@adhdev/daemon-core 1.0.18-rc.2 → 1.0.18-rc.20

package/src/providers/auto-approve-modes.ts

@@ -0,0 +1,103 @@
+import type {
+  AutoApproveMode,
+  AutoApproveModeRisk,
+  AutoApproveModeStrategy,
+  ProviderModule,
+} from './contracts.js';
+
+const KNOWN_DANGEROUS_LAUNCH_ARGS = new Set([
+  '--dangerously-skip-permissions',
+  '--dangerously-bypass-approvals-and-sandbox',
+  'bypassPermissions',
+  'sandbox_mode=danger-full-access',
+  'approval_policy=never',
+]);
+
+export interface ResolvedAutoApproveMode {
+  active: boolean;
+  strategy: AutoApproveModeStrategy;
+  modeId: string;
+}
+
+function isKnownDangerousLaunchArg(arg: string): boolean {
+  const normalized = arg.trim();
+  if (KNOWN_DANGEROUS_LAUNCH_ARGS.has(normalized)) return true;
+  return normalized.startsWith('--dangerously-skip-permissions=')
+    || normalized.startsWith('--dangerously-bypass-approvals-and-sandbox=');
+}
+
+/** Runtime defense-in-depth for provider definitions that bypass schema validation. */
+export function deriveAutoApproveModeRisk(mode: Pick<AutoApproveMode, 'risk' | 'launchArgs'>): AutoApproveModeRisk {
+  return Array.isArray(mode.launchArgs) && mode.launchArgs.some(isKnownDangerousLaunchArg)
+    ? 'dangerous'
+    : mode.risk;
+}
+
+function inactiveMode(modeId = ''): ResolvedAutoApproveMode {
+  return { active: false, strategy: 'pty-parse-default', modeId };
+}
+
+function resolveConfiguredMode(
+  provider: ProviderModule,
+  mode: AutoApproveMode,
+  settings: Record<string, unknown> | undefined,
+): ResolvedAutoApproveMode {
+  if (mode.strategy === 'post-boot-command') return inactiveMode(mode.id);
+  if (settings?.launchedByCoordinator === true
+      && settings.delegatedWorkerDangerousModeAllow !== true
+      && deriveAutoApproveModeRisk(mode) === 'dangerous') {
+    const fallback = provider.autoApproveModes?.modes.find((candidate) =>
+      candidate.strategy === 'pty-parse-default'
+      && deriveAutoApproveModeRisk(candidate) !== 'dangerous');
+    return fallback
+      ? { active: true, strategy: fallback.strategy, modeId: fallback.id }
+      : inactiveMode(mode.id);
+  }
+  return { active: true, strategy: mode.strategy, modeId: mode.id };
+}
+
+/**
+ * Resolve new mode settings before the legacy boolean. A stale/unknown explicit
+ * mode id fails closed instead of falling through to an enabled legacy setting.
+ */
+export function resolveProviderAutoApproveMode(
+  provider: ProviderModule | null | undefined,
+  settings: Record<string, unknown> | undefined,
+): ResolvedAutoApproveMode {
+  // No provider (e.g. an instance whose module isn't set when a modal-park /
+  // auto-approve classification runs) ⇒ auto-approve is inactive. this.provider is
+  // genuinely nullable at runtime (the instance reads this.provider?.nativeHistory
+  // elsewhere), and the sibling helper findProviderAutoApproveMode already guards
+  // with provider?.autoApproveModes. Guard the entry so every caller is safe.
+  if (!provider) return inactiveMode();
+  const config = provider.autoApproveModes;
+  const explicitModeId = settings?.autoApproveMode;
+  if (typeof explicitModeId === 'string') {
+    const mode = config?.modes.find((candidate) => candidate.id === explicitModeId);
+    if (!mode) return inactiveMode(explicitModeId);
+    return resolveConfiguredMode(provider, mode, settings);
+  }
+
+  const explicitLegacy = settings?.autoApprove;
+  const providerLegacyDefault = provider.settings?.autoApprove?.default;
+  const legacyActive = typeof explicitLegacy === 'boolean'
+    ? explicitLegacy
+    : typeof providerLegacyDefault === 'boolean'
+      ? providerLegacyDefault
+      : false;
+  if (!legacyActive) return inactiveMode();
+
+  if (!config) {
+    return { active: true, strategy: 'pty-parse-default', modeId: 'legacy' };
+  }
+  const defaultMode = config.modes.find((mode) => mode.id === config.default);
+  if (!defaultMode) return inactiveMode(config.default);
+  return resolveConfiguredMode(provider, defaultMode, settings);
+}
+
+export function findProviderAutoApproveMode(
+  provider: ProviderModule | undefined,
+  modeId: string,
+): AutoApproveMode | undefined {
+  return provider?.autoApproveModes?.modes.find((mode) => mode.id === modeId);
+}

package/src/providers/chat-message-normalization.ts

@@ -156,6 +156,59 @@ export function selectFinalAssistantTurnEndMessage(
   return null;
 }
 
+/**
+ * EARLY-IDLE-COMPLETION-FALSE-POSITIVE — trailing tool/terminal activity detector.
+ *
+ * True when the transcript's LAST non-empty user-facing assistant bubble is followed
+ * by one or more TOOL / TERMINAL activity bubbles (a tool_use/command the assistant
+ * fired AFTER its text) — i.e. the assistant emitted a preamble ("Let me explore…"),
+ * then started running Read/Grep, so the turn is still executing and its answer has
+ * not landed. Callers that would otherwise promote that preamble to a turn-end summary
+ * off a momentary (startup-grace / inter-tool) idle read use this as a veto.
+ *
+ * Deliberately NARROW so the pure-PTY completion rescue is preserved:
+ *   - Only TOOL/TERMINAL activity trailing the assistant vetoes. A trailing THOUGHT or
+ *     status bubble does NOT (a finished turn can end on an internal thought), matching
+ *     selectFinalAssistantTurnEndMessage's skip set minus the "still-working" signals.
+ *   - A genuinely FINISHED worker (final assistant last, no trailing tool activity —
+ *     the kimi pure-PTY continuous-idle shape) returns false, so its early completion
+ *     is untouched.
+ *
+ * Returns false when there is no final assistant bubble at all (the caller's
+ * selectFinalAssistantTurnEndMessage already handles that as "not a turn end").
+ */
+export function hasTrailingToolActivityAfterFinalAssistant(
+  messages: ChatMessage[] | null | undefined,
+): boolean {
+  if (!Array.isArray(messages) || messages.length === 0) return false;
+  let sawTrailingToolActivity = false;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const msg = messages[i];
+    if (!msg) continue;
+    const classification = classifyChatMessageVisibility(msg);
+    // A trailing user-facing assistant/model bubble with real text ends the scan:
+    // whether we saw a tool AFTER it is the verdict.
+    if (classification.isUserFacing && (msg.role === 'assistant' || msg.role === 'model')) {
+      if (flattenContent(msg.content).trim()) return sawTrailingToolActivity;
+      // Empty streaming assistant bubble — keep scanning back past it, same as
+      // selectFinalAssistantTurnEndMessage (which returns null here); an empty tail
+      // isn't a turn end, so there is nothing to veto.
+      return false;
+    }
+    if (classification.isUserFacing) {
+      // A trailing user bubble (freshly dispatched task, no reply) → no assistant
+      // turn end below it to veto.
+      return false;
+    }
+    // Non-user-facing activity/internal bubble sitting AFTER the (not-yet-seen)
+    // assistant bubble. Only tool/terminal activity signals an in-flight turn.
+    if (classification.kind === 'tool' || classification.kind === 'terminal') {
+      sawTrailingToolActivity = true;
+    }
+  }
+  return false;
+}
+
 export const BUILTIN_CHAT_MESSAGE_KINDS = ['standard', 'thought', 'tool', 'terminal', 'system'] as const;
 
 export type BuiltinChatMessageKind = typeof BUILTIN_CHAT_MESSAGE_KINDS[number];

package/src/providers/cli-provider-instance-types.ts

@@ -66,6 +66,15 @@ export type CompletedFinalizationBlock = {
     // preamble summary (evidenceLevel=insufficient) into the append-only ledger before the
     // worker's next approval turn resumes. Independent of valley length.
     holdForTranscript?: boolean;
+    // (CANON-C EARLY-EMIT FLOOR) Set on a missing_final_assistant block whose provider has NO
+    // external transcript source to trail — a PTY-parsed provider (codex-cli) or one that merely
+    // requires a final assistant before idle. For those the CANON-C decoupled-immediate emit is a
+    // pure timing guess (no separate transcript will land to upgrade it), so it must observe the
+    // CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS floor rather than fire at the ~13s first-poll
+    // waitedMs. A native-source block (claude-cli external-native, where the transcript legitimately
+    // trails the idle transition by a write) deliberately does NOT set this — its immediate emit is
+    // correct and is upgraded by the transcript reconcile.
+    noExternalTranscriptSource?: boolean;
 };
 
 export type CompletionFinalAssistantEvidence = {
@@ -87,6 +96,25 @@ export type ExternalTranscriptProbe = {
 
 export const COMPLETED_FINALIZATION_RETRY_MS = 1000;
 export const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30_000;
+// (CANON-C EARLY-EMIT FLOOR) Minimum elapsed time before the CANON-C transcript-evidence
+// gate (allowTimeout blocks) may fire its decoupled-immediate completion for a block that
+// has NO final-assistant evidence (missing_final_assistant, finalAssistantPresent=false).
+//
+// CANON-C deliberately decouples the idle NOTIFICATION from the transcript's final-assistant
+// turn: for a native-source worker whose transcript write merely trails the idle transition,
+// emitting immediately (weak, later upgraded) is correct. But the SAME allowTimeout path also
+// carries codex/antigravity PLAIN terminal blocks whose on-screen "final" assistant never
+// landed — there the immediate emit fires at whatever tiny waitedMs the first completion-gate
+// poll observed (~13s live), stamping evidenceLevel=insufficient and racing the transcript
+// before it can catch up or the 180s mesh-worker stall watchdog can arm. Requiring a minimum
+// dwell gives the transcript a window to land (clearing the block for a GENUINE emit) and lets
+// the stall watchdog own long turns, while still emitting a weak completion promptly once the
+// floor is met so a genuinely-answerless turn is never wedged. A block WITH final-assistant
+// evidence present is unaffected (it takes the normal emit path, not this floor). Scoped (at
+// the call site) to the missing_final_assistant transcript-evidence gate on mesh workers.
+// Sized so a short transcript-write lag resolves under it while staying well below the 30s
+// COMPLETED_FINALIZATION_MAX_WAIT_MS cap that force-releases the weak completion regardless.
+export const CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS = 20_000;
 // (FALSEIDLE-BGCHILD-a) Minimum generating→idle settle window for native-history mesh worker
 // sessions. Native-history providers (e.g. claude-cli) normally flush the completion with
 // flushDelay=0 — the transcript is authoritative, so there is no reason to wait. But a worker
@@ -120,6 +148,31 @@ export const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
 // met. Scoped (at the call site) to autonomous mesh sessions, so interactive sessions are
 // untouched.
 export const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
+// (ANTIGRAVITY-30S-CAP-PREMATURE) Minimum PTY quiet dwell required before the
+// COMPLETED_FINALIZATION_MAX_WAIT_MS (30s) cap may RELEASE an antigravity `holdForTranscript`
+// block into the forced weak completion. Antigravity is a native-source provider: its
+// idle/generating verdict is PTY-screen-derived, but its assistant answer lands in
+// native-history and can legitimately lag past 30s on a long turn (tool phase + slow reply).
+// The 30s cap releases on ELAPSED TIME, not proof-of-idle — so on a long turn it fired a
+// premature completed/idle to the coordinator while the PTY was still generating (live-repro:
+// a routed RCA task emitted "completed" in 10s with no result). Require instead that the PTY
+// has been quiet (no raw output) for at least this long AND the adapter reports no pending
+// response before the cap may force-emit. A genuinely quiescent tool-only turn (no assistant
+// bubble) has a stable screen well past this bound and still finalizes; a turn whose PTY is
+// still producing output keeps holding past 30s (up to ANTIGRAVITY_HOLD_HARD_CAP_MS). Scoped
+// (at the call site) to antigravity-cli holdForTranscript blocks, so claude-cli/codex-cli
+// completion timing is untouched.
+export const ANTIGRAVITY_HOLD_QUIET_DWELL_MS = 3000;
+// (ANTIGRAVITY-30S-CAP-PREMATURE) Absolute upper bound on how long an antigravity
+// `holdForTranscript` block may be held once the 30s cap is reached but the PTY is still
+// active. The quiet-dwell gate above keeps holding while the PTY keeps emitting output, so a
+// truly runaway turn (PTY never falls quiet) must still eventually release rather than wedge
+// the session in generating forever — strictly worse than the original premature-emit bug.
+// Once a pending completion has been held this long we force-emit regardless of PTY activity.
+// Sized generously (5 min) so realistic long antigravity turns (multi-tool + slow reply)
+// finish and let the transcript land / the PTY fall quiet naturally, while still guaranteeing
+// eventual release. Mirrors BACKGROUND_TASK_HOLD_MAX_MS's escape-hatch rationale.
+export const ANTIGRAVITY_HOLD_HARD_CAP_MS = 5 * 60_000;
 // (FALSE-IDLE-BACKGROUND-CMD) Hard cap on how long a pending completion may be HELD
 // solely because the claude-cli transcript still shows an unresolved run_in_background
 // bash job (backgroundTaskActive). The hold is the correct behaviour while the job is