@adhdev/daemon-core 1.0.18-rc.16 → 1.0.18-rc.18

package/dist/providers/auto-approve-modes.d.ts

@@ -0,0 +1,14 @@
+import type { AutoApproveMode, AutoApproveModeRisk, AutoApproveModeStrategy, ProviderModule } from './contracts.js';
+export interface ResolvedAutoApproveMode {
+    active: boolean;
+    strategy: AutoApproveModeStrategy;
+    modeId: string;
+}
+/** Runtime defense-in-depth for provider definitions that bypass schema validation. */
+export declare function deriveAutoApproveModeRisk(mode: Pick<AutoApproveMode, 'risk' | 'launchArgs'>): AutoApproveModeRisk;
+/**
+ * Resolve new mode settings before the legacy boolean. A stale/unknown explicit
+ * mode id fails closed instead of falling through to an enabled legacy setting.
+ */
+export declare function resolveProviderAutoApproveMode(provider: ProviderModule, settings: Record<string, unknown> | undefined): ResolvedAutoApproveMode;
+export declare function findProviderAutoApproveMode(provider: ProviderModule | undefined, modeId: string): AutoApproveMode | undefined;

package/dist/providers/cli-provider-instance.d.ts

@@ -810,7 +810,11 @@ export declare class CliProviderInstance implements ProviderInstance {
     getAdapter(): ProviderCliAdapter;
     get cliType(): string;
     get cliName(): string;
+    private resolveAutoApproveMode;
+    /** Legacy boolean view retained for internal/test compatibility. */
     private shouldAutoApprove;
+    private shouldUsePtyAutoApprove;
+    private resetPtyAutoApproveState;
     /** @see ProviderInstance.noteManualInteraction */
     noteManualInteraction(now?: number, opts?: {
         passive?: boolean;

package/dist/providers/contracts.d.ts

@@ -389,6 +389,21 @@ export interface ProviderCompatibilityEntry {
     ideVersion: string;
     scriptDir: string;
 }
+export type AutoApproveModeStrategy = 'pty-parse-default' | 'launch-args' | 'post-boot-command';
+export type AutoApproveModeRisk = 'safe' | 'caution' | 'dangerous';
+export interface AutoApproveMode {
+    id: string;
+    label: string;
+    strategy: AutoApproveModeStrategy;
+    risk: AutoApproveModeRisk;
+    warning?: string;
+    launchArgs?: string[];
+    removeArgs?: string[];
+}
+export interface AutoApproveModesConfig {
+    default: string;
+    modes: AutoApproveMode[];
+}
 export interface ProviderModule {
     /** Unique identifier (e.g. 'cline', 'cursor', 'gemini-cli') */
     type: string;
@@ -418,6 +433,8 @@ export interface ProviderModule {
     status?: string;
     /** Inventory/support detail string maintained in adhdev-providers */
     details?: string;
+    /** Provider-specific auto-approve choices and their launch/runtime strategy. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** Install instructions (shown when command is missing) */
     install?: string;
     /** Custom version detection command (e.g. 'cursor --version', 'claude -v') */

package/dist/providers/provider-schema.d.ts

@@ -3,3 +3,4 @@ export interface ProviderValidationResult {
     warnings: string[];
 }
 export declare function validateProviderDefinition(raw: unknown): ProviderValidationResult;
+export declare function validateAutoApproveModes(raw: unknown, errors: string[]): void;

package/dist/repo-mesh-types.d.ts

@@ -14,6 +14,8 @@ import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
 import type { MagiKindPanelMap, DifficultyBrainMap, NodeCapabilitySlot } from '@adhdev/mesh-shared';
+import type { ProviderModule } from './providers/contracts.js';
+import type { RepoMeshDeclarativeConfig } from './config/mesh-json-config.js';
 export interface RepoMesh {
     id: string;
     name: string;
@@ -255,6 +257,8 @@ export interface RepoMeshPolicy {
      * A node policy may override this per-node (RepoMeshNodePolicy.delegatedWorkerAutoApprove).
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Explicit opt-in required before delegated workers may use a dangerous provider mode. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): opt-in to allow the coordinator to inject
      * DESTRUCTIVE keys (CTRL_C / ESC) into a worker PTY via mesh_send_keys. These
@@ -406,6 +410,8 @@ export interface RepoMeshNodePolicy {
      * precedence over the mesh-level policy for worker sessions launched onto this node.
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Per-node override for dangerous delegated worker mode authorization. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): per-node override for
      * RepoMeshPolicy.allowSendKeysDestructive.
@@ -524,13 +530,39 @@ export declare function normalizeAutoFastForwardPolicy(value: unknown): NonNulla
  */
 export declare function mergeAndNormalizePolicy(base: RepoMeshPolicy | undefined, patch: Partial<RepoMeshPolicy> | undefined): RepoMeshPolicy;
 /**
- * Resolve whether a delegated worker session launched onto `nodePolicy` (within a mesh
- * governed by `meshPolicy`) should auto-approve. Precedence: node override → mesh policy
- * → default true. The result is stamped into the worker launch settings envelope as
- * `autoApprove`; it wins over the global per-provider-type autoApprove config because the
- * launch path merges the envelope as a settingsOverride on top of the provider defaults.
+ * Resolve delegated worker auto-approve. Legacy providers return a boolean. Providers
+ * with modes return a mode id, except a dangerous mode is downgraded to a
+ * non-dangerous PTY mode unless mesh/node policy explicitly opts in.
+ *
+ * THREE EXPLICIT STAGES — do not collapse them; the ordering is a hard MAGI
+ * invariant:
+ *
+ *   ① ENABLE gate (machine-local policy only): node boolean > mesh boolean.
+ *      `enabled=false` returns `false` IMMEDIATELY, BEFORE any mode selection.
+ *      The repo `mesh.json` providerDefaults has ZERO influence here — a
+ *      node/mesh opt-out is never overridden by a repo-declared requested mode.
+ *
+ *   ② MODE selection (only when enabled === true):
+ *        task override [FUTURE — param reserved below, not yet wired] >
+ *        repo mesh.json providerDefaults.autoApproveModes[providerType] >
+ *        provider spec autoApproveModes.default.
+ *      A repo-requested mode ID is adopted ONLY when it exists in the provider's
+ *      own `autoApproveModes.modes`; an unknown/stale/typo'd ID is IGNORED and we
+ *      fall back to the provider default (fail-closed: never coerce into a
+ *      dangerous mode via a bad ID).
+ *
+ *   ③ DANGEROUS gate: whichever mode stage ② picked, if it is dangerous and the
+ *      machine-local delegatedWorkerDangerousModeAllow is not set, downgrade to a
+ *      non-dangerous PTY-parse mode (or `false` if none exists).
  */
-export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove'> | null): boolean;
+export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null, repoConfig?: RepoMeshDeclarativeConfig | null, providerType?: string | null): boolean | string;
+export declare function resolveDelegatedWorkerDangerousModeAllow(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerDangerousModeAllow'> | null): boolean;
+/** Shape a boolean-or-mode resolution for the settings precedence contract. */
+export declare function delegatedWorkerAutoApproveSettings(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null, repoConfig?: RepoMeshDeclarativeConfig | null, providerType?: string | null): {
+    autoApprove: boolean | undefined;
+    autoApproveMode: string | undefined;
+    delegatedWorkerDangerousModeAllow: boolean;
+};
 /**
  * MESH-SEND-KEYS (feature 3): resolve whether DESTRUCTIVE key injection
  * (CTRL_C/ESC via mesh_send_keys) is permitted for a node. Node policy overrides

package/dist/shared-types.d.ts

@@ -13,7 +13,7 @@ export type { ProviderState, ProviderStatus, ActiveChatData, IdeProviderState, C
 export type { ProviderErrorReason } from './providers/provider-instance.js';
 import type { ActiveChatData as _ActiveChatData, ProviderErrorReason as _ProviderErrorReason } from './providers/provider-instance.js';
 import type { WorkspaceEntry } from './config/workspaces.js';
-import type { ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
+import type { AutoApproveModesConfig, ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
 import type { GitCompactSummary, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams } from './git/git-types.js';
 import type { InteractivePrompt } from './providers/types/interactive-prompt.js';
 export type { GitCommandName, GitCompactSummary, GitDiffSummary, GitFailureReason, GitFileChange, GitFileChangeStatus, GitRepoIdentity, GitRepoStatus, GitSnapshot, GitSnapshotCompareSummary, GitSnapshotReason, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams, } from './git/git-types.js';
@@ -428,6 +428,8 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
+    /** Provider-declared auto-approve choices shown by session launch UIs. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** BRAIN-ROUTING: suggested model values for the new-session model dropdown. */
     modelOptions?: string[];
     /** BRAIN-ROUTING: reasoning-effort values for the new-session thinking dropdown. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.16",
+  "version": "1.0.18-rc.18",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.16",
-    "@adhdev/session-host-core": "1.0.18-rc.16",
+    "@adhdev/mesh-shared": "1.0.18-rc.18",
+    "@adhdev/session-host-core": "1.0.18-rc.18",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/cli-manager.ts

@@ -34,6 +34,7 @@ import type { SessionRegistry } from '../sessions/registry.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { LOG } from '../logging/logger.js';
 import { shouldRestoreHostedRuntime } from './hosted-runtime-restore.js';
+import { findProviderAutoApproveMode, resolveProviderAutoApproveMode } from '../providers/auto-approve-modes.js';
 
 // ─── external dependency interface ──────────────────────────
 
@@ -452,6 +453,40 @@ export function expandThinkingLaunchArgs(
     return template.map((part) => part.includes('{{level}}') ? part.replace('{{level}}', mapped) : part);
 }
 
+function matchesRemovedLaunchArg(arg: string, removeArg: string): boolean {
+    return arg === removeArg || (removeArg.startsWith('--') && arg.startsWith(`${removeArg}=`));
+}
+
+/**
+ * Apply a selected launch-args auto-approve mode without mutating provider metadata.
+ * removeArgs only targets provider-owned base spawn.args; launchArgs are prepended to
+ * per-launch args beside model/thinking args, making conflict removal order-independent.
+ */
+export function applyAutoApproveModeLaunchArgs(
+    provider: ProviderModule | undefined,
+    cliArgs: string[] | undefined,
+    settings: Record<string, unknown> | undefined,
+): { provider: ProviderModule | undefined; cliArgs: string[] | undefined } {
+    if (!provider) return { provider, cliArgs };
+    const resolved = resolveProviderAutoApproveMode(provider, settings);
+    if (!resolved.active || resolved.strategy !== 'launch-args') return { provider, cliArgs };
+    const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+    if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+
+    const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+    const baseArgs = provider.spawn?.args;
+    const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0
+        ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg)))
+        : baseArgs;
+    const launchProvider = filteredBaseArgs === baseArgs
+        ? provider
+        : { ...provider, spawn: { ...provider.spawn!, args: filteredBaseArgs } };
+    return {
+        provider: launchProvider,
+        cliArgs: [...mode.launchArgs, ...(cliArgs || [])],
+    };
+}
+
 function readSubcommandSessionId(args: string[], subcommands: string[]): string | undefined {
     const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
     if (resumeIndex < 0) return undefined;
@@ -1048,6 +1083,17 @@ export class DaemonCliManager {
             console.log(colorize('cyan', `  📦 Using provider: ${provider.name} (${provider.type})`));
         }
 
+        const launchSettings = {
+            ...this.providerLoader.getSettings(normalizedType),
+            ...(options?.settingsOverride || {}),
+        };
+        const versionResolvedProvider = provider
+            ? (this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider)
+            : undefined;
+        const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+        const launchProvider = autoApproveLaunch.provider || provider;
+        const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+
  // ─── Model axis (MAGI kind-panel): expand initialModel → launch args ───
  // For a plain CLI provider the model is selected at spawn time via the manifest's
  // modelLaunchArgs template ('{{model}}' → the requested model). ACP providers took
@@ -1055,10 +1101,10 @@ export class DaemonCliManager {
  // or no requested model, is a no-op — model selection is best-effort and must never
  // fail a launch. The model args are prepended so a caller's explicit cliArgs (e.g. a
  // resume flag) still win positionally where order matters.
-        const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
+        const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
         const cliArgsWithModel = modelLaunchArgs
-            ? [...modelLaunchArgs, ...(cliArgs || [])]
-            : cliArgs;
+            ? [...modelLaunchArgs, ...(cliArgsWithAutoApprove || [])]
+            : cliArgsWithAutoApprove;
         if (initialModel && !modelLaunchArgs) {
             LOG.warn('CLI', `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template — launching without model selection.`);
         }
@@ -1069,7 +1115,7 @@ export class DaemonCliManager {
  // Best-effort; a provider with no template (or no requested level) is a no-op. ACP
  // providers route thinking through setConfigOption('thought_level') above.
         const initialThinkingLevel = options?.initialThinkingLevel;
-        const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+        const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
         const cliArgsWithBrain = thinkingLaunchArgs
             ? [...thinkingLaunchArgs, ...(cliArgsWithModel || [])]
             : cliArgsWithModel;
@@ -1078,13 +1124,13 @@ export class DaemonCliManager {
         }
 
  // ─── Resolve launch options → provider session binding ───
-        const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+        const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
         const resolvedCliArgs = sessionBinding.cliArgs;
 
  // If InstanceManager exists, manage as CliProviderInstance unified
         const instanceManager = this.deps.getInstanceManager();
-        if (provider && instanceManager) {
-            const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+        if (launchProvider && instanceManager) {
+            const resolvedProvider = launchProvider;
             await this.registerCliInstance(
                 key,
                 normalizedType,
@@ -1092,7 +1138,7 @@ export class DaemonCliManager {
                 resolvedDir,
                 resolvedCliArgs,
                 resolvedProvider,
-                { ...this.providerLoader.getSettings(normalizedType), ...(options?.settingsOverride || {}) },
+                launchSettings,
                 false,
                 {
                     providerSessionId: sessionBinding.providerSessionId,

package/src/commands/med-family/mesh-crud.ts

@@ -399,6 +399,161 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
         }
     },
 
+    // READ path for `.adhdev/mesh.json` — returns the currently-committed repo
+    // config (parsed + normalized) for a workspace so a UI can render/edit the
+    // existing declarative zones (notably `providerDefaults.autoApproveModes`)
+    // WITHOUT re-deriving them from the machine-local scaffold. Never writes.
+    // `config` is undefined when no repo file exists (sourceType 'unavailable') or
+    // it is unparseable (sourceType 'invalid', with the parse error surfaced).
+    read_mesh_json_config: async (_ctx: MedFamilyContext, args: any) => {
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        try {
+            const { loadRepoMeshJsonConfig } = await import('../../config/mesh-json-config.js');
+            const loaded = loadRepoMeshJsonConfig(workspace);
+            return {
+                success: true,
+                workspace,
+                sourceType: loaded.sourceType,
+                source: loaded.source,
+                ...(loaded.path ? { path: loaded.path } : {}),
+                ...(loaded.error ? { error: loaded.error } : {}),
+                config: loaded.config,
+                // Convenience projection so the UI does not have to reach into config.
+                providerDefaults: loaded.config?.providerDefaults,
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
+    // Partial-edit WRITE path for `.adhdev/mesh.json` `providerDefaults` — a
+    // READ-MODIFY-WRITE that preserves operator hand-edits. Unlike
+    // write_mesh_json_config (which rebuilds the WHOLE file from the machine-local
+    // scaffold and can silently drop hand-edited zones), this parses the existing
+    // repo file, merges ONLY the providerDefaults.autoApproveModes zone, and
+    // re-serializes — coordinator prompt, operating notes and limits authored in
+    // the repo are carried through untouched. Defaults to dry-run.
+    //
+    // args: { workspace?, autoApproveModes: Record<providerType,modeId>, write?, merge? }
+    //   merge=true (default): per-provider merge into the existing map; a modeId of
+    //     '' | null removes that provider's entry. merge=false: REPLACE the whole
+    //     autoApproveModes map with the supplied one.
+    set_mesh_provider_defaults: async (_ctx: MedFamilyContext, args: any) => {
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        const write = args?.write === true;
+        const merge = args?.merge !== false; // default true
+        const inputModes = args?.autoApproveModes;
+        if (inputModes !== undefined && (typeof inputModes !== 'object' || inputModes === null || Array.isArray(inputModes))) {
+            return { success: false, error: 'autoApproveModes must be an object (providerType → modeId) when provided' };
+        }
+        try {
+            const {
+                loadRepoMeshJsonConfig,
+                normalizeRepoMeshDeclarativeConfig,
+                MESH_JSON_CONFIG_LOCATIONS,
+            } = await import('../../config/mesh-json-config.js');
+            const { existsSync, readFileSync, mkdirSync, writeFileSync } = await import('fs');
+            const { dirname, join } = await import('path');
+            const yaml = await import('js-yaml');
+
+            const relativePath = MESH_JSON_CONFIG_LOCATIONS[0];
+
+            // Read-modify-write: parse the EXISTING on-disk document (preferring the
+            // first existing json/yaml variant) so unrelated zones survive verbatim.
+            let baseDoc: Record<string, any> = { version: 1 };
+            let existingPath = join(workspace, relativePath);
+            let existedAsYaml = false;
+            for (const relative of MESH_JSON_CONFIG_LOCATIONS) {
+                const candidate = join(workspace, relative);
+                if (!existsSync(candidate)) continue;
+                try {
+                    const text = readFileSync(candidate, 'utf-8');
+                    const parsed = /\.json$/i.test(candidate) ? JSON.parse(text) : yaml.load(text);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                        baseDoc = parsed as Record<string, any>;
+                        existingPath = candidate;
+                        existedAsYaml = !/\.json$/i.test(candidate);
+                    }
+                } catch (e: any) {
+                    return { success: false, error: `existing ${relative} is unparseable, refusing to overwrite: ${e?.message || e}` };
+                }
+                break;
+            }
+
+            // Merge ONLY the providerDefaults.autoApproveModes zone.
+            const existingPd = baseDoc.providerDefaults && typeof baseDoc.providerDefaults === 'object' && !Array.isArray(baseDoc.providerDefaults)
+                ? baseDoc.providerDefaults as Record<string, any>
+                : {};
+            const existingModes = existingPd.autoApproveModes && typeof existingPd.autoApproveModes === 'object' && !Array.isArray(existingPd.autoApproveModes)
+                ? { ...existingPd.autoApproveModes as Record<string, string> }
+                : {};
+
+            const nextModes: Record<string, string> = merge ? existingModes : {};
+            if (inputModes) {
+                for (const [providerType, modeId] of Object.entries(inputModes as Record<string, unknown>)) {
+                    const type = typeof providerType === 'string' ? providerType.trim() : '';
+                    if (!type) continue;
+                    const id = typeof modeId === 'string' ? modeId.trim() : '';
+                    if (id) nextModes[type] = id;
+                    else delete nextModes[type]; // '' / null → remove this provider's entry
+                }
+            }
+
+            const nextDoc: Record<string, any> = { ...baseDoc, version: 1 };
+            if (Object.keys(nextModes).length) {
+                nextDoc.providerDefaults = { ...existingPd, autoApproveModes: nextModes };
+            } else {
+                // No entries left → drop the zone entirely so we don't leave an empty stub.
+                if (nextDoc.providerDefaults) {
+                    const { autoApproveModes, ...restPd } = nextDoc.providerDefaults;
+                    if (Object.keys(restPd).length) nextDoc.providerDefaults = restPd;
+                    else delete nextDoc.providerDefaults;
+                }
+            }
+
+            // Validate the merged document before it ever touches disk.
+            const validation = normalizeRepoMeshDeclarativeConfig(nextDoc);
+            if (!validation.valid) {
+                return { success: false, error: `merged mesh.json is invalid: ${validation.errors.join('; ')}` };
+            }
+
+            // Serialize in the on-disk format (JSON unless the existing file was YAML).
+            const absolutePath = existingPath;
+            const serialized = existedAsYaml
+                ? yaml.dump(nextDoc, { indent: 2 })
+                : `${JSON.stringify(nextDoc, null, 2)}\n`;
+
+            if (!write) {
+                return {
+                    success: true,
+                    written: false,
+                    dryRun: true,
+                    path: absolutePath,
+                    relativePath,
+                    merge,
+                    providerDefaults: nextDoc.providerDefaults,
+                    preview: serialized,
+                    note: 'Dry-run: nothing written. Re-run with write=true to persist. Only the providerDefaults zone is merged; other repo zones are preserved.',
+                };
+            }
+
+            mkdirSync(dirname(absolutePath), { recursive: true });
+            writeFileSync(absolutePath, serialized, 'utf-8');
+            return {
+                success: true,
+                written: true,
+                dryRun: false,
+                path: absolutePath,
+                relativePath,
+                merge,
+                providerDefaults: nextDoc.providerDefaults,
+                note: 'Wrote providerDefaults into .adhdev/mesh.json (read-modify-write; other zones preserved). Commit it to the repo.',
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
     delete_mesh: async (_ctx: MedFamilyContext, args: any) => {
         const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
         if (!meshId) return { success: false, error: 'meshId required' };

package/src/config/mesh-json-config.ts

@@ -19,6 +19,18 @@
  * machine-local policy directly. The repo file shapes the coordinator prompt and
  * operating notes, nothing else.
  *
+ * `providerDefaults` IS NOT POLICY EITHER. It is a repo-shared DECLARATIVE
+ * "requested auto-approve mode" per providerType — the answer to "WHEN a delegated
+ * worker of type X is auto-approved, WHICH mode should it use by default". It has
+ * NO say over WHETHER auto-approve is enabled: the ENABLE decision (and the
+ * dangerous-mode opt-in) remains 100% machine-local (meshes.json /
+ * RepoMeshPolicy). A repo can declare `providerDefaults` freely; a machine that
+ * has delegatedWorkerAutoApprove=false still gets no auto-approve, and a dangerous
+ * requested mode is still downgraded to PTY parsing unless the machine opts in.
+ * The requested mode ID is validated at runtime against the provider spec — an
+ * unknown mode ID is IGNORED (fall back to the provider's own default), never
+ * silently coerced into a dangerous mode.
+ *
  * The coordinator/operatingNotes merge is **in-memory only**: the on-disk
  * machine-local `meshes.json` is never mutated by this module.
  *
@@ -60,6 +72,19 @@ export interface RepoMeshDeclarativeLimits {
     maxNotes?: number;
 }
 
+/**
+ * Repo-shared declarative per-provider defaults. NOT policy — see the file header.
+ * `autoApproveModes` maps a providerType (e.g. "claude-cli") to the auto-approve
+ * mode ID that a delegated worker of that type should REQUEST when it is
+ * auto-approved. The map only influences WHICH mode is used, never WHETHER
+ * auto-approve is enabled (that stays machine-local). Mode IDs are validated
+ * against the live provider spec at resolve time; an unknown ID is ignored.
+ */
+export interface RepoMeshDeclarativeProviderDefaults {
+    /** providerType → requested auto-approve mode ID. */
+    autoApproveModes?: Record<string, string>;
+}
+
 /**
  * Parsed + normalized `.adhdev/mesh.json` shape. Every field is optional except
  * version so a repo can declare only the zone(s) it cares about. Policy is NOT a
@@ -70,6 +95,8 @@ export interface RepoMeshDeclarativeConfig {
     coordinator?: RepoMeshDeclarativeCoordinatorConfig;
     operatingNotes?: CoordinatorOperatingNote[];
     limits?: RepoMeshDeclarativeLimits;
+    /** Repo-shared per-provider defaults (requested auto-approve mode). NOT policy. */
+    providerDefaults?: RepoMeshDeclarativeProviderDefaults;
 }
 
 export interface RepoMeshJsonConfigLoadResult {
@@ -132,6 +159,20 @@ export const MESH_JSON_CONFIG_SCHEMA = {
                 maxNotes: { type: 'number', minimum: 1 },
             },
         },
+        providerDefaults: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                // providerType → requested auto-approve mode ID. Mode IDs are
+                // validated against the live provider spec at resolve time; an
+                // unknown ID is ignored (provider default is used), so the schema
+                // only constrains the shape (string→string), not the ID values.
+                autoApproveModes: {
+                    type: 'object',
+                    additionalProperties: { type: 'string' },
+                },
+            },
+        },
     },
 } as const;
 
@@ -226,6 +267,38 @@ export function normalizeRepoMeshDeclarativeConfig(parsed: unknown): {
         }
     }
 
+    // providerDefaults: shape-only normalization. We keep every string→string
+    // (providerType → requested mode ID) entry after trimming; we deliberately do
+    // NOT validate the mode IDs against any provider spec here — the normalizer has
+    // no provider registry, and (crucially) validity depends on the LIVE provider
+    // at resolve time. The runtime resolver (resolveDelegatedWorkerAutoApprove)
+    // checks the requested ID against provider.autoApproveModes.modes and falls
+    // back to the provider's own default when the ID is unknown. This keeps the
+    // config fail-closed: a stale/typo'd mode ID never coerces into a dangerous
+    // mode, it just means "no repo override → provider default".
+    if (parsed.providerDefaults !== undefined) {
+        if (isRecord(parsed.providerDefaults)) {
+            const pd: RepoMeshDeclarativeProviderDefaults = {};
+            const rawModes = (parsed.providerDefaults as Record<string, unknown>).autoApproveModes;
+            if (rawModes !== undefined) {
+                if (isRecord(rawModes)) {
+                    const modes: Record<string, string> = {};
+                    for (const [providerType, modeId] of Object.entries(rawModes)) {
+                        const type = typeof providerType === 'string' ? providerType.trim() : '';
+                        const id = typeof modeId === 'string' ? modeId.trim() : '';
+                        if (type && id) modes[type] = id;
+                    }
+                    if (Object.keys(modes).length) pd.autoApproveModes = modes;
+                } else {
+                    errors.push('providerDefaults.autoApproveModes must be an object when provided');
+                }
+            }
+            if (Object.keys(pd).length) config.providerDefaults = pd;
+        } else {
+            errors.push('providerDefaults must be an object when provided');
+        }
+    }
+
     return { valid: true, config, errors };
 }
 
@@ -364,6 +437,21 @@ export function applyRepoMeshConfig<T extends Pick<LocalMeshEntry, 'coordinator'
  * exported — it is machine-local only and has no place in mesh.json. Operating
  * notes are intentionally NOT exported either: those are runtime ledger lessons,
  * and a repo should declare baseline notes deliberately.
+ *
+ * `providerDefaults` is NOT auto-exported from the machine-local mesh (there is no
+ * machine-local source for it — it is a repo-authored declaration). To help an
+ * operator hand-author it, the scaffold carries a commented example shape:
+ *
+ *   "providerDefaults": {
+ *     "autoApproveModes": {
+ *       "claude-cli": "accept-edits",   // requested mode WHEN auto-approve is on
+ *       "codex-cli": "auto"             // (enable/dangerous opt-in stays machine-local)
+ *     }
+ *   }
+ *
+ * The example is surfaced via the scaffold's `_providerDefaultsExample` hint (JSON
+ * has no comments) rather than a live `providerDefaults` value, so serializing the
+ * scaffold never writes an unwanted requested-mode map into the repo file.
  */
 export function buildMeshJsonConfigScaffold(
     mesh: Pick<LocalMeshEntry, 'coordinator'>,
@@ -378,6 +466,21 @@ export function buildMeshJsonConfigScaffold(
     return scaffold;
 }
 
+/**
+ * A copy-paste example of the `providerDefaults` zone for operators hand-authoring
+ * a repo `.adhdev/mesh.json`. Returned by the export/write commands as a separate
+ * hint field (never merged into the serialized scaffold) so the repo file stays
+ * clean. The mode IDs shown are illustrative — a repo should use IDs that exist in
+ * its own providers' specs; an unknown ID is ignored at resolve time and the
+ * provider's own default is used.
+ */
+export const MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE: RepoMeshDeclarativeProviderDefaults = {
+    autoApproveModes: {
+        'claude-cli': 'accept-edits',
+        'codex-cli': 'auto',
+    },
+};
+
 /** Serialize a scaffold to the canonical 2-space JSON draft text. */
 export function serializeMeshJsonConfigScaffold(config: RepoMeshDeclarativeConfig): string {
     return JSON.stringify(config, null, 2);

package/src/index.ts

@@ -143,6 +143,8 @@ export type {
 export {
   DEFAULT_MESH_POLICY,
   resolveDelegatedWorkerAutoApprove,
+  delegatedWorkerAutoApproveSettings,
+  resolveDelegatedWorkerDangerousModeAllow,
   resolveAllowSendKeysDestructive,
   resolveMagiSessionCleanupMode,
   magiAutoLaunchedSessionCleanupDecision,
@@ -161,6 +163,24 @@ export {
   resolveAutoConvergeCodeChange,
 } from './repo-mesh-types.js';
 
+// ── Repo-shared declarative mesh config (.adhdev/mesh.json) ──
+export {
+  loadRepoMeshJsonConfig,
+  normalizeRepoMeshDeclarativeConfig,
+  buildMeshJsonConfigScaffold,
+  serializeMeshJsonConfigScaffold,
+  MESH_JSON_CONFIG_LOCATIONS,
+  MESH_JSON_CONFIG_SCHEMA,
+  MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE,
+} from './config/mesh-json-config.js';
+export type {
+  RepoMeshDeclarativeConfig,
+  RepoMeshDeclarativeCoordinatorConfig,
+  RepoMeshDeclarativeLimits,
+  RepoMeshDeclarativeProviderDefaults,
+  RepoMeshJsonConfigLoadResult,
+} from './config/mesh-json-config.js';
+
 // ── Git Surface ──
 export * from './git/index.js';
 
@@ -489,7 +509,7 @@ export { ProviderInstanceManager } from './providers/provider-instance-manager.j
 export { IdeProviderInstance } from './providers/ide-provider-instance.js';
 export { CliProviderInstance } from './providers/cli-provider-instance.js';
 export { AcpProviderInstance } from './providers/acp-provider-instance.js';
-export type { ProviderModule, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
+export type { ProviderModule, AutoApproveMode, AutoApproveModesConfig, AutoApproveModeRisk, AutoApproveModeStrategy, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
 export type { ProviderSourceConfigSnapshot, ProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { parseProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { normalizeInputEnvelope, normalizeMessageParts, flattenMessageParts } from './providers/io-contracts.js';