@adhdev/daemon-core 1.0.18-rc.2 → 1.0.18-rc.20

package/dist/cli-adapters/cli-state-engine.d.ts

@@ -59,6 +59,17 @@ export interface CliStateEngineCallbacks {
      */
     isInApprovalResumeGrace?(): boolean;
 }
+/**
+ * Minimal shape computeApprovalContentSignature / isStaleResolvedApproval
+ * actually need — deliberately narrower than the full CliBufferSnapshot so
+ * callers outside the settled-eval loop (e.g. the adapter's startup-gate
+ * modal parse in getStatus/getDebugState) can supply just these two fields
+ * without having to fabricate an entire snapshot.
+ */
+interface ApprovalSignatureSnapshot {
+    screenText?: string;
+    accumulatedBuffer?: string;
+}
 export declare class CliStateEngine {
     private readonly provider;
     private readonly runner;
@@ -76,6 +87,22 @@ export declare class CliStateEngine {
     } | null;
     lastApprovalResolvedAt: number;
     lastResolvedModalMessage: string;
+    /**
+     * Normalized approval-context signature captured at resolve time (see
+     * `computeApprovalContentSignature`) — the screen text with blank-line
+     * padding and any manifest-declared chrome (transcriptPty.chromePatterns,
+     * spinner.patterns) stripped out. Used by applyWaitingApproval's
+     * isStaleResolvedRepaint check to tell "the same already-answered modal,
+     * re-parsed from a screen that has not meaningfully changed" apart from
+     * "a genuinely new approval" — content-based, not time-based, because
+     * ordinary TUI chrome (status bar, context meter, blank-line repaint)
+     * keeps producing fresh PTY bytes on an otherwise-unchanged screen and
+     * defeats any output-timestamp discriminator within a few hundred ms.
+     * Cleared whenever a turn starts or the session tears down (see
+     * onTurnStarted / resetActiveTurnState / onPtyExit) so a next-turn
+     * approval is never compared against stale prior-turn state.
+     */
+    lastApprovalResolvedContentSignature: string;
     /**
      * Monotonic counter bumped every time the FSM *enters* waiting_approval
      * with a freshly captured modal (see `applyWaitingApproval`). It is the
@@ -243,6 +270,55 @@ export declare class CliStateEngine {
     finishResponse(): void;
     private scheduleIdleFinish;
     private cancelPendingIdleFinish;
+    /**
+     * Derive a stable approval-context signature from the current screen,
+     * with blank-line padding and any manifest-declared chrome stripped out.
+     *
+     * Generic by design — no kimi- or provider-specific hardcoding: it reads
+     * whatever `tui.transcriptPty.chromePatterns` and `tui.spinner.patterns`
+     * the ACTIVE provider's own manifest already declares (present on any
+     * declarative-TUI provider; simply absent/empty for scripted providers,
+     * in which case this degrades to blank-line stripping only — never worse
+     * than comparing the raw screen). Those pattern lists exist precisely to
+     * name "known volatile repaint noise" (status bar, context meter, spinner
+     * ticks, banners) — reusing them here means the SAME declared knowledge
+     * that governs transcript-chrome stripping also governs staleness
+     * detection, instead of re-encoding provider knowledge into daemon-core.
+     *
+     * Deliberately NOT a hash of the whole screen/buffer: an ordinary TUI
+     * repaints its footer/status/context-meter chrome continuously even while
+     * genuinely idle, so a raw whole-screen or whole-buffer fingerprint (or a
+     * mere "did any bytes arrive" timestamp) changes on every repaint tick
+     * regardless of whether anything approval-relevant actually happened.
+     * Stripping the declared chrome first yields a signature that only
+     * changes when the surrounding conversation/tool-output content itself
+     * changes — exactly the discriminator applyWaitingApproval's
+     * isStaleResolvedRepaint check needs.
+     */
+    private computeApprovalContentSignature;
+    /**
+     * True when `modal` is a stale re-parse of an already-resolved approval:
+     * same message text, and the chrome-stripped approval-context signature
+     * of `snap` is unchanged from the signature captured at resolve time.
+     *
+     * Public and reused verbatim by BOTH the settled-eval capture path
+     * (applyWaitingApproval, below) and any OUTSIDE re-parse the adapter
+     * performs independently of the settle loop — e.g. provider-cli-adapter's
+     * getStatus()/getDebugState() startup-gate modal detection, which reads
+     * `recentOutputBuffer` directly while `startupParseGate` is open and can
+     * re-surface the same already-resolved modal before the gate closes.
+     * Centralizing the discriminator here means there is exactly ONE
+     * definition of "stale" for the whole session — no divergent duplicate
+     * heuristic re-implemented per call site.
+     */
+    isStaleResolvedApproval(modal: {
+        message: string;
+        buttons: string[];
+    } | null, snap: ApprovalSignatureSnapshot): boolean;
+    /** Clear all resolve-time approval bookkeeping (message, timestamp, content
+     *  signature) — called at turn/session boundaries so a next-turn or
+     *  next-session approval is never compared against stale prior state. */
+    private clearApprovalResolutionMemory;
     /**
      * Schedule one more settled evaluation while pinned to `waiting_approval`
      * with no actionable modal. The settled FSM normally only re-runs on new
@@ -269,3 +345,4 @@ export declare class CliStateEngine {
     private parsedStatusHasFinalStandardAssistantMessage;
     private recordTrace;
 }
+export {};

package/dist/cli-adapters/provider-cli-shared.d.ts

@@ -270,6 +270,39 @@ export interface CliProviderModule {
     _resolvedScriptsSource?: string | null;
     _versionWarning?: string | null;
 }
+/**
+ * PURE-PTY TRANSCRIPT CLASS predicate (kimi and kin).
+ *
+ * A provider is "pure-PTY full-buffer" when it reconstructs its ENTIRE transcript
+ * from the rendered PTY buffer on every read and has NO alternate transcript
+ * source:
+ *   - transcriptAuthority !== 'provider'  (the daemon PTY parser owns the transcript,
+ *     not a provider-side canonical source)
+ *   - NO nativeHistory              (no on-disk / native-source history to fall back to)
+ *   - tui.transcriptPty.scope === 'buffer' (the parser walks the full rendered buffer)
+ *
+ * This class is invisible to two provider-authority-keyed code paths that other
+ * providers rely on for mesh completion semantics:
+ *   1. CliStateEngine.onTurnStarted only promotes to 'generating' for
+ *      transcriptAuthority==='provider' providers — so a pure-PTY session that
+ *      submits a prompt while already idle collapses idle→idle, the
+ *      generating→idle edge never occurs, and agent:generating_completed is never
+ *      emitted (the coordinator ledger leaves the task 'assigned' forever).
+ *   2. checkMeshWorkerStall's native-transcript completion reconcile is gated on
+ *      the native-source shape, so a finished pure-PTY worker's static idle is
+ *      misread as monitor:no_progress (a false task_stalled).
+ *
+ * The runtime capability, NOT any single spec field value, is authoritative: a
+ * given kimi manifest checkout may declare nativeHistory/transcriptAuthority, but
+ * the live-loaded pure-PTY session has none. Callers that only hold a
+ * CliProviderModule (the engine) share this exact predicate with the adapter
+ * (parsesFullPtyTranscriptFromBuffer) so the two never drift.
+ */
+export declare function isPurePtyTranscriptProvider(provider: {
+    transcriptAuthority?: 'provider' | 'daemon';
+    nativeHistory?: unknown;
+    tui?: Record<string, unknown>;
+} | null | undefined): boolean;
 /**
  * Stateful, transcript-oriented terminal cell accumulator.
  *

package/dist/cli-adapters/pty-transport.d.ts

@@ -39,7 +39,8 @@ export interface PtyRuntimeTransport {
     getMetadata?(): PtyRuntimeMetadata | null;
     onData(callback: (data: string) => void): void;
     onExit(callback: (info: {
-        exitCode: number;
+        exitCode: number | null;
+        signal?: number | null;
     }) => void): void;
 }
 export interface PtyTransportFactory {

package/dist/commands/cli-manager.d.ts

@@ -131,6 +131,15 @@ export declare function expandModelLaunchArgs(template: string[] | undefined, mo
  * thinking request without a template is a no-op). BRAIN-ROUTING thinking axis.
  */
 export declare function expandThinkingLaunchArgs(template: string[] | undefined, level: string | undefined, levelMap: Partial<Record<string, string>> | undefined): string[] | undefined;
+/**
+ * Apply a selected launch-args auto-approve mode without mutating provider metadata.
+ * removeArgs only targets provider-owned base spawn.args; launchArgs are prepended to
+ * per-launch args beside model/thinking args, making conflict removal order-independent.
+ */
+export declare function applyAutoApproveModeLaunchArgs(provider: ProviderModule | undefined, cliArgs: string[] | undefined, settings: Record<string, unknown> | undefined): {
+    provider: ProviderModule | undefined;
+    cliArgs: string[] | undefined;
+};
 export declare function supportsExplicitSessionResume(resume?: ProviderResumeCapability): boolean;
 export declare function resolveCliSessionBinding(provider: ProviderModule | undefined, normalizedType: string, cliArgs?: string[], requestedResumeSessionId?: string): CliSessionBinding;
 export declare class DaemonCliManager {

package/dist/commands/process-lifecycle.d.ts

@@ -0,0 +1,43 @@
+export interface ProcessLifecycleOptions {
+    platform?: NodeJS.Platform;
+    execFileSync?: typeof import('child_process').execFileSync;
+}
+export interface OwnedProcessInfo {
+    pid: number;
+    commandLine: string | null;
+}
+export declare function getProcessCommandLine(pid: number, options?: ProcessLifecycleOptions): string | null;
+/**
+ * Extract the script argument (the token after the node executable) from a
+ * command line. Handles both quoted and unquoted executables/scripts.
+ */
+export declare function parseNodeScriptPath(commandLine: string | null): string | null;
+export declare function killProcess(pid: number, options?: ProcessLifecycleOptions): boolean;
+export declare function waitForPidExit(pid: number, timeoutMs: number): Promise<boolean>;
+/**
+ * List Node processes whose command line places them under any of the supplied
+ * prefixes. Windows-only — the versioned-prefix lifecycle this supports does not
+ * exist on POSIX, so the helper is a no-op there.
+ */
+export declare function listOwnedNodeProcesses(options: {
+    prefixes: readonly string[];
+    excludePids?: readonly number[];
+    markers?: readonly string[];
+} & ProcessLifecycleOptions): OwnedProcessInfo[];
+export declare function stopOwnedProcesses(options: {
+    processes: readonly OwnedProcessInfo[];
+    waitMs?: number;
+} & ProcessLifecycleOptions): Promise<{
+    stopped: number;
+    survivors: OwnedProcessInfo[];
+}>;
+export declare function stopOwnedProcessesForPrefixes(options: {
+    prefixes: readonly string[];
+    excludePids?: readonly number[];
+    markers?: readonly string[];
+    waitMs?: number;
+    log?: (message: string) => void;
+} & ProcessLifecycleOptions): Promise<{
+    stopped: number;
+    survivors: OwnedProcessInfo[];
+}>;

package/dist/commands/upgrade-helper.d.ts

@@ -29,6 +29,7 @@ export declare function resolveCurrentGlobalInstallSurface(options: {
     currentCliPath?: string;
     nodeExecutable?: string;
     platform?: NodeJS.Platform;
+    homeDir?: string;
 }): CurrentGlobalInstallSurface;
 export declare function buildPinnedGlobalInstallCommand(options: {
     packageName: string;

package/dist/commands/windows-atomic-upgrade.d.ts

@@ -1,4 +1,6 @@
 import { type ChildProcess } from 'child_process';
+export declare const DEFAULT_HEALTH_TIMEOUT_MS = 120000;
+export declare const ADHDEV_OWNED_MARKERS: readonly ["session-host-daemon", "node_modules/adhdev", "node_modules/@adhdev/daemon-standalone"];
 export interface WindowsInstallerLayout {
     homeDir: string;
     installRoot: string;
@@ -13,7 +15,7 @@ export interface WindowsAtomicUpgradeHooks {
     restartOld: (portableNode: string) => void;
     waitForHealth: (pid: number, targetVersion: string) => Promise<boolean>;
     stopProcess: (pid: number) => void;
-    cleanup: (layout: WindowsInstallerLayout, activePrefix: string) => void;
+    cleanup: (layout: WindowsInstallerLayout, activePrefix: string) => void | Promise<void>;
     log: (message: string) => void;
 }
 export interface WindowsAtomicUpgradeOptions {
@@ -22,6 +24,8 @@ export interface WindowsAtomicUpgradeOptions {
     targetVersion: string;
     portableNode: string;
     hooks: WindowsAtomicUpgradeHooks;
+    /** PIDs that must never be terminated during prefix sweeps (helper + parent daemon). */
+    excludePids?: number[];
 }
 export interface WindowsAtomicUpgradeResult {
     stagedPrefix: string;
@@ -43,5 +47,17 @@ export declare function createDefaultWindowsAtomicHooks(options: {
     cwd: string;
     env: NodeJS.ProcessEnv;
     log: (message: string) => void;
+    /** Loopback IPC port to probe for health/version. Defaults to the daemon's local IPC port. */
+    healthPort?: number;
+    /** How long to poll for the replacement daemon to report the target version. */
+    healthTimeoutMs?: number;
 }): WindowsAtomicUpgradeHooks;
 export declare function boundedCleanupInactivePrefixes(layout: WindowsInstallerLayout, activePrefix: string, log: (message: string) => void): void;
+export declare function cleanupInactivePrefixesWithGuard(options: {
+    layout: WindowsInstallerLayout;
+    activePrefix: string;
+    excludePids?: number[];
+    markers?: readonly string[];
+    waitMs?: number;
+    log?: (message: string) => void;
+}): Promise<void>;

package/dist/config/mesh-json-config.d.ts

@@ -19,6 +19,18 @@
  * machine-local policy directly. The repo file shapes the coordinator prompt and
  * operating notes, nothing else.
  *
+ * `providerDefaults` IS NOT POLICY EITHER. It is a repo-shared DECLARATIVE
+ * "requested auto-approve mode" per providerType — the answer to "WHEN a delegated
+ * worker of type X is auto-approved, WHICH mode should it use by default". It has
+ * NO say over WHETHER auto-approve is enabled: the ENABLE decision (and the
+ * dangerous-mode opt-in) remains 100% machine-local (meshes.json /
+ * RepoMeshPolicy). A repo can declare `providerDefaults` freely; a machine that
+ * has delegatedWorkerAutoApprove=false still gets no auto-approve, and a dangerous
+ * requested mode is still downgraded to PTY parsing unless the machine opts in.
+ * The requested mode ID is validated at runtime against the provider spec — an
+ * unknown mode ID is IGNORED (fall back to the provider's own default), never
+ * silently coerced into a dangerous mode.
+ *
  * The coordinator/operatingNotes merge is **in-memory only**: the on-disk
  * machine-local `meshes.json` is never mutated by this module.
  *
@@ -48,6 +60,18 @@ export interface RepoMeshDeclarativeLimits {
     /** Advisory only in v1 — recorded but never enforced. */
     maxNotes?: number;
 }
+/**
+ * Repo-shared declarative per-provider defaults. NOT policy — see the file header.
+ * `autoApproveModes` maps a providerType (e.g. "claude-cli") to the auto-approve
+ * mode ID that a delegated worker of that type should REQUEST when it is
+ * auto-approved. The map only influences WHICH mode is used, never WHETHER
+ * auto-approve is enabled (that stays machine-local). Mode IDs are validated
+ * against the live provider spec at resolve time; an unknown ID is ignored.
+ */
+export interface RepoMeshDeclarativeProviderDefaults {
+    /** providerType → requested auto-approve mode ID. */
+    autoApproveModes?: Record<string, string>;
+}
 /**
  * Parsed + normalized `.adhdev/mesh.json` shape. Every field is optional except
  * version so a repo can declare only the zone(s) it cares about. Policy is NOT a
@@ -58,6 +82,8 @@ export interface RepoMeshDeclarativeConfig {
     coordinator?: RepoMeshDeclarativeCoordinatorConfig;
     operatingNotes?: CoordinatorOperatingNote[];
     limits?: RepoMeshDeclarativeLimits;
+    /** Repo-shared per-provider defaults (requested auto-approve mode). NOT policy. */
+    providerDefaults?: RepoMeshDeclarativeProviderDefaults;
 }
 export interface RepoMeshJsonConfigLoadResult {
     config?: RepoMeshDeclarativeConfig;
@@ -133,6 +159,18 @@ export declare const MESH_JSON_CONFIG_SCHEMA: {
                 };
             };
         };
+        readonly providerDefaults: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly autoApproveModes: {
+                    readonly type: "object";
+                    readonly additionalProperties: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
     };
 };
 /**
@@ -193,7 +231,31 @@ export declare function applyRepoMeshConfig<T extends Pick<LocalMeshEntry, 'coor
  * exported — it is machine-local only and has no place in mesh.json. Operating
  * notes are intentionally NOT exported either: those are runtime ledger lessons,
  * and a repo should declare baseline notes deliberately.
+ *
+ * `providerDefaults` is NOT auto-exported from the machine-local mesh (there is no
+ * machine-local source for it — it is a repo-authored declaration). To help an
+ * operator hand-author it, the scaffold carries a commented example shape:
+ *
+ *   "providerDefaults": {
+ *     "autoApproveModes": {
+ *       "claude-cli": "accept-edits",   // requested mode WHEN auto-approve is on
+ *       "codex-cli": "auto"             // (enable/dangerous opt-in stays machine-local)
+ *     }
+ *   }
+ *
+ * The example is surfaced via the scaffold's `_providerDefaultsExample` hint (JSON
+ * has no comments) rather than a live `providerDefaults` value, so serializing the
+ * scaffold never writes an unwanted requested-mode map into the repo file.
  */
 export declare function buildMeshJsonConfigScaffold(mesh: Pick<LocalMeshEntry, 'coordinator'>): RepoMeshDeclarativeConfig;
+/**
+ * A copy-paste example of the `providerDefaults` zone for operators hand-authoring
+ * a repo `.adhdev/mesh.json`. Returned by the export/write commands as a separate
+ * hint field (never merged into the serialized scaffold) so the repo file stays
+ * clean. The mode IDs shown are illustrative — a repo should use IDs that exist in
+ * its own providers' specs; an unknown ID is ignored at resolve time and the
+ * provider's own default is used.
+ */
+export declare const MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE: RepoMeshDeclarativeProviderDefaults;
 /** Serialize a scaffold to the canonical 2-space JSON draft text. */
 export declare function serializeMeshJsonConfigScaffold(config: RepoMeshDeclarativeConfig): string;

package/dist/index.d.ts

@@ -8,7 +8,9 @@ export type { SessionEntry, CompactSessionEntry, CompactDaemonEntry, CloudDaemon
 export type { InteractivePrompt, InteractiveQuestion, InteractiveOption, InteractivePromptResponse, InteractiveAnswer, } from './providers/types/interactive-prompt.js';
 export { normalizeInteractivePrompt, normalizeInteractivePromptResponse, buildClaudeInteractiveToolResult, interactivePromptFromClaudeAskUserQuestion, detectClaudeAskUserQuestionPromptFromJson, } from './providers/types/interactive-prompt.js';
 export type { RepoMesh, RepoMeshDaemonRole, RepoMeshHostMetadata, RepoMeshHostPairingMetadata, RepoMeshHostStatus, RepoMeshNode, RepoMeshNodeHealth, RepoMeshPolicy, RepoMeshMagiSessionCleanupMode, RepoMeshNodePolicy, RepoMeshRelatedRepo, RepoMeshNodeCapabilities, DetectedCommand, ProjectContextSnapshot, ProjectContextSource, RepoMeshCoordinatorConfig, LocalMeshConfig, LocalMeshEntry, LocalMeshNodeEntry, RepoMeshStatus, RepoMeshNodeStatus, RepoMeshPeerConnectionStatus, RepoMeshPeerConnectionState, RepoMeshPeerConnectionTransport, RepoMeshSessionStatus, RepoMeshQueueTask, RepoMeshQueueTaskStatus, RepoMeshQueueSummary, RepoMeshQueueStatus, RepoMeshLedgerEntryStatus, RepoMeshLedgerSummaryStatus, RepoMeshLedgerStatus, MeshAsyncJobLifecycle, RepoMeshSchedulingStrategy, RepoMeshSchedulingStatus, RepoMeshNodeSchedulingStatus, RepoMeshNodeProviderSchedulingStatus, } from './repo-mesh-types.js';
-export { DEFAULT_MESH_POLICY, resolveDelegatedWorkerAutoApprove, resolveAllowSendKeysDestructive, resolveMagiSessionCleanupMode, magiAutoLaunchedSessionCleanupDecision, MESH_SCHEDULING_STRATEGIES, DEFAULT_MESH_SCHEDULING_STRATEGY, normalizeMeshSchedulingStrategy, resolveNodeSchedulingPriority, resolveProviderMaxParallel, mergeAndNormalizePolicy, normalizeAutoFastForwardPolicy, resolveMaxParallelTasks, MESH_MAX_PARALLEL_TASKS_MIN, MESH_MAX_PARALLEL_TASKS_MAX, MESH_CONVERGE_REFINE_TAG, MESH_CONVERGE_FAST_FORWARD_TAG, resolveAutoConvergeCodeChange, } from './repo-mesh-types.js';
+export { DEFAULT_MESH_POLICY, resolveDelegatedWorkerAutoApprove, delegatedWorkerAutoApproveSettings, resolveDelegatedWorkerDangerousModeAllow, resolveAllowSendKeysDestructive, resolveMagiSessionCleanupMode, magiAutoLaunchedSessionCleanupDecision, MESH_SCHEDULING_STRATEGIES, DEFAULT_MESH_SCHEDULING_STRATEGY, normalizeMeshSchedulingStrategy, resolveNodeSchedulingPriority, resolveProviderMaxParallel, mergeAndNormalizePolicy, normalizeAutoFastForwardPolicy, resolveMaxParallelTasks, MESH_MAX_PARALLEL_TASKS_MIN, MESH_MAX_PARALLEL_TASKS_MAX, MESH_CONVERGE_REFINE_TAG, MESH_CONVERGE_FAST_FORWARD_TAG, resolveAutoConvergeCodeChange, } from './repo-mesh-types.js';
+export { loadRepoMeshJsonConfig, normalizeRepoMeshDeclarativeConfig, buildMeshJsonConfigScaffold, serializeMeshJsonConfigScaffold, MESH_JSON_CONFIG_LOCATIONS, MESH_JSON_CONFIG_SCHEMA, MESH_JSON_PROVIDER_DEFAULTS_EXAMPLE, } from './config/mesh-json-config.js';
+export type { RepoMeshDeclarativeConfig, RepoMeshDeclarativeCoordinatorConfig, RepoMeshDeclarativeLimits, RepoMeshDeclarativeProviderDefaults, RepoMeshJsonConfigLoadResult, } from './config/mesh-json-config.js';
 export * from './git/index.js';
 import type { RuntimeWriteOwner as _RuntimeWriteOwner } from './shared-types-extra.js';
 import type { RuntimeAttachedClient as _RuntimeAttachedClient } from './shared-types-extra.js';
@@ -137,7 +139,7 @@ export { ProviderInstanceManager } from './providers/provider-instance-manager.j
 export { IdeProviderInstance } from './providers/ide-provider-instance.js';
 export { CliProviderInstance } from './providers/cli-provider-instance.js';
 export { AcpProviderInstance } from './providers/acp-provider-instance.js';
-export type { ProviderModule, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
+export type { ProviderModule, AutoApproveMode, AutoApproveModesConfig, AutoApproveModeRisk, AutoApproveModeStrategy, CdpTargetFilter, ProviderResumeCapability, InputEnvelope, InputPart, MessagePart, ReadChatTurnStatus, ControlListResult, ControlSetResult, ControlInvokeResult } from './providers/contracts.js';
 export type { ProviderSourceConfigSnapshot, ProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { parseProviderSourceConfigUpdate } from './config/provider-source-config.js';
 export { normalizeInputEnvelope, normalizeMessageParts, flattenMessageParts } from './providers/io-contracts.js';