@adhdev/daemon-core 1.0.18-rc.6 → 1.0.18-rc.8

package/src/mesh/mesh-ledger.ts

@@ -88,6 +88,14 @@ export type MeshLedgerKind =
     // payload: { keys: string[], hasDestructive: boolean, result: 'injected'|'refused'|'error',
     //            refused?: string, submits?: boolean, confirmDestructive?: boolean }
     | 'key_injection'
+    // Disk/worktree retention (mission 86def38d): DETECTION-ONLY signal that a git
+    // worktree present on disk has no matching live mesh node — an orphan cleanup
+    // candidate. The reconcile loop emits this so the coordinator can decide whether
+    // to remove it; retention NEVER auto-deletes a worktree (manual/coordinator-driven).
+    // Keyed by worktreePath so a re-emit for the same orphan is idempotent (a prior
+    // unresolved entry within the dedupe window suppresses the repeat).
+    // payload: { worktreePath, branch?, head?, reason: 'no_matching_live_node', state: 'cleanup_candidate' }
+    | 'worktree_cleanup_candidate'
     ;
 
 export interface MeshLedgerEntry {
@@ -317,6 +325,70 @@ export const OPERATING_NOTE_DEDUPE_WINDOW = 40;
 // a coordinator actually sees while still capping unbounded store growth.
 export const OPERATING_NOTE_KEEP_LATEST = 100;
 
+// ─── Operating-note lifecycle: category TTL + expiry (read-side only) ──────────
+// Minimal first cut of the operating-notes lifecycle. Expiry is READ/INJECTION
+// side ONLY — the store prune (keep-latest-100 above) stays purely count-based
+// and NEVER deletes by age, so audit history is preserved. isNoteExpired decides
+// whether an UNPINNED note still rides into a coordinator prompt.
+//
+// Per-category retention (days). A category not listed here — including the
+// uncategorized case — is durable (never expires). provider_quirk is durable
+// because a runtime quirk stays true until the provider changes.
+export const OPERATING_NOTE_CATEGORY_TTL_DAYS: Readonly<Record<string, number>> = {
+    recovery_lesson: 14,
+    pattern_to_avoid: 30,
+    // provider_quirk: durable (intentionally absent → never expires)
+};
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+/**
+ * Shape isNoteExpired reads. Structural so mesh-ledger stays free of a
+ * coordinator-prompt import (CoordinatorOperatingNote satisfies this).
+ */
+export interface OperatingNoteExpiryInput {
+    category?: string;
+    pinned?: boolean;
+    createdAt?: string;
+    /** Explicit expiry override; wins over the category TTL when parseable. */
+    expiresAt?: string;
+    /** Fallback creation time (ledger entry timestamp) when createdAt absent. */
+    timestamp?: string;
+}
+
+/**
+ * Pure helper: is this UNPINNED operating note expired as of `now` (epoch ms)?
+ *
+ * Rules:
+ *  - pinned notes NEVER expire (always false).
+ *  - an explicit, parseable `expiresAt` in the past → expired.
+ *  - otherwise the category TTL applies; a durable category (provider_quirk,
+ *    uncategorized, or any category not in the TTL map) never expires.
+ *  - age is measured from createdAt, falling back to `timestamp` (ledger entry
+ *    time). If neither is a valid date, the note is treated as NOT expired
+ *    (never silently drop a note we cannot age).
+ */
+export function isNoteExpired(note: OperatingNoteExpiryInput, now: number): boolean {
+    if (!note || note.pinned) return false;
+
+    // Explicit expiresAt wins when present and parseable.
+    if (typeof note.expiresAt === 'string') {
+        const exp = new Date(note.expiresAt).getTime();
+        if (!Number.isNaN(exp)) return exp <= now;
+    }
+
+    const ttlDays = note.category ? OPERATING_NOTE_CATEGORY_TTL_DAYS[note.category] : undefined;
+    if (typeof ttlDays !== 'number' || !Number.isFinite(ttlDays)) {
+        // Durable category (provider_quirk / uncategorized / unknown) → never expires.
+        return false;
+    }
+
+    const created = new Date(note.createdAt ?? note.timestamp ?? '').getTime();
+    if (Number.isNaN(created)) return false; // cannot age → keep
+
+    return now - created >= ttlDays * MS_PER_DAY;
+}
+
 // ─── Path Helpers ───────────────────────────────
 
 export function getLedgerDir(): string {

package/src/mesh/mesh-reconcile-loop.ts

@@ -76,6 +76,7 @@ import {
     resolveReconcileIntervalMs,
 } from './mesh-reconcile-config.js';
 import { pullRemoteNodeQueues } from './mesh-remote-event-pull.js';
+import { runDiskRetentionSweep, detectAndSignalOrphanWorktrees } from './mesh-disk-retention.js';
 import {
     reconcileUnterminatedDirectDispatches,
     autoPruneStaleDirectDispatches,
@@ -126,6 +127,16 @@ interface LiveCoordinator {
 // "restart does not clear it" symptom the operator needs visibility into).
 const coordinatorModalParkState = new Map<string, boolean>();
 
+// Disk/worktree retention throttle. The reconcile tick runs every ~4s, but the
+// retention sweep (fs walks + git worktree list) is far too heavy for that cadence
+// and its artifacts age in days, so it runs at most once per hour. `undefined`
+// means "never run yet" → runs on the first tick after daemon start so a long-lived
+// backlog is reclaimed promptly rather than an hour later. Per-process; a restart
+// re-runs it immediately, which is the desired behavior (a restart is exactly when
+// stale artifacts from the previous run should be swept).
+const DISK_RETENTION_INTERVAL_MS = 60 * 60 * 1000; // 1h
+let lastDiskRetentionRunAt: number | undefined;
+
 // Find live CLI coordinator instances on THIS daemon, keyed by mesh.
 function findLiveCoordinators(components: DaemonComponents): LiveCoordinator[] {
     const out: LiveCoordinator[] = [];
@@ -1354,6 +1365,44 @@ export async function runMeshReconcileTick(components: DaemonComponents): Promis
         }
     }
 
+    // ── PHASE 6: disk / worktree retention (hourly, mission 86def38d) ──────────
+    // Legacy on-disk artifacts under ~/.adhdev accumulated with NO lifetime and grew
+    // the data volume until a refine bootstrap failed at 98% disk. This throttled pass
+    // (≤1×/hour — the artifacts age in days and the fs/git walk is too heavy for the 4s
+    // tick) reclaims them:
+    //   • JSONL ledger files older than 30d (legacy after the SQLite ledger)
+    //   • terminated session-host runtime files older than 14d (live never touched)
+    //   • mesh-runtime.db.bak-* backups older than 7d
+    //   • orphan worktree DETECTION → cleanup_candidate ledger signal (NEVER deleted).
+    // Runs BEFORE PHASE 2's early return so it fires whether or not a live CLI
+    // coordinator exists on this daemon. Isolated in try/catch so it can never kill the
+    // tick. All file deletions are defensive (age + live-runtime guards in the pure
+    // selectors); worktree cleanup stays manual/coordinator-driven.
+    {
+        const nowMs = Date.now();
+        const due = lastDiskRetentionRunAt === undefined
+            || (nowMs - lastDiskRetentionRunAt) >= DISK_RETENTION_INTERVAL_MS;
+        if (due) {
+            lastDiskRetentionRunAt = nowMs;
+            try {
+                runDiskRetentionSweep(nowMs);
+            } catch (e: any) {
+                LOG.warn('MeshReconcile', `Disk retention sweep failed: ${e?.message || e}`);
+            }
+            // Orphan-worktree detection is per-mesh (needs the mesh's base repo + node set)
+            // and only for meshes this daemon hosts (its local base checkout is the git anchor).
+            for (const mesh of listMeshes()) {
+                const selfIds = resolveCoordinatorSelfIds(mesh, drainDaemonIds);
+                if (!daemonHostsMesh(mesh, selfIds)) continue;
+                try {
+                    await detectAndSignalOrphanWorktrees(mesh, nowMs);
+                } catch (e: any) {
+                    LOG.warn('MeshReconcile', `Orphan worktree detection failed for mesh ${mesh.id}: ${e?.message || e}`);
+                }
+            }
+        }
+    }
+
     // ── PHASE 2: inject into live CLI coordinators on this daemon ──────────────
     const coordinators = findLiveCoordinators(components);
     if (coordinators.length === 0) {

package/src/mesh/mesh-runtime-store.ts

@@ -174,6 +174,27 @@ export class MeshRuntimeStore {
         this.instance = undefined;
     }
 
+    /**
+     * VACUUM the SQLite database to reclaim on-disk space. Retention prunes rows
+     * with DELETE, which frees pages inside the file but does NOT shrink it — the
+     * mesh-runtime.db grew to hundreds of MB (mission 86def38d disk-accumulation
+     * bootstrap failure) precisely because the file was never compacted. This
+     * rewrites the DB into a minimal footprint. Best-effort: a VACUUM failure (e.g.
+     * insufficient temp space, a read lock) is logged and swallowed so it can never
+     * block daemon shutdown. Called once on shutdown (see daemon-lifecycle), never
+     * on the hot path — VACUUM takes an exclusive lock and rewrites the whole file.
+     */
+    vacuum(): void {
+        try {
+            // Fold the WAL back into the main DB first so VACUUM reclaims those pages too.
+            try { this.db.pragma('wal_checkpoint(TRUNCATE)'); } catch { /* checkpoint best-effort */ }
+            this.db.exec('VACUUM;');
+            LOG.info('MeshRuntimeStore', 'VACUUM completed on shutdown');
+        } catch (err: any) {
+            LOG.warn('MeshRuntimeStore', `VACUUM on shutdown failed (ignored): ${err?.message || err}`);
+        }
+    }
+
     close(): void {
         this.db.close();
     }

package/src/providers/cli-provider-instance-types.ts

@@ -120,6 +120,31 @@ export const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
 // met. Scoped (at the call site) to autonomous mesh sessions, so interactive sessions are
 // untouched.
 export const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
+// (ANTIGRAVITY-30S-CAP-PREMATURE) Minimum PTY quiet dwell required before the
+// COMPLETED_FINALIZATION_MAX_WAIT_MS (30s) cap may RELEASE an antigravity `holdForTranscript`
+// block into the forced weak completion. Antigravity is a native-source provider: its
+// idle/generating verdict is PTY-screen-derived, but its assistant answer lands in
+// native-history and can legitimately lag past 30s on a long turn (tool phase + slow reply).
+// The 30s cap releases on ELAPSED TIME, not proof-of-idle — so on a long turn it fired a
+// premature completed/idle to the coordinator while the PTY was still generating (live-repro:
+// a routed RCA task emitted "completed" in 10s with no result). Require instead that the PTY
+// has been quiet (no raw output) for at least this long AND the adapter reports no pending
+// response before the cap may force-emit. A genuinely quiescent tool-only turn (no assistant
+// bubble) has a stable screen well past this bound and still finalizes; a turn whose PTY is
+// still producing output keeps holding past 30s (up to ANTIGRAVITY_HOLD_HARD_CAP_MS). Scoped
+// (at the call site) to antigravity-cli holdForTranscript blocks, so claude-cli/codex-cli
+// completion timing is untouched.
+export const ANTIGRAVITY_HOLD_QUIET_DWELL_MS = 3000;
+// (ANTIGRAVITY-30S-CAP-PREMATURE) Absolute upper bound on how long an antigravity
+// `holdForTranscript` block may be held once the 30s cap is reached but the PTY is still
+// active. The quiet-dwell gate above keeps holding while the PTY keeps emitting output, so a
+// truly runaway turn (PTY never falls quiet) must still eventually release rather than wedge
+// the session in generating forever — strictly worse than the original premature-emit bug.
+// Once a pending completion has been held this long we force-emit regardless of PTY activity.
+// Sized generously (5 min) so realistic long antigravity turns (multi-tool + slow reply)
+// finish and let the transcript land / the PTY fall quiet naturally, while still guaranteeing
+// eventual release. Mirrors BACKGROUND_TASK_HOLD_MAX_MS's escape-hatch rationale.
+export const ANTIGRAVITY_HOLD_HARD_CAP_MS = 5 * 60_000;
 // (FALSE-IDLE-BACKGROUND-CMD) Hard cap on how long a pending completion may be HELD
 // solely because the claude-cli transcript still shows an unresolved run_in_background
 // bash job (backgroundTaskActive). The hold is the correct behaviour while the job is

package/src/providers/cli-provider-instance.ts

@@ -58,6 +58,8 @@ import {
     COMPLETED_FINALIZATION_MAX_WAIT_MS,
     NATIVE_HISTORY_MESH_IDLE_SETTLE_MS,
     PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS,
+    ANTIGRAVITY_HOLD_QUIET_DWELL_MS,
+    ANTIGRAVITY_HOLD_HARD_CAP_MS,
     BACKGROUND_TASK_HOLD_MAX_MS,
     USER_INPUT_ACK_DEDUP_WINDOW_MS,
     STARTUP_GRACE_IDLE_COLLAPSE_WINDOW_MS,
@@ -369,6 +371,16 @@ export class CliProviderInstance implements ProviderInstance {
     private generatingDebounceTimer: NodeJS.Timeout | null = null;
     private generatingDebouncePending: { chatTitle: string; timestamp: number } | null = null;
     private lastApprovalEventFingerprint = '';
+    // INTERACTIVE-PROMPT-PUSH: edge-trigger key for the AskUserQuestion / waiting_choice
+    // notification. An AskUserQuestion prompt is surfaced only as a display-only
+    // `waiting_choice` overlay in getState(); the raw adapter status stays idle/generating,
+    // so detectStatusTransition()'s status-keyed arms never fire and no push-worthy
+    // agent:* event is emitted — the owner misses the "ACTION REQUIRED" prompt when the
+    // app is backgrounded. We emit one agent:waiting_approval on ENTRY into the prompt
+    // state (reusing the existing server push path, no cloud change) and dedupe on this
+    // key so repeated status ticks with the same prompt do not re-fire. '' means no
+    // prompt is currently active (cleared when the prompt is answered/gone).
+    private lastInteractivePromptEventKey = '';
     private autoApproveBusy = false;
     private autoApproveBusyTimer: NodeJS.Timeout | null = null;
     private lastAutoApprovalSignature = '';
@@ -1897,6 +1909,33 @@ export class CliProviderInstance implements ProviderInstance {
         return false;
     }
 
+    // (ANTIGRAVITY-30S-CAP-PREMATURE) Discriminator gating the 30s-cap release of an antigravity
+    // `holdForTranscript` block. Antigravity's idle verdict is PTY-screen-derived but its assistant
+    // answer lands in native-history, which can legitimately lag past COMPLETED_FINALIZATION_MAX_WAIT_MS
+    // (30s) on a long turn. The cap releases on elapsed time, not proof-of-idle, so it force-emitted a
+    // premature weak completion WHILE THE PTY WAS STILL GENERATING. Returns true when the PTY is still
+    // active — i.e. the adapter reports a pending response OR raw PTY output arrived within the last
+    // ANTIGRAVITY_HOLD_QUIET_DWELL_MS — meaning the 30s cap must KEEP HOLDING (the turn is not proven
+    // over). Returns false when the PTY is genuinely quiescent (no pending response AND no recent
+    // output), so a real tool-only turn with no assistant bubble still force-emits a weak completion
+    // rather than wedging. The absolute ANTIGRAVITY_HOLD_HARD_CAP_MS bound is enforced at the call site
+    // so a runaway PTY that never falls quiet still eventually releases. Fails OPEN (returns false =
+    // allow release) when lastOutputAt is unreadable, so the gate can never wedge a session.
+    private antigravityHoldPtyStillActive(): boolean {
+        if (this.hasAdapterPendingResponse()) return true;
+        try {
+            const outStatus = this.adapter.getStatus({ allowParse: false }) as any;
+            const lastOutputAt = typeof outStatus?.lastOutputAt === 'number' && Number.isFinite(outStatus.lastOutputAt)
+                ? outStatus.lastOutputAt as number
+                : undefined;
+            if (typeof lastOutputAt === 'number') {
+                const quietMs = Date.now() - lastOutputAt;
+                if (quietMs < ANTIGRAVITY_HOLD_QUIET_DWELL_MS) return true;
+            }
+        } catch { /* defensive: dwell read is best-effort — fall through to allow release */ }
+        return false;
+    }
+
     private shouldSuppressStaleParsedBusyStatus(parsedStatus: any, adapterStatus: any): boolean {
         const parsedRawStatus = typeof parsedStatus?.status === 'string' ? parsedStatus.status.trim() : '';
         const adapterRawStatus = typeof adapterStatus?.status === 'string' ? adapterStatus.status.trim() : '';
@@ -2751,6 +2790,42 @@ export class CliProviderInstance implements ProviderInstance {
                 this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
                 return;
             }
+            // (ANTIGRAVITY-30S-CAP-PREMATURE) The 30s cap has been reached for an antigravity
+            // `holdForTranscript` block. The cap releases on ELAPSED TIME, not proof-of-idle — but
+            // antigravity is native-source (assistant answer in native-history) with a PTY-derived
+            // idle verdict, so the transcript's final assistant bubble can legitimately land past 30s
+            // on a long turn. Releasing here would fire a premature weak completed/idle to the
+            // coordinator WHILE THE PTY IS STILL GENERATING (the live-reproduced defect). Gate the
+            // release on the PTY being genuinely quiet: if it is still active (adapter pending
+            // response OR raw output within ANTIGRAVITY_HOLD_QUIET_DWELL_MS) and we are under the
+            // absolute ANTIGRAVITY_HOLD_HARD_CAP_MS bound, KEEP HOLDING (re-probe next retry — the
+            // transcript branch above clears the block for a genuine emit once the answer lands).
+            // A genuinely quiescent tool-only turn (no assistant bubble, PTY stable) falls through
+            // to the existing weak force-emit; a runaway PTY that never quiets releases at the hard
+            // cap so it cannot wedge forever. Scoped to antigravity holdForTranscript so
+            // claude-cli/codex-cli completion timing is unchanged.
+            if (this.type === 'antigravity-cli'
+                && block.holdForTranscript === true
+                && waitedMs < ANTIGRAVITY_HOLD_HARD_CAP_MS
+                && this.antigravityHoldPtyStillActive()) {
+                if (pending.loggedBlockReason !== 'antigravity_hold_pty_active') {
+                    LOG.info('CLI', `[${this.type}] 30s cap reached but PTY still generating; holding antigravity completion past cap (waitedMs=${waitedMs} hardCap=${ANTIGRAVITY_HOLD_HARD_CAP_MS}) (${blockReason})`);
+                    if (this.isMeshWorkerSession()) {
+                        traceMeshEventDrop('completion_gate_hold', this.meshTraceCtx(), `antigravity_hold_pty_active waited=${waitedMs}ms`);
+                    }
+                    if (this.completionTraceOn()) this.recordCompletionGateTrace('hold', {
+                        blockReason,
+                        latestVisibleStatus,
+                        terminal: block.terminal === true,
+                        holdForTranscript: true,
+                        antigravityPtyStillActive: true,
+                        waitedMs,
+                    });
+                    pending.loggedBlockReason = 'antigravity_hold_pty_active';
+                }
+                this.scheduleCompletedDebounceFlush(COMPLETED_FINALIZATION_RETRY_MS);
+                return;
+            }
             const emittedAfterFinalizationTimeout = waitedMs >= COMPLETED_FINALIZATION_MAX_WAIT_MS;
             const completionDiagnostic = this.buildCompletedFinalizationDiagnostic({
                 blockReason,
@@ -3885,6 +3960,47 @@ export class CliProviderInstance implements ProviderInstance {
             this.lastStatus = newStatus;
         }
 
+        // INTERACTIVE-PROMPT-PUSH: fire a push-worthy notification when the session
+        // ENTERS an AskUserQuestion / waiting_choice state. This is orthogonal to the
+        // status-change block above: an AskUserQuestion prompt is surfaced only as a
+        // display-only `waiting_choice` overlay in getState() (mirrored here off
+        // adapterStatus.activeInteractivePrompt, the exact signal getState uses), while
+        // the raw adapter status stays idle/generating — so none of the status-keyed
+        // arms above ever emit an agent:* event for it and the owner gets no web-push.
+        //
+        // We REUSE agent:waiting_approval (the question message as modalMessage, the
+        // choice labels as modalButtons) so the existing server push path fires with
+        // zero cloud change — the semantics ("the agent needs your input") match.
+        //
+        // Edge-triggered: emit exactly once on entry, keyed on promptId + question text,
+        // and reset the key when the prompt clears so a fresh prompt re-fires and a later
+        // real completion still flows through the idle arm normally. We do NOT emit when
+        // the session is ALSO in a genuine approval state (newStatus === 'waiting_approval'):
+        // that arm already emits agent:waiting_approval, and firing here too would double
+        // up on the same modal.
+        const interactivePrompt = adapterStatus.activeInteractivePrompt ?? null;
+        if (interactivePrompt && newStatus !== 'waiting_approval') {
+            const firstQuestion = interactivePrompt.questions?.[0];
+            const promptKey = `${interactivePrompt.promptId}::${firstQuestion?.question ?? ''}`;
+            if (promptKey !== this.lastInteractivePromptEventKey) {
+                this.lastInteractivePromptEventKey = promptKey;
+                const modalMessage = firstQuestion
+                    ? (firstQuestion.header
+                        ? `${firstQuestion.header}: ${firstQuestion.question}`
+                        : firstQuestion.question)
+                    : undefined;
+                const modalButtons = firstQuestion?.options?.map((option: { label: string }) => option.label);
+                this.pushEvent({
+                    event: 'agent:waiting_approval', chatTitle, timestamp: now,
+                    modalMessage,
+                    modalButtons,
+                });
+            }
+        } else if (!interactivePrompt && this.lastInteractivePromptEventKey) {
+            // Prompt answered / gone — reset so the next AskUserQuestion re-fires.
+            this.lastInteractivePromptEventKey = '';
+        }
+
         // GENERATING-BOUNDARY idle-stayed collapse (R4b): the starting→idle
         // fast-collapse arm above only fires when the FIRST turn itself drives the
         // starting→idle transition. When the launch settle already drained