7853,7 @@ var init_mesh_runtime_store = __esm({
         this.walWriteCounter = 0;
         try {
           const walPath = `${this.dbPath}-wal`;
-          if (!existsSync8(walPath)) return;
+          if (!existsSync9(walPath)) return;
           const size = statSync5(walPath).size;
           if (size < _MeshRuntimeStore.WAL_MAX_BYTES) return;
           process.stderr.write(
@@ -7522,9 +7870,9 @@ var init_mesh_runtime_store = __esm({
         const count = this.db.prepare("SELECT COUNT(*) AS count FROM mesh_queue WHERE mesh_id = ?").get(meshId);
         if (count.count > 0) return;
         const path46 = legacyQueuePath(meshId);
-        if (!existsSync8(path46)) return;
+        if (!existsSync9(path46)) return;
         try {
-          const entries = JSON.parse(readFileSync5(path46, "utf-8"));
+          const entries = JSON.parse(readFileSync6(path46, "utf-8"));
           if (!Array.isArray(entries)) return;
           const insert = this.db.prepare(`
                 INSERT OR REPLACE INTO mesh_queue (
@@ -8955,8 +9303,8 @@ __export(mesh_ledger_exports, {
   readOperatingNotes: () => readOperatingNotes,
   tombstoneOperatingNote: () => tombstoneOperatingNote
 });
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, statSync as statSync6, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, statSync as statSync6, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
 import { EventEmitter } from "events";
 function isIntentionalCleanupStopEntry(entry) {
@@ -8979,35 +9327,35 @@ function isNoteExpired(note, now) {
   return now - created >= ttlDays * MS_PER_DAY;
 }
 function getLedgerDir() {
-  const dir = join10(getConfigDir(), LEDGER_DIR_NAME);
-  if (!existsSync9(dir)) {
+  const dir = join11(getConfigDir(), LEDGER_DIR_NAME);
+  if (!existsSync10(dir)) {
     mkdirSync5(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function getLedgerPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join10(getLedgerDir(), `${safe}.jsonl`);
+  return join11(getLedgerDir(), `${safe}.jsonl`);
 }
 function getRotatedPath(meshId, index) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join10(getLedgerDir(), `${safe}.${index}.jsonl`);
+  return join11(getLedgerDir(), `${safe}.${index}.jsonl`);
 }
 function getArchivePath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join10(getLedgerDir(), `${safe}.archive.jsonl`);
+  return join11(getLedgerDir(), `${safe}.archive.jsonl`);
 }
 function getRotatedArchivePath(meshId, index) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join10(getLedgerDir(), `${safe}.archive.${index}.jsonl`);
+  return join11(getLedgerDir(), `${safe}.archive.${index}.jsonl`);
 }
 function getArchivedCountsPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join10(getLedgerDir(), `${safe}.archived-counts.json`);
+  return join11(getLedgerDir(), `${safe}.archived-counts.json`);
 }
 function rotateArchiveFile(meshId, archivePath) {
   let index = 1;
-  while (existsSync9(getRotatedArchivePath(meshId, index))) {
+  while (existsSync10(getRotatedArchivePath(meshId, index))) {
     index++;
     if (index > 5) break;
   }
@@ -9021,9 +9369,9 @@ function rotateArchiveFile(meshId, archivePath) {
 }
 function readArchivedCounts(meshId) {
   const path46 = getArchivedCountsPath(meshId);
-  if (!existsSync9(path46)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
+  if (!existsSync10(path46)) return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
   try {
-    return JSON.parse(readFileSync6(path46, "utf-8"));
+    return JSON.parse(readFileSync7(path46, "utf-8"));
   } catch {
     return { taskCompleted: 0, taskFailed: 0, taskStalled: 0, recoveryAttempted: 0, totalArchived: 0, lastArchivedAt: "" };
   }
@@ -9062,7 +9410,7 @@ Valid status values: \`completed\` | \`failed\` | \`blocked\` | \`partial\`.`;
 }
 function compactLedger(meshId) {
   const filePath = getLedgerPath(meshId);
-  if (!existsSync9(filePath)) return { archivedCount: 0, retainedCount: 0 };
+  if (!existsSync10(filePath)) return { archivedCount: 0, retainedCount: 0 };
   const cutoff = Date.now() - ARCHIVE_TERMINAL_OLDER_THAN_MS;
   const entries = readLedgerEntries(meshId);
   const keep = [];
@@ -9077,7 +9425,7 @@ function compactLedger(meshId) {
   if (archive.length === 0) return { archivedCount: 0, retainedCount: keep.length };
   const archivePath = getArchivePath(meshId);
   try {
-    if (existsSync9(archivePath) && statSync6(archivePath).size > 50 * 1024 * 1024) {
+    if (existsSync10(archivePath) && statSync6(archivePath).size > 50 * 1024 * 1024) {
       rotateArchiveFile(meshId, archivePath);
     }
     const archiveLines = archive.map((e) => JSON.stringify(e)).join("\n") + "\n";
@@ -9268,7 +9616,7 @@ function appendLedgerEntry(meshId, partial) {
     ...partial
   };
   const filePath = getLedgerPath(meshId);
-  if (existsSync9(filePath)) {
+  if (existsSync10(filePath)) {
     try {
       const stat2 = statSync6(filePath);
       if (stat2.size >= MAX_FILE_SIZE_BYTES) {
@@ -9456,10 +9804,10 @@ function appendRemoteLedgerEntries(meshId, entries) {
 }
 function readLedgerFile(meshId) {
   const filePath = getLedgerPath(meshId);
-  if (!existsSync9(filePath)) return [];
+  if (!existsSync10(filePath)) return [];
   let content;
   try {
-    content = readFileSync6(filePath, "utf-8");
+    content = readFileSync7(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -9724,7 +10072,7 @@ function getSessionRecoveryContext(meshId, opts) {
 }
 function rotateLedgerFile(meshId, currentPath) {
   let index = 1;
-  while (existsSync9(getRotatedPath(meshId, index))) {
+  while (existsSync10(getRotatedPath(meshId, index))) {
     index++;
     if (index > 10) break;
   }
@@ -10729,10 +11077,10 @@ __export(mesh_coordinator_exports, {
   resolveMeshCoordinatorSetup: () => resolveMeshCoordinatorSetup,
   stripCoordinatorWrapperFile: () => stripCoordinatorWrapperFile
 });
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
 import * as os4 from "os";
 import { DEFAULT_SESSION_HOST_COLS, DEFAULT_SESSION_HOST_ROWS } from "@adhdev/session-host-core";
-import { basename as basename2, isAbsolute as isAbsolute4, join as join12, resolve as resolve7 } from "path";
+import { basename as basename2, isAbsolute as isAbsolute4, join as join13, resolve as resolve7 } from "path";
 function isHermesProvider(provider, cliType) {
   const type = cliType?.trim() || provider?.type?.trim() || "";
   return type === HERMES_CLI_TYPE;
@@ -10752,7 +11100,7 @@ function resolveHermesMeshCoordinatorSetup(options) {
       reason: "Could not resolve the ADHDev MCP server entrypoint and a Node runtime with WebSocket support for daemon IPC mode"
     };
   }
-  const configPath = join12(resolveHermesCoordinatorHome(options.meshId, options.workspace), "config.yaml");
+  const configPath = join13(resolveHermesCoordinatorHome(options.meshId, options.workspace), "config.yaml");
   if (!configPath.trim()) {
     return createHermesManualMeshCoordinatorSetup(options.meshId, options.workspace);
   }
@@ -10899,14 +11247,14 @@ function resolveHermesCoordinatorHome(meshId, workspace) {
   const key2 = `${meshId || "mesh"}
 ${resolve7(workspace || os4.tmpdir())}`;
   const hash = shortHash(key2);
-  return join12(os4.tmpdir(), `adhdev-hermes-mesh-coordinator-${hash}`);
+  return join13(os4.tmpdir(), `adhdev-hermes-mesh-coordinator-${hash}`);
 }
 function resolveMcpConfigPath(configPath, workspace) {
   const trimmed = configPath.trim();
   if (trimmed === "~") return os4.homedir();
-  if (trimmed.startsWith("~/")) return join12(os4.homedir(), trimmed.slice(2));
+  if (trimmed.startsWith("~/")) return join13(os4.homedir(), trimmed.slice(2));
   if (isAbsolute4(trimmed)) return trimmed;
-  return join12(workspace, trimmed);
+  return join13(workspace, trimmed);
 }
 function resolveAdhdevMcpServerLaunch(options) {
   const directEntryPath = resolveAdhdevMcpEntryPath(options.adhdevMcpEntryPath);
@@ -10977,7 +11325,7 @@ function applyInjectionRule(systemPrompt, injection, ctx) {
     }
     case "context_file": {
       if (!injection.path) return {};
-      const target = isAbsolute4(injection.path) ? injection.path : join12(ctx.workspace, injection.path);
+      const target = isAbsolute4(injection.path) ? injection.path : join13(ctx.workspace, injection.path);
       const wrapper = injection.wrapper && injection.wrapper.includes("{prompt}") ? injection.wrapper : "{prompt}";
       const managedNote = "> _Managed by adhdev mesh coordinator \u2014 do not hand-edit this block. Changes inside the sentinels are overwritten on next coordinator launch._";
       const promptWithNote = `${managedNote}
@@ -10986,8 +11334,8 @@ ${systemPrompt}`;
       const rendered = wrapper.replace(/\{prompt\}/g, promptWithNote);
       const sentinel = wrapper.split("{prompt}")[0].trim();
       try {
-        if (existsSync10(target)) {
-          const existing = readFileSync8(target, "utf-8");
+        if (existsSync11(target)) {
+          const existing = readFileSync9(target, "utf-8");
           if (sentinel && existing.includes(sentinel)) {
             const closing = wrapper.split("{prompt}")[1]?.trim();
             const safeOpen = sentinel.replace(/[.+^${}()|[\]\\]/g, "\\$&");
@@ -11017,8 +11365,8 @@ function stripCoordinatorWrapperFile(filePath) {
   const OPEN = "<!-- adhdev-mesh-coordinator-prompt -->";
   const CLOSE = "<!-- /adhdev-mesh-coordinator-prompt -->";
   try {
-    if (!existsSync10(filePath)) return;
-    const existing = readFileSync8(filePath, "utf-8");
+    if (!existsSync11(filePath)) return;
+    const existing = readFileSync9(filePath, "utf-8");
     const openIdx = existing.indexOf(OPEN);
     if (openIdx < 0) return;
     const closeIdx = existing.indexOf(CLOSE, openIdx);
@@ -11121,16 +11469,16 @@ var init_mesh_coordinator = __esm({
 });
 
 // src/mesh/coordinator-registry.ts
-import { join as join13 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
 function getRegistryPath() {
-  return join13(getDaemonDataDir(), "mesh-coordinators.json");
+  return join14(getDaemonDataDir(), "mesh-coordinators.json");
 }
 function loadMeshCoordinatorRegistry() {
   const path46 = getRegistryPath();
-  if (!existsSync11(path46)) return;
+  if (!existsSync12(path46)) return;
   try {
-    const raw = JSON.parse(readFileSync9(path46, "utf-8"));
+    const raw = JSON.parse(readFileSync10(path46, "utf-8"));
     if (!Array.isArray(raw)) return;
     _registry.clear();
     for (const entry of raw) {
@@ -11186,9 +11534,9 @@ var init_coordinator_registry = __esm({
 });
 
 // src/mesh/refine-config.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
-import { join as join14 } from "path";
-import * as yaml2 from "js-yaml";
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import { join as join15 } from "path";
+import * as yaml3 from "js-yaml";
 function isMeshConfigRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -11272,14 +11620,14 @@ function validateMeshRefineConfig(config, source = "inline") {
   const rejectedCommands = [];
   const deprecationWarnings = [];
   let bootstrapMode = "inherit";
-  if (!isRecord2(config)) return { valid: false, errors: ["config must be an object"], bootstrapCommands, commands, rejectedCommands, bootstrapMode, deprecationWarnings };
+  if (!isRecord3(config)) return { valid: false, errors: ["config must be an object"], bootstrapCommands, commands, rejectedCommands, bootstrapMode, deprecationWarnings };
   if (config.version !== 1) errors.push("version must be 1");
   if (config.allowAutoPublishSubmoduleMainCommits !== void 0 && typeof config.allowAutoPublishSubmoduleMainCommits !== "boolean") {
     errors.push("allowAutoPublishSubmoduleMainCommits must be a boolean when provided");
   }
   const validation = config.validation;
-  if (validation !== void 0 && !isRecord2(validation)) errors.push("validation must be an object");
-  const rawBootstrapMode = isRecord2(validation) ? validation.bootstrap : void 0;
+  if (validation !== void 0 && !isRecord3(validation)) errors.push("validation must be an object");
+  const rawBootstrapMode = isRecord3(validation) ? validation.bootstrap : void 0;
   if (rawBootstrapMode !== void 0) {
     if (rawBootstrapMode === "inherit" || rawBootstrapMode === "skip") {
       bootstrapMode = rawBootstrapMode;
@@ -11287,8 +11635,8 @@ function validateMeshRefineConfig(config, source = "inline") {
       errors.push("validation.bootstrap must be 'inherit' or 'skip' when provided");
     }
   }
-  const rawCommands = isRecord2(validation) ? validation.commands : void 0;
-  const rawBootstrapCommands = isRecord2(validation) ? validation.bootstrapCommands : void 0;
+  const rawCommands = isRecord3(validation) ? validation.commands : void 0;
+  const rawBootstrapCommands = isRecord3(validation) ? validation.bootstrapCommands : void 0;
   if (rawCommands !== void 0 && !Array.isArray(rawCommands)) errors.push("validation.commands must be an array");
   if (rawBootstrapCommands !== void 0 && !Array.isArray(rawBootstrapCommands)) errors.push("validation.bootstrapCommands must be an array");
   if (Array.isArray(rawBootstrapCommands) && rawBootstrapCommands.length > 0) {
@@ -11311,9 +11659,9 @@ function validateMeshRefineConfig(config, source = "inline") {
   if (rejectedCommands.length) errors.push("one or more validation commands are invalid");
   return { valid: errors.length === 0, errors, bootstrapCommands, commands, rejectedCommands, bootstrapMode, deprecationWarnings };
 }
-function parseConfigText2(path46, text) {
+function parseConfigText3(path46, text) {
   if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml2.load(text);
+  return yaml3.load(text);
 }
 function loadMeshRefineConfig(mesh, workspace) {
   const policy = mesh?.policy && typeof mesh.policy === "object" && !Array.isArray(mesh.policy) ? mesh.policy : {};
@@ -11324,10 +11672,10 @@ function loadMeshRefineConfig(mesh, workspace) {
     return { config: inline, source: "mesh.policy.refineConfig", sourceType: "mesh_policy" };
   }
   for (const relative5 of MESH_REFINE_CONFIG_LOCATIONS) {
-    const configPath = join14(workspace, relative5);
-    if (!existsSync12(configPath)) continue;
+    const configPath = join15(workspace, relative5);
+    if (!existsSync13(configPath)) continue;
     try {
-      const parsed = parseConfigText2(configPath, readFileSync10(configPath, "utf-8"));
+      const parsed = parseConfigText3(configPath, readFileSync11(configPath, "utf-8"));
       const validation = validateMeshRefineConfig(parsed, relative5);
       if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
       return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
@@ -11343,20 +11691,20 @@ function loadMeshRefineConfig(mesh, workspace) {
 }
 function readPackageScripts(workspace) {
   try {
-    const parsed = JSON.parse(readFileSync10(join14(workspace, "package.json"), "utf-8"));
-    return isRecord2(parsed?.scripts) ? parsed.scripts : {};
+    const parsed = JSON.parse(readFileSync11(join15(workspace, "package.json"), "utf-8"));
+    return isRecord3(parsed?.scripts) ? parsed.scripts : {};
   } catch {
     return {};
   }
 }
 function collectProjectContextSuggestions(mesh) {
   const commands = mesh?.projectContext?.commands;
-  if (!isRecord2(commands)) return [];
+  if (!isRecord3(commands)) return [];
   const suggestions = [];
   for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
     const entries = Array.isArray(commands[category]) ? commands[category] : [];
     for (const entry of entries) {
-      if (isRecord2(entry) && typeof entry.command === "string") suggestions.push({ command: entry.command, category });
+      if (isRecord3(entry) && typeof entry.command === "string") suggestions.push({ command: entry.command, category });
     }
   }
   return suggestions;
@@ -11418,7 +11766,7 @@ function resolveMeshRefineValidationPlan(mesh, workspace) {
     unavailableReason: validation.commands.length ? void 0 : "validation_unavailable: repo mesh/refine config has no validation.commands"
   };
 }
-var MESH_REFINE_VALIDATION_CATEGORIES, MESH_REFINE_VALIDATION_SCOPES, MESH_REFINE_CONFIG_LOCATIONS, MESH_REFINE_CONFIG_SCHEMA, SHELL_METACHAR_RE, SAFE_TOKEN_RE, SAFE_WIN32_EXEC_TOKEN_RE, isRecord2;
+var MESH_REFINE_VALIDATION_CATEGORIES, MESH_REFINE_VALIDATION_SCOPES, MESH_REFINE_CONFIG_LOCATIONS, MESH_REFINE_CONFIG_SCHEMA, SHELL_METACHAR_RE, SAFE_TOKEN_RE, SAFE_WIN32_EXEC_TOKEN_RE, isRecord3;
 var init_refine_config = __esm({
   "src/mesh/refine-config.ts"() {
     "use strict";
@@ -11512,13 +11860,13 @@ var init_refine_config = __esm({
     SHELL_METACHAR_RE = /[;&|<>`$\n\r'"]/;
     SAFE_TOKEN_RE = /^[A-Za-z0-9_@./:=+-]+$/;
     SAFE_WIN32_EXEC_TOKEN_RE = /^[A-Za-z0-9_@./:=+\\-]+$/;
-    isRecord2 = isMeshConfigRecord;
+    isRecord3 = isMeshConfigRecord;
   }
 });
 
 // src/cli-adapters/resolve-executable.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import * as path10 from "path";
 function resolveWin32GlobalBin(trimmed) {
   if (path10.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\")) {
@@ -11534,7 +11882,7 @@ function resolveWin32GlobalBin(trimmed) {
     if (!dir) continue;
     for (const ext of WIN_EXEC_EXT) {
       const full = path10.join(dir, trimmed + ext);
-      if (existsSync13(full)) return full;
+      if (existsSync14(full)) return full;
     }
   }
   return null;
@@ -11551,7 +11899,7 @@ function resolveWin32Executable(command) {
   if (process.platform !== "win32") return command;
   const trimmed = (command || "").trim();
   if (!trimmed) return command;
-  if (path10.isAbsolute(trimmed) && existsSync13(trimmed)) return trimmed;
+  if (path10.isAbsolute(trimmed) && existsSync14(trimmed)) return trimmed;
   try {
     const out = execFileSync("where", [trimmed], {
       encoding: "utf8",
@@ -11627,12 +11975,12 @@ __export(worktree_bootstrap_config_exports, {
   shouldDeferDispatchForBootstrap: () => shouldDeferDispatchForBootstrap,
   validateMeshWorktreeBootstrapConfig: () => validateMeshWorktreeBootstrapConfig
 });
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
-import { join as join16, resolve as pathResolve } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
+import { join as join17, resolve as pathResolve } from "path";
 import { execFile as execFile3, execFileSync as execFileSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { promisify as promisify3 } from "util";
-import * as yaml3 from "js-yaml";
+import * as yaml4 from "js-yaml";
 function getRegisteredSubmodulePaths(workspace) {
   const paths = /* @__PURE__ */ new Set();
   try {
@@ -11747,7 +12095,7 @@ function isWorktreeBootstrapStaleRunning(node, nowMs = Date.now()) {
   if (!Number.isFinite(startedMs)) return false;
   if (nowMs - startedMs <= WORKTREE_BOOTSTRAP_STALE_RUNNING_MS) return false;
   const workspace = typeof node?.workspace === "string" ? node.workspace.trim() : "";
-  if (!workspace || !existsSync14(workspace)) return false;
+  if (!workspace || !existsSync15(workspace)) return false;
   try {
     const out = execFileSync2(resolveWin32Executable("git"), ["status", "--porcelain"], {
       cwd: workspace,
@@ -11768,9 +12116,9 @@ function shouldDeferDispatchForBootstrap(node, nowMs = Date.now()) {
   if (node?.worktreeBootstrap?.status !== "running") return false;
   return !isWorktreeBootstrapStaleRunning(node, nowMs);
 }
-function parseConfigText3(path46, text) {
+function parseConfigText4(path46, text) {
   if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml3.load(text);
+  return yaml4.load(text);
 }
 function truncateOutput(value) {
   const text = typeof value === "string" ? value : value == null ? "" : String(value);
@@ -11810,10 +12158,10 @@ function loadMeshWorktreeBootstrapConfig(mesh, workspace) {
     return { config: inline, source: "mesh.policy.worktreeBootstrapConfig", sourceType: "mesh_policy" };
   }
   for (const relative5 of MESH_WORKTREE_BOOTSTRAP_CONFIG_LOCATIONS) {
-    const configPath = join16(workspace, relative5);
-    if (!existsSync14(configPath)) continue;
+    const configPath = join17(workspace, relative5);
+    if (!existsSync15(configPath)) continue;
     try {
-      const parsed = parseConfigText3(configPath, readFileSync11(configPath, "utf-8"));
+      const parsed = parseConfigText4(configPath, readFileSync12(configPath, "utf-8"));
       const validation = validateMeshWorktreeBootstrapConfig(parsed, relative5);
       if (!validation.valid) return { source: relative5, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
       return { config: parsed, source: relative5, sourceType: "repo_file", path: configPath };
@@ -11826,9 +12174,9 @@ function loadMeshWorktreeBootstrapConfig(mesh, workspace) {
 function computeStaleInputsDigest(workspace, staleInputs) {
   const digest = {};
   for (const relative5 of staleInputs ?? []) {
-    const filePath = join16(workspace, relative5);
+    const filePath = join17(workspace, relative5);
     try {
-      digest[relative5] = createHash2("sha256").update(readFileSync11(filePath)).digest("hex");
+      digest[relative5] = createHash2("sha256").update(readFileSync12(filePath)).digest("hex");
     } catch {
       digest[relative5] = "absent";
     }
@@ -11899,10 +12247,10 @@ async function runMeshWorktreeBootstrap(mesh, workspace) {
     staleInputs: loaded.config.staleInputs
   };
   const staleInputPaths = loaded.config.staleInputs ?? [];
-  const initiallyAbsent = staleInputPaths.filter((p) => !existsSync14(join16(workspace, p)));
+  const initiallyAbsent = staleInputPaths.filter((p) => !existsSync15(join17(workspace, p)));
   for (const command of validation.commands) {
     if (initiallyAbsent.length > 0) {
-      const appearedNow = initiallyAbsent.filter((p) => existsSync14(join16(workspace, p)));
+      const appearedNow = initiallyAbsent.filter((p) => existsSync15(join17(workspace, p)));
       if (appearedNow.length > 0) {
         state.status = "stale";
         state.completedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -12025,224 +12373,6 @@ var init_worktree_bootstrap_config = __esm({
   }
 });
 
-// src/config/mesh-json-config.ts
-var mesh_json_config_exports = {};
-__export(mesh_json_config_exports, {
-  MESH_JSON_CONFIG_LOCATIONS: () => MESH_JSON_CONFIG_LOCATIONS,
-  MESH_JSON_CONFIG_SCHEMA: () => MESH_JSON_CONFIG_SCHEMA,
-  applyRepoMeshConfig: () => applyRepoMeshConfig,
-  buildMeshJsonConfigScaffold: () => buildMeshJsonConfigScaffold,
-  loadRepoMeshJsonConfig: () => loadRepoMeshJsonConfig,
-  mergeEffectiveCoordinatorConfig: () => mergeEffectiveCoordinatorConfig,
-  mergeEffectiveOperatingNotes: () => mergeEffectiveOperatingNotes,
-  normalizeRepoMeshDeclarativeConfig: () => normalizeRepoMeshDeclarativeConfig,
-  serializeMeshJsonConfigScaffold: () => serializeMeshJsonConfigScaffold
-});
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import { join as join17 } from "path";
-import * as yaml4 from "js-yaml";
-function isRecord3(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function parseConfigText4(path46, text) {
-  if (/\.json$/i.test(path46)) return JSON.parse(text);
-  return yaml4.load(text);
-}
-function normalizeOperatingNote(value) {
-  if (!isRecord3(value)) return null;
-  const text = typeof value.text === "string" ? value.text.trim() : "";
-  if (!text) return null;
-  const category = value.category === "provider_quirk" || value.category === "pattern_to_avoid" || value.category === "recovery_lesson" ? value.category : void 0;
-  return {
-    text,
-    ...category ? { category } : {},
-    ...typeof value.createdAt === "string" ? { createdAt: value.createdAt } : {},
-    ...typeof value.sourceCoordinator === "string" ? { sourceCoordinator: value.sourceCoordinator } : {},
-    // Operating-notes lifecycle: a repo-declared note may pin itself or set an
-    // explicit expiry, same as a runtime-recorded one. Phase 2 (b)/(c): it may
-    // also declare supersedes/subjectKey to retire an earlier note or group
-    // same-subject notes for folding.
-    ...value.pinned === true ? { pinned: true } : {},
-    ...typeof value.expiresAt === "string" ? { expiresAt: value.expiresAt } : {},
-    ...typeof value.supersedes === "string" ? { supersedes: value.supersedes } : {},
-    ...typeof value.subjectKey === "string" ? { subjectKey: value.subjectKey } : {}
-  };
-}
-function normalizeRepoMeshDeclarativeConfig(parsed) {
-  const errors = [];
-  if (!isRecord3(parsed)) return { valid: false, errors: ["config must be an object"] };
-  if (parsed.version !== 1) {
-    return { valid: false, errors: [`version must be 1 (got ${JSON.stringify(parsed.version)})`] };
-  }
-  const config = { version: 1 };
-  if (parsed.coordinator !== void 0) {
-    if (isRecord3(parsed.coordinator)) {
-      const coord = {};
-      const c = parsed.coordinator;
-      if (typeof c.systemPromptOverride === "string") coord.systemPromptOverride = c.systemPromptOverride;
-      if (typeof c.systemPromptAppend === "string") coord.systemPromptAppend = c.systemPromptAppend;
-      if (Number.isFinite(Number(c.maxPromptChars))) coord.maxPromptChars = Number(c.maxPromptChars);
-      config.coordinator = coord;
-    } else {
-      errors.push("coordinator must be an object when provided");
-    }
-  }
-  if (parsed.operatingNotes !== void 0) {
-    if (Array.isArray(parsed.operatingNotes)) {
-      const notes = parsed.operatingNotes.map(normalizeOperatingNote).filter((n) => n !== null);
-      if (notes.length) config.operatingNotes = notes;
-    } else {
-      errors.push("operatingNotes must be an array when provided");
-    }
-  }
-  if (parsed.limits !== void 0) {
-    if (isRecord3(parsed.limits)) {
-      const limits = {};
-      if (Number.isFinite(Number(parsed.limits.maxNoteChars))) limits.maxNoteChars = Number(parsed.limits.maxNoteChars);
-      if (Number.isFinite(Number(parsed.limits.maxNotes))) limits.maxNotes = Number(parsed.limits.maxNotes);
-      if (Object.keys(limits).length) config.limits = limits;
-    } else {
-      errors.push("limits must be an object when provided");
-    }
-  }
-  return { valid: true, config, errors };
-}
-function loadRepoMeshJsonConfig(workspace) {
-  const bases = [];
-  const ws = typeof workspace === "string" ? workspace.trim() : "";
-  if (ws) bases.push(ws);
-  let cwd = "";
-  try {
-    cwd = process.cwd();
-  } catch {
-  }
-  if (cwd && cwd !== ws) bases.push(cwd);
-  for (const base of bases) {
-    for (const relative5 of MESH_JSON_CONFIG_LOCATIONS) {
-      const configPath = join17(base, relative5);
-      if (!existsSync15(configPath)) continue;
-      try {
-        const parsed = parseConfigText4(configPath, readFileSync12(configPath, "utf-8"));
-        const result = normalizeRepoMeshDeclarativeConfig(parsed);
-        if (!result.valid || !result.config) {
-          return { source: relative5, sourceType: "invalid", path: configPath, error: result.errors.join("; ") };
-        }
-        return { config: result.config, source: relative5, sourceType: "repo_file", path: configPath };
-      } catch (error) {
-        return { source: relative5, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
-      }
-    }
-  }
-  return {
-    source: "unavailable",
-    sourceType: "unavailable",
-    error: `No repo mesh config found. Checked: ${MESH_JSON_CONFIG_LOCATIONS.join(", ")}`
-  };
-}
-function mergeEffectiveCoordinatorConfig(repoCoord, localCoord) {
-  const out = { ...localCoord || {} };
-  const localOverride = localCoord?.systemPromptOverride?.trim();
-  const repoOverride = repoCoord?.systemPromptOverride?.trim();
-  if (localOverride) {
-    out.systemPromptOverride = localCoord.systemPromptOverride;
-  } else if (repoOverride) {
-    out.systemPromptOverride = repoCoord.systemPromptOverride;
-  } else {
-    delete out.systemPromptOverride;
-  }
-  const repoAppend = repoCoord?.systemPromptAppend?.trim() ? repoCoord.systemPromptAppend.trim() : "";
-  const localAppendRaw = localCoord?.systemPromptAppend ?? localCoord?.systemPromptSuffix;
-  const localAppend = localAppendRaw?.trim() ? localAppendRaw.trim() : "";
-  const stacked = [repoAppend, localAppend].filter(Boolean).join("\n\n");
-  if (stacked) {
-    out.systemPromptAppend = stacked;
-    delete out.systemPromptSuffix;
-  }
-  return out;
-}
-function mergeEffectiveOperatingNotes(repoNotes, ledgerNotes) {
-  const usable = (notes) => Array.isArray(notes) ? notes.filter((n) => n && typeof n.text === "string" && n.text.trim()) : [];
-  const repo = usable(repoNotes);
-  const ledger = usable(ledgerNotes);
-  const ledgerTexts = new Set(ledger.map((n) => n.text.trim()));
-  const repoKept = repo.filter((n) => !ledgerTexts.has(n.text.trim()));
-  const merged = [...repoKept, ...ledger];
-  return merged.length ? merged : void 0;
-}
-function applyRepoMeshConfig(mesh, repoConfig) {
-  if (!repoConfig) return mesh;
-  return {
-    ...mesh,
-    coordinator: mergeEffectiveCoordinatorConfig(repoConfig.coordinator, mesh.coordinator)
-  };
-}
-function buildMeshJsonConfigScaffold(mesh) {
-  const scaffold = { version: 1 };
-  const coord = {};
-  const override = mesh.coordinator?.systemPromptOverride;
-  if (typeof override === "string" && override.trim()) coord.systemPromptOverride = override;
-  const append = mesh.coordinator?.systemPromptAppend ?? mesh.coordinator?.systemPromptSuffix;
-  if (typeof append === "string" && append.trim()) coord.systemPromptAppend = append;
-  if (Object.keys(coord).length) scaffold.coordinator = coord;
-  return scaffold;
-}
-function serializeMeshJsonConfigScaffold(config) {
-  return JSON.stringify(config, null, 2);
-}
-var MESH_JSON_CONFIG_LOCATIONS, MESH_JSON_CONFIG_SCHEMA;
-var init_mesh_json_config = __esm({
-  "src/config/mesh-json-config.ts"() {
-    "use strict";
-    MESH_JSON_CONFIG_LOCATIONS = [
-      ".adhdev/mesh.json",
-      ".adhdev/mesh.yaml",
-      ".adhdev/mesh.yml"
-    ];
-    MESH_JSON_CONFIG_SCHEMA = {
-      $schema: "https://json-schema.org/draft/2020-12/schema",
-      title: "ADHDev Repo Mesh Declarative Config",
-      type: "object",
-      additionalProperties: false,
-      required: ["version"],
-      properties: {
-        version: { const: 1 },
-        coordinator: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            systemPromptOverride: { type: "string" },
-            systemPromptAppend: { type: "string" },
-            maxPromptChars: { type: "number", minimum: 1 }
-          }
-        },
-        operatingNotes: {
-          type: "array",
-          maxItems: 200,
-          items: {
-            type: "object",
-            additionalProperties: false,
-            required: ["text"],
-            properties: {
-              text: { type: "string", minLength: 1 },
-              category: { enum: ["provider_quirk", "pattern_to_avoid", "recovery_lesson"] },
-              createdAt: { type: "string" },
-              sourceCoordinator: { type: "string" }
-            }
-          }
-        },
-        limits: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            maxNoteChars: { type: "number", minimum: 1 },
-            maxNotes: { type: "number", minimum: 1 }
-          }
-        }
-      }
-    };
-  }
-});
-
 // src/mesh/mesh-fast-forward.ts
 async function fastForwardMeshNode(args) {
   const workspace = typeof args.workspace === "string" ? args.workspace.trim() : "";
@@ -16576,6 +16706,16 @@ function __resetIdleAutoFastForwardForTests() {
   continuousAutoFastForwardLastScan.clear();
   autoFastForwardWorkspaceLease.clear();
 }
+function loadRepoConfigForNode(node) {
+  const workspace = typeof node?.workspace === "string" && node.workspace.trim() ? node.workspace.trim() : "";
+  if (!workspace) return null;
+  try {
+    const result = loadRepoMeshJsonConfig(workspace);
+    return result.sourceType === "repo_file" && result.config ? result.config : null;
+  } catch {
+    return null;
+  }
+}
 function getMeshWithCache(components, meshId) {
   const localMesh = getMesh(meshId);
   const cachedMesh = components.router?.getCachedInlineMesh(meshId);
@@ -16835,7 +16975,13 @@ function tryAssignQueueTask(components, meshId, nodeId, sessionId, providerType)
         meshNodeFor: meshId,
         meshNodeId: nodeId,
         launchedByCoordinator: true,
-        autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+        ...delegatedWorkerAutoApproveSettings(
+          mesh?.policy,
+          node?.policy,
+          components.providerLoader?.getMeta(providerType),
+          loadRepoConfigForNode(node),
+          providerType
+        ),
         ...localDaemonId ? { meshCoordinatorDaemonId: localDaemonId } : {},
         // COMPLETION-PROPAGATION F5: (re)stamp the coordinator SESSION anchor from THIS
         // task's sourceCoordinatorSessionId with PRIORITY — a manually-launched (or reused)
@@ -17273,10 +17419,10 @@ function liveSessionCountForNode(components, meshId, nodeId) {
   }
   return count;
 }
-function nodeHasLiveSessionPendingClaim(components, meshId, nodeId) {
+function nodeHasLiveSessionPendingClaim(components, meshId, nodeId, task, node) {
   if (inWindowAutoLaunchSessionIdsForNode(meshId, nodeId).length > 0) return true;
   const busySessionIds = new Set(
-    getQueue(meshId, { status: ["assigned"] }).filter((task) => daemonIdsEquivalent(task.assignedNodeId, nodeId)).map((task) => readNonEmptyString(task.assignedSessionId)).filter(Boolean)
+    getQueue(meshId, { status: ["assigned"] }).filter((task2) => daemonIdsEquivalent(task2.assignedNodeId, nodeId)).map((task2) => readNonEmptyString(task2.assignedSessionId)).filter(Boolean)
   );
   return components.instanceManager.getByCategory("cli").some((inst) => {
     const state = inst.getState();
@@ -17289,6 +17435,12 @@ function nodeHasLiveSessionPendingClaim(components, meshId, nodeId) {
     if (isTerminalSessionStatus(status)) return false;
     const sessionId = readNonEmptyString(state.instanceId);
     if (sessionId && busySessionIds.has(sessionId)) return false;
+    if (task.requiredTags?.length) {
+      const sessionProviderType = state.type || readNonEmptyString(settings.providerType);
+      if (sessionProviderType && !nodeSatisfiesRequiredTags(task.requiredTags, buildMeshNodeCapabilityTags(node, sessionProviderType))) {
+        return false;
+      }
+    }
     return true;
   });
 }
@@ -17569,7 +17721,7 @@ async function maybeAutoLaunchOneQueueSession(components, meshId, mesh) {
         sweepExpiredCooldowns();
         continue;
       }
-      if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId)) {
+      if (nodeHasLiveSessionPendingClaim(components, meshId, nodeId, task, node)) {
         markAutoLaunch(meshId, task.id, { status: "skipped", reason: "node_has_live_session_pending_claim", nodeId });
         continue;
       }
@@ -17608,8 +17760,14 @@ async function maybeAutoLaunchOneQueueSession(components, meshId, mesh) {
           spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || "hidden",
           // Coordinator-dispatched worker: auto-approve unless mesh/node policy
           // opts out (default true). Lands in settingsOverride and beats the
-          // global per-provider-type autoApprove config (see shouldAutoApprove).
-          autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+          // global per-provider-type boolean/mode through explicit opposite-key clearing.
+          ...delegatedWorkerAutoApproveSettings(
+            mesh?.policy,
+            node?.policy,
+            components.providerLoader?.getMeta(resolved.providerType),
+            loadRepoConfigForNode(node),
+            resolved.providerType
+          ),
           launchedByCoordinator: true,
           autoLaunchedForQueueTaskId: task.id
         };
@@ -18073,6 +18231,7 @@ var init_mesh_queue_assignment = __esm({
     init_mesh_event_trace();
     init_mesh_warmup_deadline();
     init_repo_mesh_types();
+    init_mesh_json_config();
     init_dist();
     init_mesh_node_slots();
     init_mesh_events_stale();
@@ -20449,6 +20608,7 @@ function buildAvailableProviders(providerLoader) {
       ...provider.lastDetection !== void 0 ? { lastDetection: provider.lastDetection } : {},
       ...provider.lastVerification !== void 0 ? { lastVerification: provider.lastVerification } : {},
       ...provider.meshCoordinator !== void 0 ? { meshCoordinator: provider.meshCoordinator } : {},
+      ...provider.autoApproveModes !== void 0 ? { autoApproveModes: provider.autoApproveModes } : {},
       ...trust ? {
         trust,
         trustDescription: describeTrust2(trust),
@@ -21627,7 +21787,24 @@ function injectMeshSystemMessage(components, args) {
                   spawnedSessionVisibility: mesh?.policy?.spawnedSessionVisibility || "hidden",
                   // Coordinator-dispatched recovery relaunch: same auto-approve
                   // policy as the primary worker launch path.
-                  autoApprove: resolveDelegatedWorkerAutoApprove(mesh?.policy, node?.policy),
+                  ...delegatedWorkerAutoApproveSettings(
+                    mesh?.policy,
+                    node?.policy,
+                    components.providerLoader?.getMeta(recoveryContext.failedProviderType),
+                    // Recovery relaunch: same repo-declared requested mode as the
+                    // primary path. node.workspace missing → null → provider default.
+                    (() => {
+                      const ws = typeof node?.workspace === "string" && node.workspace.trim() ? node.workspace.trim() : "";
+                      if (!ws) return null;
+                      try {
+                        const r = loadRepoMeshJsonConfig(ws);
+                        return r.sourceType === "repo_file" && r.config ? r.config : null;
+                      } catch {
+                        return null;
+                      }
+                    })(),
+                    recoveryContext.failedProviderType
+                  ),
                   launchedByCoordinator: true
                 }
               }).catch((e) => LOG.error("MeshRecovery", `Failed to auto-relaunch session for ${node.id}: ${e?.message}`));
@@ -22017,6 +22194,7 @@ var init_mesh_event_forwarding = __esm({
     init_mesh_event_trace();
     init_snapshot();
     init_repo_mesh_types();
+    init_mesh_json_config();
     init_dist();
     init_mesh_events_stale();
     init_mesh_task_inflight();
@@ -24287,6 +24465,20 @@ var init_provider_schema = __esm({
             }
           }
         },
+        autoApproveModes: {
+          type: "object",
+          description: "Provider-specific auto-approve choices and their launch/runtime strategy.",
+          required: ["default", "modes"],
+          additionalProperties: false,
+          properties: {
+            default: { type: "string", minLength: 1 },
+            modes: {
+              type: "array",
+              minItems: 1,
+              items: { $ref: "#/$defs/autoApproveMode" }
+            }
+          }
+        },
         sendDelayMs: {
           type: "number",
           minimum: 0,
@@ -24660,6 +24852,36 @@ var init_provider_schema = __esm({
         }
       },
       $defs: {
+        autoApproveMode: {
+          type: "object",
+          required: ["id", "label", "strategy", "risk"],
+          additionalProperties: false,
+          properties: {
+            id: { type: "string", minLength: 1 },
+            label: { type: "string", minLength: 1 },
+            strategy: { enum: ["pty-parse-default", "launch-args", "post-boot-command"] },
+            risk: { enum: ["safe", "caution", "dangerous"] },
+            warning: { type: "string", minLength: 1 },
+            launchArgs: {
+              type: "array",
+              items: { type: "string", minLength: 1 }
+            },
+            removeArgs: {
+              type: "array",
+              items: { type: "string", minLength: 1 }
+            }
+          },
+          allOf: [
+            {
+              if: { properties: { strategy: { const: "launch-args" } }, required: ["strategy"] },
+              then: { required: ["launchArgs"], properties: { launchArgs: { minItems: 1 } } }
+            },
+            {
+              if: { properties: { risk: { const: "dangerous" } }, required: ["risk"] },
+              then: { required: ["warning"] }
+            }
+          ]
+        },
         patternList: {
           type: "array",
           items: {
@@ -30768,6 +30990,7 @@ function detectClaudeAskUserQuestionPromptFromJson(value, providerType = "claude
 
 // src/index.ts
 init_repo_mesh_types();
+init_mesh_json_config();
 
 // src/git/index.ts
 init_git_executor();
@@ -49005,6 +49228,7 @@ function formatMarkerTimestamp(timestamp) {
 }
 
 // src/providers/cli-provider-instance.ts
+init_auto_approve_modes();
 function approvalModalSignature(message, affirmativeAnchor) {
   return [typeof message === "string" ? message.trim() : "", affirmativeAnchor].join("::");
 }
@@ -50985,7 +51209,7 @@ var CliProviderInstance = class _CliProviderInstance {
    * resolveModal, so a plain turn that never saw an approval always returns false.
    */
   inApprovalResumeGrace(now = Date.now()) {
-    if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return false;
+    if (!this.isAutonomousMeshSession() || !this.shouldUsePtyAutoApprove()) return false;
     const resolvedAt = typeof this.adapter?.lastApprovalResolvedAt === "number" ? this.adapter.lastApprovalResolvedAt : 0;
     if (resolvedAt <= 0) return false;
     return now - resolvedAt < _CliProviderInstance.APPROVAL_RESUME_GRACE_MS;
@@ -51090,7 +51314,7 @@ var CliProviderInstance = class _CliProviderInstance {
       return;
     }
     const latestStatus = this.adapter.getStatus({ allowParse: false });
-    const latestAutoApproveActive = latestStatus.status === "waiting_approval" && this.shouldAutoApprove();
+    const latestAutoApproveActive = latestStatus.status === "waiting_approval" && this.shouldUsePtyAutoApprove();
     const latestVisibleStatus = latestAutoApproveActive || this.autoApproveBusy ? "generating" : latestStatus.status;
     LOG.debug("CLI", `[${this.type}] flush attempt: adapterStatus=${latestStatus.status} latestVisible=${latestVisibleStatus} generatingStartedAt=${this.generatingStartedAt} isWaitingForResponse=${!!this.adapter?.isWaitingForResponse} hasPartial=${!!this.adapter.getPartialResponse?.()}`);
     if (latestVisibleStatus !== "idle") {
@@ -51360,7 +51584,7 @@ var CliProviderInstance = class _CliProviderInstance {
    * session, where a human answers the prompt, is returned untouched).
    */
   stabilizeFlappingApprovalStatus(adapterStatus, now = Date.now()) {
-    if (!this.isAutonomousMeshSession() || !this.shouldAutoApprove()) return adapterStatus;
+    if (!this.isAutonomousMeshSession() || !this.shouldUsePtyAutoApprove()) return adapterStatus;
     const rawStatus = adapterStatus?.status;
     const resolvedAt = typeof this.adapter?.lastApprovalResolvedAt === "number" ? this.adapter.lastApprovalResolvedAt : 0;
     if (rawStatus === "waiting_approval") {
@@ -51390,7 +51614,11 @@ var CliProviderInstance = class _CliProviderInstance {
     return adapterStatus;
   }
   maybeAutoApproveStatus(adapterStatus, now = Date.now()) {
-    if (adapterStatus?.status === "waiting_approval" && this.shouldAutoApprove() && this.manualAttendance.isAttended(now)) {
+    if (!this.shouldUsePtyAutoApprove()) {
+      this.resetPtyAutoApproveState();
+      return false;
+    }
+    if (adapterStatus?.status === "waiting_approval" && this.shouldUsePtyAutoApprove() && this.manualAttendance.isAttended(now)) {
       this.lastAutoApprovalSignature = "";
       this.pendingAutoApprovalSignature = "";
       this.pendingAutoApprovalSince = 0;
@@ -51405,7 +51633,7 @@ var CliProviderInstance = class _CliProviderInstance {
       }, this.manualAttendance.remainingMs(now) + 20);
       return false;
     }
-    const autoApproveActive = adapterStatus?.status === "waiting_approval" && this.shouldAutoApprove();
+    const autoApproveActive = adapterStatus?.status === "waiting_approval" && this.shouldUsePtyAutoApprove();
     if (!autoApproveActive) {
       this.lastAutoApprovalSignature = "";
       if (this.pendingAutoApprovalSince) {
@@ -52100,15 +52328,34 @@ ${buttons.join("\n")}`;
   get cliName() {
     return this.provider.name;
   }
+  resolveAutoApproveMode() {
+    return resolveProviderAutoApproveMode(this.provider, this.settings);
+  }
+  /** Legacy boolean view retained for internal/test compatibility. */
   shouldAutoApprove() {
-    if (typeof this.settings.autoApprove === "boolean") {
-      return this.settings.autoApprove;
+    return this.resolveAutoApproveMode().active;
+  }
+  shouldUsePtyAutoApprove() {
+    const resolved = this.resolveAutoApproveMode();
+    return this.shouldAutoApprove() && resolved.strategy === "pty-parse-default";
+  }
+  resetPtyAutoApproveState() {
+    this.lastAutoApprovalSignature = "";
+    this.pendingAutoApprovalSignature = "";
+    this.pendingAutoApprovalSince = 0;
+    this.autoApproveInactiveSince = 0;
+    this.autoApproveMaskSince = 0;
+    this.stalledApprovalNudgeEpisode = 0;
+    this.autoApproveLastModalSeenAt = 0;
+    this.autoApproveBusy = false;
+    if (this.autoApproveSettleTimer) {
+      clearTimeout(this.autoApproveSettleTimer);
+      this.autoApproveSettleTimer = null;
     }
-    const providerDefault = this.provider.settings?.autoApprove?.default;
-    if (typeof providerDefault === "boolean") {
-      return providerDefault;
+    if (this.autoApproveBusyTimer) {
+      clearTimeout(this.autoApproveBusyTimer);
+      this.autoApproveBusyTimer = null;
     }
-    return false;
   }
   /** @see ProviderInstance.noteManualInteraction */
   noteManualInteraction(now = Date.now(), opts) {
@@ -52124,7 +52371,7 @@ ${buttons.join("\n")}`;
    * CLI-specific modal text.
    */
   autoApproveEffectivelyActive(status, now = Date.now()) {
-    return status === "waiting_approval" && this.shouldAutoApprove() && !this.manualAttendance.isAttended(now);
+    return status === "waiting_approval" && this.shouldUsePtyAutoApprove() && !this.manualAttendance.isAttended(now);
   }
   // STATUS-MISMATCH: true once the current auto-approve episode has been masking
   // waiting_approval behind `generating` for longer than AUTO_APPROVE_MASK_STALL_MS without
@@ -52134,7 +52381,7 @@ ${buttons.join("\n")}`;
   // maybeAutoApproveStatus (driven by getState + the recheck timer during a waiting episode);
   // this read is side-effect-free so getStatusMetadata can consult it too.
   autoApproveMaskStalled(now = Date.now()) {
-    return this.autoApproveMaskSince > 0 && now - this.autoApproveMaskSince > _CliProviderInstance.AUTO_APPROVE_MASK_STALL_MS;
+    return this.shouldUsePtyAutoApprove() && this.autoApproveMaskSince > 0 && now - this.autoApproveMaskSince > _CliProviderInstance.AUTO_APPROVE_MASK_STALL_MS;
   }
   /**
    * NOTIF-APPROVAL-MASKED (Q1b): surface a delegated worker's STALLED auto-approve modal
@@ -52158,6 +52405,7 @@ ${buttons.join("\n")}`;
    * mask-clock value) so a modal that flaps between parsed/unparsed states is announced once.
    */
   maybeEmitStalledApprovalNudge(adapterStatus, now) {
+    if (!this.shouldUsePtyAutoApprove()) return;
     if (!this.isMeshWorkerSession()) return;
     if (adapterStatus?.status !== "waiting_approval") return;
     if (!this.autoApproveMaskStalled(now)) return;
@@ -53703,6 +53951,7 @@ function shouldRestoreHostedRuntime(record, managerTag) {
 }
 
 // src/commands/cli-manager.ts
+init_auto_approve_modes();
 function isExplicitCommand(command) {
   const trimmed = command.trim();
   return path30.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~");
@@ -53929,6 +54178,24 @@ function expandThinkingLaunchArgs(template, level, levelMap) {
   const mapped = levelMap && typeof levelMap[raw] === "string" && levelMap[raw].trim() ? levelMap[raw].trim() : raw;
   return template.map((part) => part.includes("{{level}}") ? part.replace("{{level}}", mapped) : part);
 }
+function matchesRemovedLaunchArg(arg, removeArg) {
+  return arg === removeArg || removeArg.startsWith("--") && arg.startsWith(`${removeArg}=`);
+}
+function applyAutoApproveModeLaunchArgs(provider, cliArgs, settings) {
+  if (!provider) return { provider, cliArgs };
+  const resolved = resolveProviderAutoApproveMode(provider, settings);
+  if (!resolved.active || resolved.strategy !== "launch-args") return { provider, cliArgs };
+  const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+  if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+  const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+  const baseArgs = provider.spawn?.args;
+  const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0 ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg))) : baseArgs;
+  const launchProvider = filteredBaseArgs === baseArgs ? provider : { ...provider, spawn: { ...provider.spawn, args: filteredBaseArgs } };
+  return {
+    provider: launchProvider,
+    cliArgs: [...mode.launchArgs, ...cliArgs || []]
+  };
+}
 function readSubcommandSessionId(args, subcommands) {
   const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
   if (resumeIndex < 0) return void 0;
@@ -54359,22 +54626,30 @@ Run 'adhdev doctor' for detailed diagnostics.`
     if (provider) {
       console.log(colorize("cyan", `  \u{1F4E6} Using provider: ${provider.name} (${provider.type})`));
     }
-    const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
-    const cliArgsWithModel = modelLaunchArgs ? [...modelLaunchArgs, ...cliArgs || []] : cliArgs;
+    const launchSettings = {
+      ...this.providerLoader.getSettings(normalizedType),
+      ...options?.settingsOverride || {}
+    };
+    const versionResolvedProvider = provider ? this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider : void 0;
+    const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+    const launchProvider = autoApproveLaunch.provider || provider;
+    const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+    const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
+    const cliArgsWithModel = modelLaunchArgs ? [...modelLaunchArgs, ...cliArgsWithAutoApprove || []] : cliArgsWithAutoApprove;
     if (initialModel && !modelLaunchArgs) {
       LOG.warn("CLI", `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template \u2014 launching without model selection.`);
     }
     const initialThinkingLevel = options?.initialThinkingLevel;
-    const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+    const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
     const cliArgsWithBrain = thinkingLaunchArgs ? [...thinkingLaunchArgs, ...cliArgsWithModel || []] : cliArgsWithModel;
     if (initialThinkingLevel && !thinkingLaunchArgs) {
       LOG.warn("CLI", `[${normalizedType}] initialThinkingLevel='${initialThinkingLevel}' requested but provider declares no thinkingLaunchArgs template \u2014 launching without thinking-level selection.`);
     }
-    const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+    const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
     const resolvedCliArgs = sessionBinding.cliArgs;
     const instanceManager = this.deps.getInstanceManager();
-    if (provider && instanceManager) {
-      const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+    if (launchProvider && instanceManager) {
+      const resolvedProvider = launchProvider;
       await this.registerCliInstance(
         key2,
         normalizedType,
@@ -54382,7 +54657,7 @@ Run 'adhdev doctor' for detailed diagnostics.`
         resolvedDir,
         resolvedCliArgs,
         resolvedProvider,
-        { ...this.providerLoader.getSettings(normalizedType), ...options?.settingsOverride || {} },
+        launchSettings,
         false,
         {
           providerSessionId: sessionBinding.providerSessionId,
@@ -55221,6 +55496,7 @@ init_hash();
 init_logger();
 
 // src/providers/provider-schema.ts
+init_auto_approve_modes();
 init_open_panel_support();
 var VALID_CAPABILITY_MEDIA_TYPES = /* @__PURE__ */ new Set(["text", "image", "audio", "video", "resource"]);
 var VALID_INPUT_STRATEGIES2 = /* @__PURE__ */ new Set(["native", "native_acp", "resource_link", "text_fallback", "paste", "upload"]);
@@ -55286,6 +55562,7 @@ var KNOWN_PROVIDER_FIELDS = /* @__PURE__ */ new Set([
   "providerVersion",
   "status",
   "details",
+  "autoApproveModes",
   "modelLaunchArgs",
   "modelOptions",
   "thinkingLaunchArgs",
@@ -55347,6 +55624,7 @@ function validateProviderDefinition(raw) {
   validateCapabilities(provider, controls, errors);
   validateNativeHistory(provider.nativeHistory, errors);
   validateMeshCoordinator(provider.meshCoordinator, errors);
+  validateAutoApproveModes(provider.autoApproveModes, errors);
   for (const control of controls) {
     validateControl(control, errors);
   }
@@ -55355,6 +55633,75 @@ function validateProviderDefinition(raw) {
   }
   return { errors, warnings };
 }
+function validateAutoApproveModes(raw, errors) {
+  if (raw === void 0) return;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    errors.push("autoApproveModes must be an object");
+    return;
+  }
+  const config = raw;
+  const defaultModeId = typeof config.default === "string" ? config.default.trim() : "";
+  if (!defaultModeId) {
+    errors.push("autoApproveModes.default must be a non-empty string");
+  } else {
+    config.default = defaultModeId;
+  }
+  if (!Array.isArray(config.modes) || config.modes.length === 0) {
+    errors.push("autoApproveModes.modes must be a non-empty array");
+    return;
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, rawMode] of config.modes.entries()) {
+    const prefix = `autoApproveModes.modes[${index}]`;
+    if (!rawMode || typeof rawMode !== "object" || Array.isArray(rawMode)) {
+      errors.push(`${prefix} must be an object`);
+      continue;
+    }
+    const mode = rawMode;
+    const id = typeof mode.id === "string" ? mode.id.trim() : "";
+    if (!id) {
+      errors.push(`${prefix}.id must be a non-empty string`);
+    } else if (ids.has(id)) {
+      errors.push(`${prefix}.id must be unique (duplicate: ${id})`);
+    } else {
+      ids.add(id);
+      mode.id = id;
+    }
+    if (typeof mode.label !== "string" || !mode.label.trim()) {
+      errors.push(`${prefix}.label must be a non-empty string`);
+    }
+    const strategy = mode.strategy;
+    if (!["pty-parse-default", "launch-args", "post-boot-command"].includes(String(strategy))) {
+      errors.push(`${prefix}.strategy must be one of: pty-parse-default, launch-args, post-boot-command`);
+    } else if (strategy === "post-boot-command") {
+      errors.push(`${prefix}.strategy post-boot-command is reserved and unsupported in v1`);
+    }
+    const risk = mode.risk;
+    if (!["safe", "caution", "dangerous"].includes(String(risk))) {
+      errors.push(`${prefix}.risk must be one of: safe, caution, dangerous`);
+    }
+    for (const field of ["launchArgs", "removeArgs"]) {
+      const value = mode[field];
+      if (value !== void 0 && (!Array.isArray(value) || value.some((arg) => typeof arg !== "string" || !arg.trim()))) {
+        errors.push(`${prefix}.${field} must be an array of non-empty strings when provided`);
+      }
+    }
+    if (strategy === "launch-args" && (!Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0)) {
+      errors.push(`${prefix}.launchArgs must be a non-empty array for launch-args strategy`);
+    }
+    if (["safe", "caution", "dangerous"].includes(String(risk)) && deriveAutoApproveModeRisk(mode) === "dangerous") {
+      mode.risk = "dangerous";
+    }
+    if (mode.risk === "dangerous" && (typeof mode.warning !== "string" || !mode.warning.trim())) {
+      errors.push(`${prefix}.warning is required for dangerous modes`);
+    } else if (mode.warning !== void 0 && (typeof mode.warning !== "string" || !mode.warning.trim())) {
+      errors.push(`${prefix}.warning must be a non-empty string when provided`);
+    }
+  }
+  if (defaultModeId && !ids.has(defaultModeId)) {
+    errors.push(`autoApproveModes.default must reference an existing mode id: ${defaultModeId}`);
+  }
+}
 function validateCapabilities(provider, controls, errors) {
   const capabilities = provider.capabilities;
   if (provider.contractVersion === 2) {
@@ -59964,6 +60311,139 @@ var meshCrudHandlers = {
       return { success: false, error: e.message };
     }
   },
+  // READ path for `.adhdev/mesh.json` — returns the currently-committed repo
+  // config (parsed + normalized) for a workspace so a UI can render/edit the
+  // existing declarative zones (notably `providerDefaults.autoApproveModes`)
+  // WITHOUT re-deriving them from the machine-local scaffold. Never writes.
+  // `config` is undefined when no repo file exists (sourceType 'unavailable') or
+  // it is unparseable (sourceType 'invalid', with the parse error surfaced).
+  read_mesh_json_config: async (_ctx, args) => {
+    const workspace = typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+    try {
+      const { loadRepoMeshJsonConfig: loadRepoMeshJsonConfig2 } = await Promise.resolve().then(() => (init_mesh_json_config(), mesh_json_config_exports));
+      const loaded = loadRepoMeshJsonConfig2(workspace);
+      return {
+        success: true,
+        workspace,
+        sourceType: loaded.sourceType,
+        source: loaded.source,
+        ...loaded.path ? { path: loaded.path } : {},
+        ...loaded.error ? { error: loaded.error } : {},
+        config: loaded.config,
+        // Convenience projection so the UI does not have to reach into config.
+        providerDefaults: loaded.config?.providerDefaults
+      };
+    } catch (e) {
+      return { success: false, error: e.message };
+    }
+  },
+  // Partial-edit WRITE path for `.adhdev/mesh.json` `providerDefaults` — a
+  // READ-MODIFY-WRITE that preserves operator hand-edits. Unlike
+  // write_mesh_json_config (which rebuilds the WHOLE file from the machine-local
+  // scaffold and can silently drop hand-edited zones), this parses the existing
+  // repo file, merges ONLY the providerDefaults.autoApproveModes zone, and
+  // re-serializes — coordinator prompt, operating notes and limits authored in
+  // the repo are carried through untouched. Defaults to dry-run.
+  //
+  // args: { workspace?, autoApproveModes: Record<providerType,modeId>, write?, merge? }
+  //   merge=true (default): per-provider merge into the existing map; a modeId of
+  //     '' | null removes that provider's entry. merge=false: REPLACE the whole
+  //     autoApproveModes map with the supplied one.
+  set_mesh_provider_defaults: async (_ctx, args) => {
+    const workspace = typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+    const write = args?.write === true;
+    const merge = args?.merge !== false;
+    const inputModes = args?.autoApproveModes;
+    if (inputModes !== void 0 && (typeof inputModes !== "object" || inputModes === null || Array.isArray(inputModes))) {
+      return { success: false, error: "autoApproveModes must be an object (providerType \u2192 modeId) when provided" };
+    }
+    try {
+      const {
+        loadRepoMeshJsonConfig: loadRepoMeshJsonConfig2,
+        normalizeRepoMeshDeclarativeConfig: normalizeRepoMeshDeclarativeConfig2,
+        MESH_JSON_CONFIG_LOCATIONS: MESH_JSON_CONFIG_LOCATIONS2
+      } = await Promise.resolve().then(() => (init_mesh_json_config(), mesh_json_config_exports));
+      const { existsSync: existsSync57, readFileSync: readFileSync44, mkdirSync: mkdirSync23, writeFileSync: writeFileSync25 } = await import("fs");
+      const { dirname: dirname19, join: join54 } = await import("path");
+      const yaml6 = await import("js-yaml");
+      const relativePath = MESH_JSON_CONFIG_LOCATIONS2[0];
+      let baseDoc = { version: 1 };
+      let existingPath = join54(workspace, relativePath);
+      let existedAsYaml = false;
+      for (const relative5 of MESH_JSON_CONFIG_LOCATIONS2) {
+        const candidate = join54(workspace, relative5);
+        if (!existsSync57(candidate)) continue;
+        try {
+          const text = readFileSync44(candidate, "utf-8");
+          const parsed = /\.json$/i.test(candidate) ? JSON.parse(text) : yaml6.load(text);
+          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            baseDoc = parsed;
+            existingPath = candidate;
+            existedAsYaml = !/\.json$/i.test(candidate);
+          }
+        } catch (e) {
+          return { success: false, error: `existing ${relative5} is unparseable, refusing to overwrite: ${e?.message || e}` };
+        }
+        break;
+      }
+      const existingPd = baseDoc.providerDefaults && typeof baseDoc.providerDefaults === "object" && !Array.isArray(baseDoc.providerDefaults) ? baseDoc.providerDefaults : {};
+      const existingModes = existingPd.autoApproveModes && typeof existingPd.autoApproveModes === "object" && !Array.isArray(existingPd.autoApproveModes) ? { ...existingPd.autoApproveModes } : {};
+      const nextModes = merge ? existingModes : {};
+      if (inputModes) {
+        for (const [providerType, modeId] of Object.entries(inputModes)) {
+          const type = typeof providerType === "string" ? providerType.trim() : "";
+          if (!type) continue;
+          const id = typeof modeId === "string" ? modeId.trim() : "";
+          if (id) nextModes[type] = id;
+          else delete nextModes[type];
+        }
+      }
+      const nextDoc = { ...baseDoc, version: 1 };
+      if (Object.keys(nextModes).length) {
+        nextDoc.providerDefaults = { ...existingPd, autoApproveModes: nextModes };
+      } else {
+        if (nextDoc.providerDefaults) {
+          const { autoApproveModes, ...restPd } = nextDoc.providerDefaults;
+          if (Object.keys(restPd).length) nextDoc.providerDefaults = restPd;
+          else delete nextDoc.providerDefaults;
+        }
+      }
+      const validation = normalizeRepoMeshDeclarativeConfig2(nextDoc);
+      if (!validation.valid) {
+        return { success: false, error: `merged mesh.json is invalid: ${validation.errors.join("; ")}` };
+      }
+      const absolutePath = existingPath;
+      const serialized = existedAsYaml ? yaml6.dump(nextDoc, { indent: 2 }) : `${JSON.stringify(nextDoc, null, 2)}
+`;
+      if (!write) {
+        return {
+          success: true,
+          written: false,
+          dryRun: true,
+          path: absolutePath,
+          relativePath,
+          merge,
+          providerDefaults: nextDoc.providerDefaults,
+          preview: serialized,
+          note: "Dry-run: nothing written. Re-run with write=true to persist. Only the providerDefaults zone is merged; other repo zones are preserved."
+        };
+      }
+      mkdirSync23(dirname19(absolutePath), { recursive: true });
+      writeFileSync25(absolutePath, serialized, "utf-8");
+      return {
+        success: true,
+        written: true,
+        dryRun: false,
+        path: absolutePath,
+        relativePath,
+        merge,
+        providerDefaults: nextDoc.providerDefaults,
+        note: "Wrote providerDefaults into .adhdev/mesh.json (read-modify-write; other zones preserved). Commit it to the repo."
+      };
+    } catch (e) {
+      return { success: false, error: e.message };
+    }
+  },
   delete_mesh: async (_ctx, args) => {
     const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
     if (!meshId) return { success: false, error: "meshId required" };
@@ -76096,6 +76576,9 @@ export {
   MAX_LEDGER_SLICE_LIMIT,
   MESH_CONVERGE_FAST_FORWARD_TAG,
   MESH_CONVERGE_REFINE_TAG,
+  MESH_JSON_CONFIG_LOCATIONS,
+  MESH_JSON_CONFIG_SCHEMA,
+  MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE,
   MESH_MAX_PARALLEL_TASKS_MAX,
   MESH_MAX_PARALLEL_TASKS_MIN,
   MESH_MISSION_LIST_HISTORY_ID_LIMIT,
@@ -76155,6 +76638,7 @@ export {
   buildMeshActiveWorkSummary,
   buildMeshAsyncRefineJobs,
   buildMeshHostRequiredFailure,
+  buildMeshJsonConfigScaffold,
   buildMeshLedgerReconciliationEvidence,
   buildMeshLedgerReplicaEvidence,
   buildMeshMagiActivity,
@@ -76205,6 +76689,7 @@ export {
   createSessionDelivery,
   createWorktree,
   daemonIdsEquivalent,
+  delegatedWorkerAutoApproveSettings,
   deleteDirectDispatchesByTaskId,
   deleteMesh,
   deriveMeshNodeHealthFromGit,
@@ -76318,6 +76803,7 @@ export {
   loadMeshCoordinatorRegistry,
   loadMeshRefineConfig,
   loadMeshWorktreeBootstrapConfig,
+  loadRepoMeshJsonConfig,
   loadRepoSettings,
   loadState,
   logCommand,
@@ -76358,6 +76844,7 @@ export {
   normalizeMeshWorkerResult,
   normalizeMessageParts,
   normalizeRepoIdentity,
+  normalizeRepoMeshDeclarativeConfig,
   normalizeSessionModalFields,
   parsePorcelainV2Status,
   parseProviderSourceConfigUpdate,
@@ -76404,6 +76891,7 @@ export {
   resolveCurrentGlobalInstallSurface,
   resolveDebugRuntimeConfig,
   resolveDelegatedWorkerAutoApprove,
+  resolveDelegatedWorkerDangerousModeAllow,
   resolveDeliveryDecision,
   resolveEffectiveMeshNodeHealth,
   resolveGitRepository,
@@ -76427,6 +76915,7 @@ export {
   runMeshWorktreeBootstrap,
   saveConfig,
   saveState,
+  serializeMeshJsonConfigScaffold,
   serializeV2EnvelopeToWire,
   setDebugRuntimeConfig,
   setLogLevel,