@adhdev/daemon-core 1.0.18-rc.2 → 1.0.18-rc.20

package/src/cli-adapters/provider-cli-shared.ts

@@ -254,6 +254,54 @@ export interface CliProviderModule {
     _versionWarning?: string | null;
 }
 
+/**
+ * PURE-PTY TRANSCRIPT CLASS predicate (kimi and kin).
+ *
+ * A provider is "pure-PTY full-buffer" when it reconstructs its ENTIRE transcript
+ * from the rendered PTY buffer on every read and has NO alternate transcript
+ * source:
+ *   - transcriptAuthority !== 'provider'  (the daemon PTY parser owns the transcript,
+ *     not a provider-side canonical source)
+ *   - NO nativeHistory              (no on-disk / native-source history to fall back to)
+ *   - tui.transcriptPty.scope === 'buffer' (the parser walks the full rendered buffer)
+ *
+ * This class is invisible to two provider-authority-keyed code paths that other
+ * providers rely on for mesh completion semantics:
+ *   1. CliStateEngine.onTurnStarted only promotes to 'generating' for
+ *      transcriptAuthority==='provider' providers — so a pure-PTY session that
+ *      submits a prompt while already idle collapses idle→idle, the
+ *      generating→idle edge never occurs, and agent:generating_completed is never
+ *      emitted (the coordinator ledger leaves the task 'assigned' forever).
+ *   2. checkMeshWorkerStall's native-transcript completion reconcile is gated on
+ *      the native-source shape, so a finished pure-PTY worker's static idle is
+ *      misread as monitor:no_progress (a false task_stalled).
+ *
+ * The runtime capability, NOT any single spec field value, is authoritative: a
+ * given kimi manifest checkout may declare nativeHistory/transcriptAuthority, but
+ * the live-loaded pure-PTY session has none. Callers that only hold a
+ * CliProviderModule (the engine) share this exact predicate with the adapter
+ * (parsesFullPtyTranscriptFromBuffer) so the two never drift.
+ */
+export function isPurePtyTranscriptProvider(provider: {
+    transcriptAuthority?: 'provider' | 'daemon';
+    nativeHistory?: unknown;
+    tui?: Record<string, unknown>;
+} | null | undefined): boolean {
+    // No provider (e.g. an instance whose module isn't set when the stall watchdog
+    // ticks) ⇒ not the pure-PTY class. Guarding here protects every caller — the
+    // stall-reconcile and turn-start paths pass this.provider unguarded, and
+    // this.provider is genuinely nullable at runtime (see this.provider?.nativeHistory
+    // in cli-provider-instance.ts). Matches resolveLocalSessionPurePty's own
+    // no-provider ⇒ not-pure-PTY contract.
+    if (!provider) return false;
+    if (provider.transcriptAuthority === 'provider') return false;
+    // nativeHistory is a top-level provider field not surfaced on
+    // CliProviderModule; read it via the same structural shape the adapter uses.
+    if (provider.nativeHistory) return false;
+    const transcriptPty = (provider.tui as { transcriptPty?: { scope?: unknown } } | undefined)?.transcriptPty;
+    return transcriptPty?.scope === 'buffer';
+}
+
 function stripAnsi(str: string): string {
     // eslint-disable-next-line no-control-regex
     return str

package/src/cli-adapters/pty-transport.d.ts

@@ -37,7 +37,8 @@ export interface PtyRuntimeTransport {
     getMetadata?(): PtyRuntimeMetadata | null;
     onData(callback: (data: string) => void): void;
     onExit(callback: (info: {
-        exitCode: number;
+        exitCode: number | null;
+        signal?: number | null;
     }) => void): void;
 }
 export interface PtyTransportFactory {

package/src/cli-adapters/pty-transport.ts

@@ -62,7 +62,7 @@ export interface PtyRuntimeTransport {
   updateMeta?(meta: Record<string, unknown>, replace?: boolean): void;
   getMetadata?(): PtyRuntimeMetadata | null;
   onData(callback: (data: string) => void): void;
-  onExit(callback: (info: { exitCode: number }) => void): void;
+  onExit(callback: (info: { exitCode: number | null; signal?: number | null }) => void): void;
 }
 
 export interface PtyTransportFactory {

package/src/cli-adapters/session-host-transport.ts

@@ -42,7 +42,7 @@ class SessionHostRuntimeTransport implements PtyRuntimeTransport {
 
     private readonly client: SessionHostClient;
     private readonly dataCallbacks = new Set<(data: string) => void>();
-    private readonly exitCallbacks = new Set<(info: { exitCode: number }) => void>();
+    private readonly exitCallbacks = new Set<(info: { exitCode: number | null; signal?: number | null }) => void>();
     private readonly pendingOutput: string[] = [];
     private operationChain = Promise.resolve();
     private unsubscribe: (() => void) | null = null;
@@ -79,7 +79,7 @@ class SessionHostRuntimeTransport implements PtyRuntimeTransport {
         }
     }
 
-    onExit(callback: (info: { exitCode: number }) => void): void {
+    onExit(callback: (info: { exitCode: number | null; signal?: number | null }) => void): void {
         this.exitCallbacks.add(callback);
     }
 
@@ -361,8 +361,13 @@ class SessionHostRuntimeTransport implements PtyRuntimeTransport {
             return;
         }
         if (event.type === 'session_exit') {
+            // Preserve the nullable/unknown exitCode and signal exactly as the
+            // session host reported them — never collapse null to 0, which would
+            // make a signal-terminated process indistinguishable from a clean exit.
+            const exitCode = typeof event.exitCode === 'number' ? event.exitCode : null;
+            const signal = typeof event.signal === 'number' ? event.signal : null;
             for (const callback of this.exitCallbacks) {
-                callback({ exitCode: event.exitCode ?? 0 });
+                callback({ exitCode, signal });
             }
             void this.closeClient(false);
         }

package/src/commands/cli-manager.ts

@@ -34,6 +34,7 @@ import type { SessionRegistry } from '../sessions/registry.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { LOG } from '../logging/logger.js';
 import { shouldRestoreHostedRuntime } from './hosted-runtime-restore.js';
+import { findProviderAutoApproveMode, resolveProviderAutoApproveMode } from '../providers/auto-approve-modes.js';
 
 // ─── external dependency interface ──────────────────────────
 
@@ -452,6 +453,40 @@ export function expandThinkingLaunchArgs(
     return template.map((part) => part.includes('{{level}}') ? part.replace('{{level}}', mapped) : part);
 }
 
+function matchesRemovedLaunchArg(arg: string, removeArg: string): boolean {
+    return arg === removeArg || (removeArg.startsWith('--') && arg.startsWith(`${removeArg}=`));
+}
+
+/**
+ * Apply a selected launch-args auto-approve mode without mutating provider metadata.
+ * removeArgs only targets provider-owned base spawn.args; launchArgs are prepended to
+ * per-launch args beside model/thinking args, making conflict removal order-independent.
+ */
+export function applyAutoApproveModeLaunchArgs(
+    provider: ProviderModule | undefined,
+    cliArgs: string[] | undefined,
+    settings: Record<string, unknown> | undefined,
+): { provider: ProviderModule | undefined; cliArgs: string[] | undefined } {
+    if (!provider) return { provider, cliArgs };
+    const resolved = resolveProviderAutoApproveMode(provider, settings);
+    if (!resolved.active || resolved.strategy !== 'launch-args') return { provider, cliArgs };
+    const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+    if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+
+    const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+    const baseArgs = provider.spawn?.args;
+    const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0
+        ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg)))
+        : baseArgs;
+    const launchProvider = filteredBaseArgs === baseArgs
+        ? provider
+        : { ...provider, spawn: { ...provider.spawn!, args: filteredBaseArgs } };
+    return {
+        provider: launchProvider,
+        cliArgs: [...mode.launchArgs, ...(cliArgs || [])],
+    };
+}
+
 function readSubcommandSessionId(args: string[], subcommands: string[]): string | undefined {
     const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
     if (resumeIndex < 0) return undefined;
@@ -707,6 +742,24 @@ export class DaemonCliManager {
                     clearInterval(checkStopped);
                     setTimeout(() => {
                         if (this.adapters.has(key)) {
+                            // KIMI-MESH-COMPLETION-EMIT (axis 2): before removeInstance closes the
+                            // event-emit window, give a mesh DELEGATED worker one last chance to emit
+                            // its completion. A native-source worker (e.g. kimi) can have its PTY
+                            // killed by a false stall AFTER it finished the task (transcript written)
+                            // but BEFORE the FSM's idle→completed event fired — the instance is the
+                            // only thing that can emit that event, and it is about to be removed. The
+                            // instance-side method is a no-op for a non-mesh session or when the
+                            // turn's completion already fired (double-emit guard) or when there is no
+                            // transcript evidence of a finished turn. Best-effort — never blocks cleanup.
+                            try {
+                                const inst = instanceManager?.getInstance(key) as (ProviderInstance & { flushMeshCompletionBeforeCleanup?: () => boolean }) | undefined;
+                                if (typeof inst?.flushMeshCompletionBeforeCleanup === 'function') {
+                                    const emitted = inst.flushMeshCompletionBeforeCleanup();
+                                    if (emitted) LOG.info('CLI', `Emitted pre-cleanup mesh completion for ${cliType} session ${key} before auto-clean`);
+                                }
+                            } catch (e) {
+                                LOG.warn('CLI', `pre-cleanup mesh completion flush failed for ${key}: ${(e as Error)?.message || e}`);
+                            }
                             this.adapters.delete(key);
                             this.deps.removeAgentTracking(key);
                             sessionRegistry?.unregisterByInstanceKey(key);
@@ -1030,6 +1083,17 @@ export class DaemonCliManager {
             console.log(colorize('cyan', `  📦 Using provider: ${provider.name} (${provider.type})`));
         }
 
+        const launchSettings = {
+            ...this.providerLoader.getSettings(normalizedType),
+            ...(options?.settingsOverride || {}),
+        };
+        const versionResolvedProvider = provider
+            ? (this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider)
+            : undefined;
+        const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+        const launchProvider = autoApproveLaunch.provider || provider;
+        const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+
  // ─── Model axis (MAGI kind-panel): expand initialModel → launch args ───
  // For a plain CLI provider the model is selected at spawn time via the manifest's
  // modelLaunchArgs template ('{{model}}' → the requested model). ACP providers took
@@ -1037,10 +1101,10 @@ export class DaemonCliManager {
  // or no requested model, is a no-op — model selection is best-effort and must never
  // fail a launch. The model args are prepended so a caller's explicit cliArgs (e.g. a
  // resume flag) still win positionally where order matters.
-        const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
+        const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
         const cliArgsWithModel = modelLaunchArgs
-            ? [...modelLaunchArgs, ...(cliArgs || [])]
-            : cliArgs;
+            ? [...modelLaunchArgs, ...(cliArgsWithAutoApprove || [])]
+            : cliArgsWithAutoApprove;
         if (initialModel && !modelLaunchArgs) {
             LOG.warn('CLI', `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template — launching without model selection.`);
         }
@@ -1051,7 +1115,7 @@ export class DaemonCliManager {
  // Best-effort; a provider with no template (or no requested level) is a no-op. ACP
  // providers route thinking through setConfigOption('thought_level') above.
         const initialThinkingLevel = options?.initialThinkingLevel;
-        const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+        const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
         const cliArgsWithBrain = thinkingLaunchArgs
             ? [...thinkingLaunchArgs, ...(cliArgsWithModel || [])]
             : cliArgsWithModel;
@@ -1060,13 +1124,13 @@ export class DaemonCliManager {
         }
 
  // ─── Resolve launch options → provider session binding ───
-        const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+        const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
         const resolvedCliArgs = sessionBinding.cliArgs;
 
  // If InstanceManager exists, manage as CliProviderInstance unified
         const instanceManager = this.deps.getInstanceManager();
-        if (provider && instanceManager) {
-            const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+        if (launchProvider && instanceManager) {
+            const resolvedProvider = launchProvider;
             await this.registerCliInstance(
                 key,
                 normalizedType,
@@ -1074,7 +1138,7 @@ export class DaemonCliManager {
                 resolvedDir,
                 resolvedCliArgs,
                 resolvedProvider,
-                { ...this.providerLoader.getSettings(normalizedType), ...(options?.settingsOverride || {}) },
+                launchSettings,
                 false,
                 {
                     providerSessionId: sessionBinding.providerSessionId,

package/src/commands/high-family/mesh-coordinator-launch.ts

@@ -115,8 +115,12 @@ export const meshCoordinatorLaunchHandlers: Record<string, HighFamilyHandler> =
                         try {
                             const { readOperatingNotes } = await import('../../mesh/mesh-ledger.js');
                             // readOperatingNotes filters out tombstoned (forgotten) notes so a
-                            // retracted lesson never rides into the prompt. Newest last; tail 20.
-                            const noteEntries = readOperatingNotes(id, { tail: 20 });
+                            // retracted lesson never rides into the prompt. Newest last.
+                            // Phase 2 (d): the byte-budget/count cap now bounds the injected list
+                            // (selectOperatingNotesForPrompt), so read a larger candidate tail than
+                            // the old fixed 20 and let injection-side ranking + budget do the
+                            // bounding. Keep a sane store-read ceiling to avoid unbounded arrays.
+                            const noteEntries = readOperatingNotes(id, { tail: 100 });
                             const notes = noteEntries
                                 .map((e) => {
                                     const p = (e.payload || {}) as Record<string, unknown>;
@@ -131,6 +135,17 @@ export const meshCoordinatorLaunchHandlers: Record<string, HighFamilyHandler> =
                                         category,
                                         createdAt: typeof p.createdAt === 'string' ? p.createdAt : e.timestamp,
                                         sourceCoordinator: typeof p.sourceCoordinator === 'string' ? p.sourceCoordinator : undefined,
+                                        // Operating-notes lifecycle: thread pinned/expiresAt so the
+                                        // injection-side selection can honor them. Legacy notes lack
+                                        // these → pinned defaults false, expiry governed by category TTL.
+                                        pinned: p.pinned === true,
+                                        ...(typeof p.expiresAt === 'string' ? { expiresAt: p.expiresAt } : {}),
+                                        // Phase 2 (b)/(c): thread the ledger id + supersedes/subjectKey
+                                        // so version-supersede targeting and same-class folding work.
+                                        // Legacy notes lack them → no supersede, fold by leading [tag].
+                                        noteId: e.id,
+                                        ...(typeof p.supersedes === 'string' ? { supersedes: p.supersedes } : {}),
+                                        ...(typeof p.subjectKey === 'string' ? { subjectKey: p.subjectKey } : {}),
                                     };
                                 })
                                 .filter((n): n is NonNullable<typeof n> => n !== null);

package/src/commands/high-family/mesh-events.ts

@@ -93,10 +93,21 @@ export const meshEventsHandlers: Record<string, HighFamilyHandler> = {
                 ? args.sessionId.trim()
                 : '';
         if (!sessionId) return { success: false, error: 'targetSessionId required' };
-        const response = normalizeInteractivePromptResponse(args?.response ?? args);
+        const rawResponse = args?.response ?? args;
         const instance = ctx.deps.instanceManager.getInstance(sessionId);
         if (!instance) return { success: false, error: `No running instance for session ${sessionId}` };
-        ctx.deps.instanceManager.sendEvent(sessionId, 'interactive_prompt_response', response);
+        // mesh_answer_question (mission f1d25e11) sends a coordinator-friendly answer array
+        // that is resolved against the AUTHORITATIVE active prompt inside the instance
+        // (resolveInteractivePromptResponse). Forward that shape RAW. The legacy strict
+        // (questionId-keyed) form is still validated here so a malformed dashboard-local
+        // answer is rejected before it reaches the instance.
+        const isFriendlyArrayForm = rawResponse
+            && typeof rawResponse === 'object'
+            && Array.isArray((rawResponse as { answers?: unknown }).answers);
+        const payload = isFriendlyArrayForm
+            ? rawResponse
+            : normalizeInteractivePromptResponse(rawResponse);
+        ctx.deps.instanceManager.sendEvent(sessionId, 'interactive_prompt_response', payload);
         return { success: true };
     },
 };

package/src/commands/med-family/mesh-crud.ts

@@ -399,6 +399,161 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
         }
     },
 
+    // READ path for `.adhdev/mesh.json` — returns the currently-committed repo
+    // config (parsed + normalized) for a workspace so a UI can render/edit the
+    // existing declarative zones (notably `providerDefaults.autoApproveModes`)
+    // WITHOUT re-deriving them from the machine-local scaffold. Never writes.
+    // `config` is undefined when no repo file exists (sourceType 'unavailable') or
+    // it is unparseable (sourceType 'invalid', with the parse error surfaced).
+    read_mesh_json_config: async (_ctx: MedFamilyContext, args: any) => {
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        try {
+            const { loadRepoMeshJsonConfig } = await import('../../config/mesh-json-config.js');
+            const loaded = loadRepoMeshJsonConfig(workspace);
+            return {
+                success: true,
+                workspace,
+                sourceType: loaded.sourceType,
+                source: loaded.source,
+                ...(loaded.path ? { path: loaded.path } : {}),
+                ...(loaded.error ? { error: loaded.error } : {}),
+                config: loaded.config,
+                // Convenience projection so the UI does not have to reach into config.
+                providerDefaults: loaded.config?.providerDefaults,
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
+    // Partial-edit WRITE path for `.adhdev/mesh.json` `providerDefaults` — a
+    // READ-MODIFY-WRITE that preserves operator hand-edits. Unlike
+    // write_mesh_json_config (which rebuilds the WHOLE file from the machine-local
+    // scaffold and can silently drop hand-edited zones), this parses the existing
+    // repo file, merges ONLY the providerDefaults.autoApproveModes zone, and
+    // re-serializes — coordinator prompt, operating notes and limits authored in
+    // the repo are carried through untouched. Defaults to dry-run.
+    //
+    // args: { workspace?, autoApproveModes: Record<providerType,modeId>, write?, merge? }
+    //   merge=true (default): per-provider merge into the existing map; a modeId of
+    //     '' | null removes that provider's entry. merge=false: REPLACE the whole
+    //     autoApproveModes map with the supplied one.
+    set_mesh_provider_defaults: async (_ctx: MedFamilyContext, args: any) => {
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        const write = args?.write === true;
+        const merge = args?.merge !== false; // default true
+        const inputModes = args?.autoApproveModes;
+        if (inputModes !== undefined && (typeof inputModes !== 'object' || inputModes === null || Array.isArray(inputModes))) {
+            return { success: false, error: 'autoApproveModes must be an object (providerType → modeId) when provided' };
+        }
+        try {
+            const {
+                loadRepoMeshJsonConfig,
+                normalizeRepoMeshDeclarativeConfig,
+                MESH_JSON_CONFIG_LOCATIONS,
+            } = await import('../../config/mesh-json-config.js');
+            const { existsSync, readFileSync, mkdirSync, writeFileSync } = await import('fs');
+            const { dirname, join } = await import('path');
+            const yaml = await import('js-yaml');
+
+            const relativePath = MESH_JSON_CONFIG_LOCATIONS[0];
+
+            // Read-modify-write: parse the EXISTING on-disk document (preferring the
+            // first existing json/yaml variant) so unrelated zones survive verbatim.
+            let baseDoc: Record<string, any> = { version: 1 };
+            let existingPath = join(workspace, relativePath);
+            let existedAsYaml = false;
+            for (const relative of MESH_JSON_CONFIG_LOCATIONS) {
+                const candidate = join(workspace, relative);
+                if (!existsSync(candidate)) continue;
+                try {
+                    const text = readFileSync(candidate, 'utf-8');
+                    const parsed = /\.json$/i.test(candidate) ? JSON.parse(text) : yaml.load(text);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                        baseDoc = parsed as Record<string, any>;
+                        existingPath = candidate;
+                        existedAsYaml = !/\.json$/i.test(candidate);
+                    }
+                } catch (e: any) {
+                    return { success: false, error: `existing ${relative} is unparseable, refusing to overwrite: ${e?.message || e}` };
+                }
+                break;
+            }
+
+            // Merge ONLY the providerDefaults.autoApproveModes zone.
+            const existingPd = baseDoc.providerDefaults && typeof baseDoc.providerDefaults === 'object' && !Array.isArray(baseDoc.providerDefaults)
+                ? baseDoc.providerDefaults as Record<string, any>
+                : {};
+            const existingModes = existingPd.autoApproveModes && typeof existingPd.autoApproveModes === 'object' && !Array.isArray(existingPd.autoApproveModes)
+                ? { ...existingPd.autoApproveModes as Record<string, string> }
+                : {};
+
+            const nextModes: Record<string, string> = merge ? existingModes : {};
+            if (inputModes) {
+                for (const [providerType, modeId] of Object.entries(inputModes as Record<string, unknown>)) {
+                    const type = typeof providerType === 'string' ? providerType.trim() : '';
+                    if (!type) continue;
+                    const id = typeof modeId === 'string' ? modeId.trim() : '';
+                    if (id) nextModes[type] = id;
+                    else delete nextModes[type]; // '' / null → remove this provider's entry
+                }
+            }
+
+            const nextDoc: Record<string, any> = { ...baseDoc, version: 1 };
+            if (Object.keys(nextModes).length) {
+                nextDoc.providerDefaults = { ...existingPd, autoApproveModes: nextModes };
+            } else {
+                // No entries left → drop the zone entirely so we don't leave an empty stub.
+                if (nextDoc.providerDefaults) {
+                    const { autoApproveModes, ...restPd } = nextDoc.providerDefaults;
+                    if (Object.keys(restPd).length) nextDoc.providerDefaults = restPd;
+                    else delete nextDoc.providerDefaults;
+                }
+            }
+
+            // Validate the merged document before it ever touches disk.
+            const validation = normalizeRepoMeshDeclarativeConfig(nextDoc);
+            if (!validation.valid) {
+                return { success: false, error: `merged mesh.json is invalid: ${validation.errors.join('; ')}` };
+            }
+
+            // Serialize in the on-disk format (JSON unless the existing file was YAML).
+            const absolutePath = existingPath;
+            const serialized = existedAsYaml
+                ? yaml.dump(nextDoc, { indent: 2 })
+                : `${JSON.stringify(nextDoc, null, 2)}\n`;
+
+            if (!write) {
+                return {
+                    success: true,
+                    written: false,
+                    dryRun: true,
+                    path: absolutePath,
+                    relativePath,
+                    merge,
+                    providerDefaults: nextDoc.providerDefaults,
+                    preview: serialized,
+                    note: 'Dry-run: nothing written. Re-run with write=true to persist. Only the providerDefaults zone is merged; other repo zones are preserved.',
+                };
+            }
+
+            mkdirSync(dirname(absolutePath), { recursive: true });
+            writeFileSync(absolutePath, serialized, 'utf-8');
+            return {
+                success: true,
+                written: true,
+                dryRun: false,
+                path: absolutePath,
+                relativePath,
+                merge,
+                providerDefaults: nextDoc.providerDefaults,
+                note: 'Wrote providerDefaults into .adhdev/mesh.json (read-modify-write; other zones preserved). Commit it to the repo.',
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
     delete_mesh: async (_ctx: MedFamilyContext, args: any) => {
         const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
         if (!meshId) return { success: false, error: 'meshId required' };

package/src/commands/med-family/mesh-queue.ts

@@ -9,6 +9,67 @@
  */
 import { readStringValue } from '../router.js';
 import type { MedFamilyContext, MedFamilyHandler } from './types.js';
+import { LOG } from '../../logging/logger.js';
+import type { CancelledTaskAssignment } from '../../mesh/mesh-work-queue.js';
+
+/**
+ * CANCEL-STICKY-TERMINAL (authoritative cancel): stop the worker a just-cancelled task was
+ * bound to. Mirrors the transport-aware stop mesh-event-forwarding's stopStaleMeshWorker
+ * performs for reclaimed workers, but runs from the command layer using ctx.deps (which the
+ * pure queue-store module lacks): local adapter → stop_cli directly; otherwise resolve the
+ * worker node's daemon id from mesh config and dispatch stop_cli over P2P/relay. Fully
+ * best-effort — a failed stop only loses the belt-and-suspenders; the cancelled row is already
+ * terminal and cannot be resurrected (updateTaskStatus terminal guard).
+ */
+async function stopCancelledTaskWorker(
+    ctx: MedFamilyContext,
+    meshId: string,
+    prior: CancelledTaskAssignment,
+): Promise<void> {
+    const { sessionId, nodeId, providerType } = prior;
+    const stopArgs: Record<string, unknown> = {
+        targetSessionId: sessionId,
+        ...(providerType ? { cliType: providerType } : {}),
+        mode: 'hard',
+        reason: 'mesh_task_cancelled',
+    };
+    try {
+        const cliManager = ctx.deps.cliManager as any;
+        const isLocal = cliManager?.adapters?.has?.(sessionId) === true;
+        if (isLocal) {
+            if (!stopArgs.cliType) {
+                const localType = cliManager?.adapters?.get?.(sessionId)?.cliType;
+                if (localType) stopArgs.cliType = localType;
+            }
+            await Promise.resolve(cliManager?.handleCliCommand?.('stop_cli', stopArgs))
+                .catch((e: any) => LOG.warn('MeshQueue', `Local stop of cancelled worker ${sessionId} failed: ${e?.message || e}`));
+            return;
+        }
+        // Remote: resolve the worker node's daemon id from mesh config, then dispatch stop_cli.
+        const dispatch = ctx.deps.dispatchMeshCommand;
+        let daemonId: string | undefined;
+        if (nodeId) {
+            try {
+                const [{ getMesh }, { meshNodeIdMatches }, { readMeshNodeDaemonId }] = await Promise.all([
+                    import('../../config/mesh-config.js'),
+                    import('@adhdev/mesh-shared'),
+                    import('../../mesh/mesh-node-identity.js'),
+                ]);
+                const mesh = getMesh(meshId) as { nodes?: any[] } | undefined;
+                const node = mesh?.nodes?.find((n: any) => meshNodeIdMatches(n, nodeId));
+                daemonId = node ? readMeshNodeDaemonId(node) || undefined : undefined;
+            } catch { /* best-effort resolution */ }
+        }
+        if (daemonId && dispatch) {
+            await Promise.resolve(dispatch(daemonId, 'stop_cli', stopArgs))
+                .catch((e: any) => LOG.warn('MeshQueue', `Remote stop of cancelled worker ${sessionId} on daemon ${daemonId} failed: ${e?.message || e}`));
+        } else {
+            LOG.warn('MeshQueue', `Cannot stop cancelled worker ${sessionId}: no local adapter and no resolvable remote daemon id (node ${nodeId ?? '?'}). Row is already terminal; if the worker completes it strand-fails harmlessly.`);
+        }
+    } catch (e: any) {
+        LOG.warn('MeshQueue', `stopCancelledTaskWorker error for ${sessionId}: ${e?.message || e}`);
+    }
+}
 
 export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
     get_mesh_queue: async (_ctx: MedFamilyContext, args: any) => {
@@ -50,10 +111,22 @@ export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
         const ownerFailure = await ctx.requireMeshHostMutationOwner(meshId, args?.inlineMesh, 'queue cancellation');
         if (ownerFailure) return ownerFailure;
         try {
-            const { cancelTask } = await import('../../mesh/mesh-work-queue.js');
+            const { cancelTask, takeCancelledTaskAssignment } = await import('../../mesh/mesh-work-queue.js');
             const reason = typeof args?.reason === 'string' ? args.reason : undefined;
             const task = cancelTask(meshId, taskId, { reason });
             if (!task) return { success: false, error: `Queue task '${taskId}' not found` };
+            // CANCEL-STICKY-TERMINAL (authoritative cancel): stop the worker that was bound to the
+            // now-cancelled task. cancelTask already cleared the queue's assignment fields (so the
+            // reclaim watchdog no longer sees it as a live assignment), but a still-running worker
+            // keeps emitting delivery/turn signals that re-ignite reclaim. cancelTask runs in the
+            // pure queue-store module (no DaemonComponents), so the transport-aware stop is done
+            // here where ctx.deps holds cliManager / dispatchMeshCommand. Best-effort: a failed
+            // stop only loses the belt-and-suspenders — the row is already terminal and un-revivable
+            // thanks to the updateTaskStatus terminal guard.
+            const prior = takeCancelledTaskAssignment(meshId, taskId);
+            if (prior?.sessionId) {
+                void stopCancelledTaskWorker(ctx, meshId, prior);
+            }
             return { success: true, task };
         } catch (e: any) {
             return { success: false, error: e.message };