@adhdev/daemon-core 1.0.18-rc.16 → 1.0.18-rc.18

package/src/repo-mesh-types.ts

@@ -15,6 +15,11 @@ import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
 import type { MagiKindPanelMap, DifficultyBrainMap, NodeCapabilitySlot } from '@adhdev/mesh-shared';
+import type { ProviderModule } from './providers/contracts.js';
+import { deriveAutoApproveModeRisk } from './providers/auto-approve-modes.js';
+// Type-only import (no runtime cycle) — mesh-json-config imports types from this
+// module, and this direction is `import type` so tsc erases it at emit.
+import type { RepoMeshDeclarativeConfig } from './config/mesh-json-config.js';
 
 // ─── Core Mesh Types ────────────────────────────
 
@@ -350,6 +355,8 @@ export interface RepoMeshPolicy {
      * A node policy may override this per-node (RepoMeshNodePolicy.delegatedWorkerAutoApprove).
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Explicit opt-in required before delegated workers may use a dangerous provider mode. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): opt-in to allow the coordinator to inject
      * DESTRUCTIVE keys (CTRL_C / ESC) into a worker PTY via mesh_send_keys. These
@@ -505,6 +512,8 @@ export interface RepoMeshNodePolicy {
      * precedence over the mesh-level policy for worker sessions launched onto this node.
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Per-node override for dangerous delegated worker mode authorization. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): per-node override for
      * RepoMeshPolicy.allowSendKeysDestructive.
@@ -550,6 +559,7 @@ export const DEFAULT_MESH_POLICY: RepoMeshPolicy = {
     // any specific session manually; that override is preserved per-device.
     spawnedSessionVisibility: 'hidden',
     delegatedWorkerAutoApprove: true,
+    delegatedWorkerDangerousModeAllow: false,
     sessionCleanupOnNodeRemove: 'preserve',
     // MAGI auto-launches a worker session per pinned replica target with no idle
     // session; those stay idle-LIVE after their turn. Default ON (stop_and_delete)
@@ -776,6 +786,13 @@ export function mergeAndNormalizePolicy(
     } else {
         delete policy.autoConvergeCodeChange;
     }
+    // Dangerous delegated-worker provider modes are fail-closed and only persist
+    // when the mesh owner has explicitly opted in.
+    if (policy.delegatedWorkerDangerousModeAllow === true) {
+        policy.delegatedWorkerDangerousModeAllow = true;
+    } else {
+        delete policy.delegatedWorkerDangerousModeAllow;
+    }
     // Coordinator idle-push policy: strict opt-in. Only persist the explicit
     // 'auto_silent_on_dispatch' value; any other/invalid value normalizes to the
     // 'always' default and is dropped so existing meshes.json stays byte-for-byte
@@ -789,23 +806,106 @@ export function mergeAndNormalizePolicy(
 }
 
 /**
- * Resolve whether a delegated worker session launched onto `nodePolicy` (within a mesh
- * governed by `meshPolicy`) should auto-approve. Precedence: node override → mesh policy
- * → default true. The result is stamped into the worker launch settings envelope as
- * `autoApprove`; it wins over the global per-provider-type autoApprove config because the
- * launch path merges the envelope as a settingsOverride on top of the provider defaults.
+ * Resolve delegated worker auto-approve. Legacy providers return a boolean. Providers
+ * with modes return a mode id, except a dangerous mode is downgraded to a
+ * non-dangerous PTY mode unless mesh/node policy explicitly opts in.
+ *
+ * THREE EXPLICIT STAGES — do not collapse them; the ordering is a hard MAGI
+ * invariant:
+ *
+ *   ① ENABLE gate (machine-local policy only): node boolean > mesh boolean.
+ *      `enabled=false` returns `false` IMMEDIATELY, BEFORE any mode selection.
+ *      The repo `mesh.json` providerDefaults has ZERO influence here — a
+ *      node/mesh opt-out is never overridden by a repo-declared requested mode.
+ *
+ *   ② MODE selection (only when enabled === true):
+ *        task override [FUTURE — param reserved below, not yet wired] >
+ *        repo mesh.json providerDefaults.autoApproveModes[providerType] >
+ *        provider spec autoApproveModes.default.
+ *      A repo-requested mode ID is adopted ONLY when it exists in the provider's
+ *      own `autoApproveModes.modes`; an unknown/stale/typo'd ID is IGNORED and we
+ *      fall back to the provider default (fail-closed: never coerce into a
+ *      dangerous mode via a bad ID).
+ *
+ *   ③ DANGEROUS gate: whichever mode stage ② picked, if it is dangerous and the
+ *      machine-local delegatedWorkerDangerousModeAllow is not set, downgrade to a
+ *      non-dangerous PTY-parse mode (or `false` if none exists).
  */
 export function resolveDelegatedWorkerAutoApprove(
-    meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove'> | null,
-    nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove'> | null,
-): boolean {
+    meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null,
+    nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null,
+    provider?: Pick<ProviderModule, 'autoApproveModes'> | null,
+    repoConfig?: RepoMeshDeclarativeConfig | null,
+    // providerType is needed to look up the repo-declared requested mode; it is
+    // separate from `provider` because the caller resolves the spec independently.
+    providerType?: string | null,
+): boolean | string {
+    // ── ① ENABLE gate — machine-local only. false short-circuits before mode. ──
+    let enabled = true;
     if (typeof nodePolicy?.delegatedWorkerAutoApprove === 'boolean') {
-        return nodePolicy.delegatedWorkerAutoApprove;
+        enabled = nodePolicy.delegatedWorkerAutoApprove;
+    } else if (typeof meshPolicy?.delegatedWorkerAutoApprove === 'boolean') {
+        enabled = meshPolicy.delegatedWorkerAutoApprove;
     }
-    if (typeof meshPolicy?.delegatedWorkerAutoApprove === 'boolean') {
-        return meshPolicy.delegatedWorkerAutoApprove;
+    if (!enabled) return false;
+
+    const modes = provider?.autoApproveModes;
+    if (!modes) return true;
+
+    // ── ② MODE selection (enabled only). Repo providerDefaults MAY override the
+    //     provider spec default here — but only with a mode ID the spec knows. ──
+    // Future: a per-task override would slot in ahead of the repo default; the
+    // signature reserves that precedence but no task override is wired yet.
+    const requestedModeRaw = typeof providerType === 'string'
+        ? repoConfig?.providerDefaults?.autoApproveModes?.[providerType.trim()]
+        : undefined;
+    const requestedModeId = typeof requestedModeRaw === 'string' && requestedModeRaw.trim()
+        ? requestedModeRaw.trim()
+        : '';
+    const requestedMode = requestedModeId
+        ? modes.modes.find((mode) => mode.id === requestedModeId)
+        : undefined;
+    const selectedMode = requestedMode
+        ?? modes.modes.find((mode) => mode.id === modes.default);
+    if (!selectedMode || selectedMode.strategy === 'post-boot-command') return false;
+
+    // ── ③ DANGEROUS gate — downgrade a dangerous selection without machine opt-in. ──
+    const dangerousAllowed = resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy);
+    if (deriveAutoApproveModeRisk(selectedMode) === 'dangerous' && !dangerousAllowed) {
+        const ptyFallback = modes.modes.find((mode) =>
+            mode.strategy === 'pty-parse-default' && deriveAutoApproveModeRisk(mode) !== 'dangerous');
+        return ptyFallback?.id || false;
     }
-    return true;
+    return selectedMode.id;
+}
+
+export function resolveDelegatedWorkerDangerousModeAllow(
+    meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerDangerousModeAllow'> | null,
+    nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerDangerousModeAllow'> | null,
+): boolean {
+    if (typeof nodePolicy?.delegatedWorkerDangerousModeAllow === 'boolean') {
+        return nodePolicy.delegatedWorkerDangerousModeAllow;
+    }
+    return meshPolicy?.delegatedWorkerDangerousModeAllow === true;
+}
+
+/** Shape a boolean-or-mode resolution for the settings precedence contract. */
+export function delegatedWorkerAutoApproveSettings(
+    meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null,
+    nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null,
+    provider?: Pick<ProviderModule, 'autoApproveModes'> | null,
+    repoConfig?: RepoMeshDeclarativeConfig | null,
+    providerType?: string | null,
+): {
+    autoApprove: boolean | undefined;
+    autoApproveMode: string | undefined;
+    delegatedWorkerDangerousModeAllow: boolean;
+} {
+    const resolved = resolveDelegatedWorkerAutoApprove(meshPolicy, nodePolicy, provider, repoConfig, providerType);
+    const delegatedWorkerDangerousModeAllow = resolveDelegatedWorkerDangerousModeAllow(meshPolicy, nodePolicy);
+    return typeof resolved === 'string'
+        ? { autoApprove: undefined, autoApproveMode: resolved, delegatedWorkerDangerousModeAllow }
+        : { autoApprove: resolved, autoApproveMode: undefined, delegatedWorkerDangerousModeAllow };
 }
 
 /**

package/src/shared-types.ts

@@ -52,7 +52,7 @@ export type { ProviderErrorReason } from './providers/provider-instance.js';
 // Local import for use in Managed*Entry types below
 import type { ActiveChatData as _ActiveChatData, ProviderErrorReason as _ProviderErrorReason } from './providers/provider-instance.js';
 import type { WorkspaceEntry } from './config/workspaces.js';
-import type { ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
+import type { AutoApproveModesConfig, ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
 import type {
     GitCompactSummary,
     GitDiffSummary,
@@ -563,6 +563,8 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
+    /** Provider-declared auto-approve choices shown by session launch UIs. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** BRAIN-ROUTING: suggested model values for the new-session model dropdown. */
     modelOptions?: string[];
     /** BRAIN-ROUTING: reasoning-effort values for the new-session thinking dropdown. */

package/src/status/snapshot.ts

@@ -145,6 +145,7 @@ export function buildAvailableProviders(
         lastDetection?: AvailableProviderInfo['lastDetection'];
         lastVerification?: AvailableProviderInfo['lastVerification'];
         meshCoordinator?: AvailableProviderInfo['meshCoordinator'];
+        autoApproveModes?: AvailableProviderInfo['autoApproveModes'];
         _sourceTrust?: AvailableProviderInfo['trust'];
         _sourceLayer?: AvailableProviderInfo['sourceLayer'];
         _sourceName?: string | null;
@@ -183,6 +184,7 @@ export function buildAvailableProviders(
             ...(provider.lastDetection !== undefined ? { lastDetection: provider.lastDetection } : {}),
             ...(provider.lastVerification !== undefined ? { lastVerification: provider.lastVerification } : {}),
             ...(provider.meshCoordinator !== undefined ? { meshCoordinator: provider.meshCoordinator } : {}),
+            ...(provider.autoApproveModes !== undefined ? { autoApproveModes: provider.autoApproveModes } : {}),
             ...(trust ? {
                 trust,
                 trustDescription: describeTrust(trust),