@adhdev/daemon-core 1.0.18-rc.9 → 1.0.19

package/dist/mesh/mesh-active-work.d.ts

@@ -1,7 +1,7 @@
 import type { MeshLedgerEntry } from './mesh-ledger.js';
 import type { MeshWorkQueueEntry, DirectDispatchRecord } from './mesh-work-queue.js';
 export type MeshActiveWorkSource = 'queue' | 'direct';
-export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval';
+export type MeshActiveWorkStatus = 'pending' | 'assigned' | 'generating' | 'idle' | 'failed' | 'awaiting_approval' | 'awaiting_choice';
 export interface MeshActiveWorkRecord {
     taskId: string;
     source: MeshActiveWorkSource;

package/dist/mesh/mesh-ledger.d.ts

@@ -15,7 +15,7 @@
 import { EventEmitter } from 'events';
 import { MeshRuntimeStore } from './mesh-runtime-store.js';
 import { type MeshLedgerOriginatingCoordinatorV2 } from './contracts.js';
-export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection' | 'worktree_cleanup_candidate';
+export type MeshLedgerKind = 'task_dispatched' | 'task_completed' | 'task_failed' | 'task_stalled' | 'task_approval_needed' | 'task_question_pending' | 'p2p_dispatch_failed' | 'session_launched' | 'session_auto_launch' | 'session_stopped' | 'checkpoint_created' | 'node_cloned' | 'node_joined' | 'node_removed' | 'coordinator_started' | 'recovery_attempted' | 'ledger_replicated' | 'ledger_reconciled' | 'direct_fast_forward' | 'delivery_unroutable' | 'direct_dispatch_pruned' | 'event_held' | 'event_held_requeued' | 'task_reclaimed' | 'coordinator_operating_note' | 'coordinator_operating_note_tombstone' | 'mission_created' | 'mission_status_changed' | 'mission_goal_updated' | 'magi_dispatched' | 'magi_synthesis' | 'key_injection' | 'worktree_cleanup_candidate';
 export interface MeshLedgerEntry {
     id: string;
     meshId: string;

package/dist/mesh/mesh-node-identity.d.ts

@@ -107,6 +107,29 @@ export declare function resolveEffectiveMeshNodeHealth(node: any): string;
  * replica that can never run.
  */
 export declare function isMeshNodeHealthLaunchable(node: any): boolean;
+/**
+ * Launch FRESHNESS gate — distinct from the health gate above.
+ *
+ * `deriveMeshNodeHealthFromGit` reports a clean-tree node with `behind > 0` as
+ * 'online', so the health gate (isMeshNodeHealthLaunchable) happily lets a STALE
+ * node — one whose branch is N commits behind its upstream — win auto-launch fitness
+ * routing and run a fresh worker against out-of-date code. `behind` is deliberately
+ * NOT folded into deriveMeshNodeHealthFromGit because "behind" is not universally
+ * unhealthy (the MAGI planner and other callers share that resolver); it is only
+ * unhealthy for *spawning new work*. This gate encodes exactly that launch-time axis.
+ *
+ * Returns false (NOT fresh → skip / de-rank) only when git telemetry is PRESENT and
+ * proves staleness:
+ *   - behind count exceeds `maxBehind` (default 0 — any behind blocks), OR
+ *   - a submodule is out of sync (gitlink points off upstream — cannot be caught up
+ *     by a simple worktree ff and would launch against a mismatched submodule).
+ *
+ * When telemetry is absent it returns true (fresh), preserving the online/unknown-pass
+ * philosophy: we never block on missing data, only on data that proves the node stale.
+ */
+export declare function isMeshNodeFreshEnoughToLaunch(node: any, opts?: {
+    maxBehind?: number;
+}): boolean;
 export declare function applyInlineMeshBranchConvergence(mesh: any, node: any, status: Record<string, unknown>): void;
 export declare function summarizeInlineMeshBranchConvergence(nodes: Array<Record<string, unknown>>): Record<string, unknown>;
 export declare function readCachedInlineMeshActiveSessions(node: any): string[];

package/dist/mesh/mesh-refine-gates.d.ts

@@ -504,6 +504,95 @@ type GitlinkTrivialFastForwardEvaluation = {
  * gate.
  */
 export declare function collectFastForwardGitlinkPaths(repoRoot: string, baseHead: string, branchHead: string): string[];
+export type SubmoduleGitlinkConvergeResult = {
+    /** True when at least one diverged gitlink submodule was rebased onto its base-side commit. */
+    converged: boolean;
+    /**
+     * Set when convergence was declined/aborted (fail-safe → caller keeps the
+     * original defer→blocked_review path). One of:
+     *   no_changed_gitlinks — no gitlink differs base↔branch
+     *   not_diverged        — the gitlink is ff/behind/equal (gate handles it)
+     *   rebase_conflict     — replaying branch-side onto base-side hit a real
+     *                         content conflict inside the submodule (aborted)
+     */
+    reason?: string;
+    /**
+     * Converged gitlinks: path → the rebased submodule commit (SUBNEW) that the
+     * root rebase must resolve the gitlink conflict to. Only populated for paths
+     * whose submodule was successfully rebased (base-side is now a strict ancestor).
+     */
+    resolutions: Array<{
+        path: string;
+        baseCommit: string;
+        branchCommit: string;
+        rebasedCommit: string;
+    }>;
+    /** Per-path outcome for observability/logging. */
+    gitlinks: Array<{
+        path: string;
+        baseCommit?: string;
+        branchCommit?: string;
+        rebasedCommit?: string;
+        action: 'rebased' | 'skipped_not_diverged' | 'rebase_conflict';
+    }>;
+};
+/**
+ * STEP 1 of auto-converging diverged oss-style submodule gitlinks: rebase the
+ * branch-side submodule commit(s) onto the base-side submodule commit INSIDE the
+ * worktree's submodule checkout (detached HEAD), so the base-side commit becomes a
+ * strict ancestor of the rebased tip. Returns the rebased commit per path so the
+ * caller's root rebase can resolve the gitlink conflict to it (STEP 2, see
+ * {@link rootRebaseResolvingGitlinks}). This automates the documented manual
+ * strict-fast-forward bypass and keeps the landed submodule history linear rather
+ * than masking a divergence.
+ *
+ * Fail-safe by construction: it only touches gitlinks that are a genuine sibling
+ * divergence (both commits local, neither an ancestor of the other, shared merge
+ * base). A submodule rebase content conflict aborts, restores the branch-side
+ * checkout, and returns `converged:false` (caller keeps defer→blocked_review). It
+ * never commits the root and NEVER pushes — remote publish is the merge/
+ * reachability stage's job; this stage is local reconciliation only.
+ *
+ * @param worktreeRoot the branch worktree root (its `<path>` submodule checkout is rebased)
+ * @param baseRepoRoot the source/base repo root (reads the base-side gitlink commit)
+ * @param baseHead     the fetched base head (root ref) — source of base-side gitlink commits
+ * @param branchHead   the worktree branch head (root ref) — source of branch-side gitlink commits
+ */
+export declare function convergeDivergedSubmoduleGitlinks(worktreeRoot: string, baseRepoRoot: string, baseHead: string, branchHead: string): SubmoduleGitlinkConvergeResult;
+export type RootRebaseGitlinkResolveResult = {
+    /** True when the root rebase completed (with gitlink conflicts resolved to the converged commits). */
+    ok: boolean;
+    /** New root HEAD after the rebase (only meaningful when ok). */
+    branchHead?: string;
+    /**
+     * Set when the rebase was aborted (fail-safe). One of:
+     *   non_gitlink_conflict — a conflict on a non-submodule path (genuine content conflict)
+     *   unexpected_gitlink   — a gitlink conflicted that we have no converged commit for
+     *   rebase_error         — the rebase failed for a non-conflict reason
+     */
+    reason?: string;
+    /** The paths that conflicted at the point of abort (for diagnostics). */
+    conflictPaths?: string[];
+};
+/**
+ * STEP 2 of auto-converging diverged submodule gitlinks: rebase the worktree root
+ * branch onto `baseHead`, resolving each submodule-gitlink conflict to the
+ * pre-converged commit from {@link convergeDivergedSubmoduleGitlinks}. git's
+ * recursive merge refuses to auto-merge a diverged gitlink ("Recursive merging
+ * with submodules currently only supports trivial cases"), so we drive the rebase
+ * ourselves: on each stop, if the ONLY unmerged paths are gitlinks we have a
+ * converged commit for, we stage those to the converged commit and `--continue`.
+ * Any non-gitlink conflict (or a gitlink with no converged commit) aborts the
+ * rebase and returns `ok:false` → caller keeps the defer→blocked_review path.
+ *
+ * On success the base-side gitlink is a strict ancestor of the resolved branch-side
+ * commit, so the downstream patch-equivalence gate treats it as a trivial
+ * fast-forward and passes.
+ */
+export declare function rootRebaseResolvingGitlinks(worktreeRoot: string, baseHead: string, resolutions: Array<{
+    path: string;
+    rebasedCommit: string;
+}>): RootRebaseGitlinkResolveResult;
 /**
  * Decide whether a merge-tree submodule conflict between base and branch is a
  * trivial gitlink fast-forward (and nothing else).

package/dist/mesh/mesh-remote-event-pull.d.ts

@@ -1,6 +1,9 @@
 import type { DaemonComponents } from '../boot/daemon-lifecycle.js';
 import type { LocalMeshEntry } from '../repo-mesh-types.js';
 export declare function pullRemoteNodeQueues(components: DaemonComponents, mesh: LocalMeshEntry, localDaemonId: string | undefined, candidateDaemonIds: string[]): Promise<void>;
+export declare function pullPendingEventsFromNode(components: DaemonComponents, meshId: string, node: {
+    daemonId?: string;
+}, localDaemonId: string | undefined, candidateDaemonIds: string[], pulls: Array<Record<string, unknown>>): Promise<void>;
 export declare function unwrapReadChatPayload(raw: unknown): Record<string, unknown> | null;
 export declare function readChatPayloadStatus(payload: Record<string, unknown> | null): string;
 export declare function realTerminalEmitPendingForTask(meshId: string, taskId: string): boolean;

package/dist/mesh/mesh-work-queue.d.ts

@@ -337,7 +337,15 @@ export type DependencyFailurePolicy = 'block' | 'cancel';
  * Update the status of a specific task.
  * Used when a session completes, fails, or stalls.
  */
-export declare function updateTaskStatus(meshId: string, taskId: string, status: MeshTaskStatus, opts?: MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+export declare function updateTaskStatus(meshId: string, taskId: string, status: MeshTaskStatus, opts?: {
+    /**
+     * CANCEL-STICKY-TERMINAL: operator/system override to permit a terminal→non-terminal
+     * transition (e.g. an explicit operator reopen). Without this, a write that would flip
+     * a `completed`/`failed`/`cancelled` row back to `pending`/`assigned` is refused as a
+     * no-op. Terminal→terminal and any transition FROM a non-terminal state are unaffected.
+     */
+    force?: boolean;
+} & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
 export declare function recordTaskAutoLaunch(meshId: string, taskId: string, autoLaunch: Omit<NonNullable<MeshWorkQueueEntry['autoLaunch']>, 'updatedAt'>): MeshWorkQueueEntry | null;
 /**
  * Mark a queue task as manually cancelled without deleting audit history.
@@ -345,6 +353,21 @@ export declare function recordTaskAutoLaunch(meshId: string, taskId: string, aut
 export declare function cancelTask(meshId: string, taskId: string, opts?: {
     reason?: string;
 } & MeshQueueMutationOptions): MeshWorkQueueEntry | null;
+/**
+ * CANCEL-STICKY-TERMINAL: the assignment a task carried at cancel time, handed to the cancel
+ * command handler so it can stop the bound worker. cancelTask runs in the pure queue-store
+ * module (no DaemonComponents), so it records the binding here and the handler drains it.
+ */
+export interface CancelledTaskAssignment {
+    sessionId: string;
+    nodeId?: string;
+    providerType?: string;
+}
+/**
+ * Read-and-clear the assignment a just-cancelled task was bound to. Returns undefined when the
+ * cancelled task had no live assignment (nothing to stop). One-shot: the entry is deleted on read.
+ */
+export declare function takeCancelledTaskAssignment(meshId: string, taskId: string): CancelledTaskAssignment | undefined;
 /**
  * Return a queue task to pending for retry. By default, dead session targeting
  * and assigned ownership are cleared so stale assignments do not strand again.

package/dist/providers/auto-approve-modes.d.ts

@@ -0,0 +1,14 @@
+import type { AutoApproveMode, AutoApproveModeRisk, AutoApproveModeStrategy, ProviderModule } from './contracts.js';
+export interface ResolvedAutoApproveMode {
+    active: boolean;
+    strategy: AutoApproveModeStrategy;
+    modeId: string;
+}
+/** Runtime defense-in-depth for provider definitions that bypass schema validation. */
+export declare function deriveAutoApproveModeRisk(mode: Pick<AutoApproveMode, 'risk' | 'launchArgs'>): AutoApproveModeRisk;
+/**
+ * Resolve new mode settings before the legacy boolean. A stale/unknown explicit
+ * mode id fails closed instead of falling through to an enabled legacy setting.
+ */
+export declare function resolveProviderAutoApproveMode(provider: ProviderModule, settings: Record<string, unknown> | undefined): ResolvedAutoApproveMode;
+export declare function findProviderAutoApproveMode(provider: ProviderModule | undefined, modeId: string): AutoApproveMode | undefined;

package/dist/providers/chat-message-normalization.d.ts

@@ -58,6 +58,28 @@ export declare function extractFinalAssistantSummaryEvidence(messages: ChatMessa
  * grace gate) on top of this structural check.
  */
 export declare function selectFinalAssistantTurnEndMessage(messages: ChatMessage[] | null | undefined): ChatMessage | null;
+/**
+ * EARLY-IDLE-COMPLETION-FALSE-POSITIVE — trailing tool/terminal activity detector.
+ *
+ * True when the transcript's LAST non-empty user-facing assistant bubble is followed
+ * by one or more TOOL / TERMINAL activity bubbles (a tool_use/command the assistant
+ * fired AFTER its text) — i.e. the assistant emitted a preamble ("Let me explore…"),
+ * then started running Read/Grep, so the turn is still executing and its answer has
+ * not landed. Callers that would otherwise promote that preamble to a turn-end summary
+ * off a momentary (startup-grace / inter-tool) idle read use this as a veto.
+ *
+ * Deliberately NARROW so the pure-PTY completion rescue is preserved:
+ *   - Only TOOL/TERMINAL activity trailing the assistant vetoes. A trailing THOUGHT or
+ *     status bubble does NOT (a finished turn can end on an internal thought), matching
+ *     selectFinalAssistantTurnEndMessage's skip set minus the "still-working" signals.
+ *   - A genuinely FINISHED worker (final assistant last, no trailing tool activity —
+ *     the kimi pure-PTY continuous-idle shape) returns false, so its early completion
+ *     is untouched.
+ *
+ * Returns false when there is no final assistant bubble at all (the caller's
+ * selectFinalAssistantTurnEndMessage already handles that as "not a turn end").
+ */
+export declare function hasTrailingToolActivityAfterFinalAssistant(messages: ChatMessage[] | null | undefined): boolean;
 export declare const BUILTIN_CHAT_MESSAGE_KINDS: readonly ["standard", "thought", "tool", "terminal", "system"];
 export type BuiltinChatMessageKind = typeof BUILTIN_CHAT_MESSAGE_KINDS[number];
 export type ChatMessageKind = BuiltinChatMessageKind | (string & {});

package/dist/providers/cli-provider-instance-types.d.ts

@@ -19,6 +19,7 @@ export type CompletedFinalizationBlock = {
     terminal?: boolean;
     allowTimeout?: boolean;
     holdForTranscript?: boolean;
+    noExternalTranscriptSource?: boolean;
 };
 export type CompletionFinalAssistantEvidence = {
     present: boolean;
@@ -37,6 +38,7 @@ export type ExternalTranscriptProbe = {
 };
 export declare const COMPLETED_FINALIZATION_RETRY_MS = 1000;
 export declare const COMPLETED_FINALIZATION_MAX_WAIT_MS = 30000;
+export declare const CANON_C_MISSING_ASSISTANT_MIN_ELAPSED_MS = 20000;
 export declare const NATIVE_HISTORY_MESH_IDLE_SETTLE_MS = 4000;
 export declare const PTY_PARSED_FINAL_ASSISTANT_QUIET_DWELL_MS = 1200;
 export declare const ANTIGRAVITY_HOLD_QUIET_DWELL_MS = 3000;

package/dist/providers/cli-provider-instance.d.ts

@@ -192,6 +192,7 @@ export declare class CliProviderInstance implements ProviderInstance {
     private meshStallEmittedForAnchor;
     private meshStallTurnActiveLast;
     private meshStallLastFiredAt;
+    private meshStallNativeTranscriptSample;
     private busyEpoch;
     private fastCollapseSynthesizedTaskId;
     private startupGraceCollapseAt;
@@ -424,6 +425,7 @@ export declare class CliProviderInstance implements ProviderInstance {
      * once at completion). Reset on the next turn's start.
      */
     private lastCompletionSummary;
+    private lastEmittedCompletion;
     private enforceFreshSessionLaunchIfNeeded;
     /**
      * BRAIN-ROUTING (runtime-control thinking axis): for a provider that selects
@@ -574,6 +576,76 @@ export declare class CliProviderInstance implements ProviderInstance {
      * starts with a clean slate (a restart is not throttled by a prior stall).
      */
     private resetMeshStallEpisode;
+    /**
+     * KIMI-MESH-COMPLETION-EMIT (axis 1). For a native-source provider
+     * (transcriptAuthority=provider — its authoritative history is an on-disk
+     * transcript file, e.g. kimi's wire.jsonl), sample the transcript's current
+     * progress fingerprint (record count + source-file mtime) WITHOUT parsing the
+     * PTY. Used by the stall watchdog to distinguish "PTY render is quiet but the
+     * worker is still doing long tool work (transcript growing)" from a genuine
+     * wedge. Returns null for a pure-PTY provider (no native source) or when the
+     * source cannot be resolved this tick — the caller then falls back to the
+     * unchanged lastOutputAt-only judgment.
+     *
+     * Generalized on the provider's native-source flag, NOT a hardcoded provider
+     * type, so every current and future pure-PTY long-tool native-source provider
+     * benefits. Cheap enough for the stall path: it runs only at the stall threshold
+     * (≥180s of PTY stasis), never on the routine 5s tick.
+     */
+    private sampleNativeTranscriptProgress;
+    /**
+     * KIMI-MESH-COMPLETION-EMIT (axis 2). Last-chance completion emit for a mesh
+     * DELEGATED worker whose PTY has already exited (e.g. killed by a false stall)
+     * and is about to be auto-cleaned (cli-manager.startCliExitMonitor →
+     * removeInstance closes the event-emit window forever). If the worker actually
+     * FINISHED its assigned turn — its authoritative native transcript holds a final
+     * assistant message for the injected task — but the completion event never fired
+     * (the stall-kill happened before the FSM's idle transition), emit it now so the
+     * coordinator learns the task completed instead of waiting ~180s for the reconcile
+     * transcript-poll to reclaim it.
+     *
+     * Scope & guards (must all hold to emit):
+     *   • mesh worker session only — a normal standalone session's ordinary exit is
+     *     never synthesized (isMeshWorkerSession()).
+     *   • DOUBLE-EMIT guard — refuse if this turn's completion already fired
+     *     (lastEmittedCompletion matches the current taskId). A worker that completed
+     *     cleanly and is merely being cleaned up never double-emits.
+     *   • evidence gate — reuse the same final-assistant/turn-scoped summary machinery
+     *     as the normal completion path (completionFinalSummary over the native
+     *     transcript). No in-turn assistant summary ⇒ no proof of completion ⇒ leave
+     *     the reclaim path to handle a genuinely-unfinished worker.
+     *
+     * Returns true when a synthetic completion was emitted, false otherwise. Safe to
+     * call unconditionally from the cleanup path.
+     */
+    flushMeshCompletionBeforeCleanup(): boolean;
+    /**
+     * KIMI-PURE-PTY-COMPLETION-EMIT (Fix 3): stall-path completion reconcile for the
+     * PURE-PTY transcript class (kimi and kin — no native transcript, no provider
+     * authority; see isPurePtyTranscriptProvider). Such a worker whose
+     * generating_completed never emitted (the onTurnStarted idle→idle collapse Fix 1
+     * fixes at the source) sits at a STATIC idle prompt: its PTY output stops the
+     * instant the answer is rendered, so the status-agnostic no-progress watchdog
+     * (checkMeshWorkerStall) reads the finished-but-quiet session as a stall and would
+     * false-fire monitor:no_progress. The native-transcript reconcile
+     * (sampleNativeTranscriptProgress) does NOT cover this class (no native source →
+     * null sample), so the stall path needs its own guard.
+     *
+     * Called from checkMeshWorkerStall just before the fire. Returns true when the
+     * session is a finished pure-PTY turn — idle, no pending response, and a PTY-parsed
+     * in-turn final assistant summary — in which case it emits the missing
+     * generating_completed (idempotent: a real/late emit writes the terminal ledger and
+     * the coordinator's reconcile makes any duplicate a no-op) and the caller SUPPRESSES
+     * the stall. Returns false for every other class/state (native-source provider, a
+     * genuinely mid-turn or wedged worker with no final assistant), so a real stall still
+     * fires unchanged.
+     *
+     * Evidence bar is identical to flushMeshCompletionBeforeCleanup: injected task's turn
+     * genuinely started + an in-turn final assistant summary. Conservative by
+     * construction — no summary ⇒ no proof of completion ⇒ return false and let the real
+     * stall fire.
+     */
+    private tryReconcilePurePtyCompletionForStall;
     /**
      * AUTOAPPROVE-FLAP-RECUR (Fix A+B): how long a busy blip / modal scroll-out may
      * persist before the in-progress settle gate is torn down. For a delegated
@@ -738,7 +810,11 @@ export declare class CliProviderInstance implements ProviderInstance {
     getAdapter(): ProviderCliAdapter;
     get cliType(): string;
     get cliName(): string;
+    private resolveAutoApproveMode;
+    /** Legacy boolean view retained for internal/test compatibility. */
     private shouldAutoApprove;
+    private shouldUsePtyAutoApprove;
+    private resetPtyAutoApproveState;
     /** @see ProviderInstance.noteManualInteraction */
     noteManualInteraction(now?: number, opts?: {
         passive?: boolean;

package/dist/providers/contracts.d.ts

@@ -389,6 +389,21 @@ export interface ProviderCompatibilityEntry {
     ideVersion: string;
     scriptDir: string;
 }
+export type AutoApproveModeStrategy = 'pty-parse-default' | 'launch-args' | 'post-boot-command';
+export type AutoApproveModeRisk = 'safe' | 'caution' | 'dangerous';
+export interface AutoApproveMode {
+    id: string;
+    label: string;
+    strategy: AutoApproveModeStrategy;
+    risk: AutoApproveModeRisk;
+    warning?: string;
+    launchArgs?: string[];
+    removeArgs?: string[];
+}
+export interface AutoApproveModesConfig {
+    default: string;
+    modes: AutoApproveMode[];
+}
 export interface ProviderModule {
     /** Unique identifier (e.g. 'cline', 'cursor', 'gemini-cli') */
     type: string;
@@ -418,6 +433,8 @@ export interface ProviderModule {
     status?: string;
     /** Inventory/support detail string maintained in adhdev-providers */
     details?: string;
+    /** Provider-specific auto-approve choices and their launch/runtime strategy. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** Install instructions (shown when command is missing) */
     install?: string;
     /** Custom version detection command (e.g. 'cursor --version', 'claude -v') */

package/dist/providers/provider-schema.d.ts

@@ -3,3 +3,4 @@ export interface ProviderValidationResult {
     warnings: string[];
 }
 export declare function validateProviderDefinition(raw: unknown): ProviderValidationResult;
+export declare function validateAutoApproveModes(raw: unknown, errors: string[]): void;

package/dist/providers/sdk/v1/builders/cli/detect-status.d.ts

@@ -75,6 +75,20 @@ export interface DetectStatusTuiSpec {
 declare function scopeText(input: CliStatusInput, scope: SpinnerSpec['scope'] | SettledPromptSpec['scope'], windowLines: number | undefined): string;
 declare function spinnerMatches(spec: SpinnerSpec, input: CliStatusInput): boolean;
 declare function settledPromptMatches(spec: SettledPromptSpec, input: CliStatusInput): boolean;
+/**
+ * APPROVAL-PICKER-MISROUTE (mission f1d25e11) defense-in-depth: an
+ * AskUserQuestion multi-choice picker is NOT an approval modal. Its option rows
+ * ("❯ 1. label") can otherwise satisfy the approval button cue and get
+ * mis-classified as `waiting_approval`, so the worker's question is surfaced to
+ * the coordinator as a task_approval_needed (→ mesh_approve, which cannot answer
+ * it). The picker carries a distinctive signature the approval FSM never does:
+ * the claude TUI select footer ("Enter to select … Esc to cancel") together with
+ * the freeform escape hatch ("Type something" / "Chat about this"). When both are
+ * present the screen is a question picker — surfaced separately as
+ * waiting_choice — so the approval matchers must yield. Mirrors the legacy
+ * looksLikeSelectionPicker guard (cli-provider-instance.ts) ported to SDK-v1.
+ */
+export declare function isAskUserQuestionPickerSignature(text: string): boolean;
 declare function modalMatches(spec: ModalSpec, input: CliStatusInput): boolean;
 export declare function buildDetectStatusFromTui(spec: DetectStatusTuiSpec): CliDetectStatusFn;
 export declare const __internal: {

package/dist/providers/types/interactive-prompt.d.ts

@@ -28,6 +28,24 @@ export interface InteractiveAnswer {
 }
 export declare function normalizeInteractivePrompt(raw: unknown): InteractivePrompt | null;
 export declare function normalizeInteractivePromptResponse(raw: unknown): InteractivePromptResponse;
+/**
+ * Resolve a coordinator-friendly answer form into the strict, questionId-keyed
+ * InteractivePromptResponse the TUI/answer machinery consumes (mission f1d25e11).
+ *
+ * mesh_answer_question lets the coordinator answer against the option LABELS or
+ * 1-based INDEXES it saw in the agent:waiting_choice event, without having to
+ * reconstruct the exact questionId → selectedLabels map. This resolves that
+ * ergonomic form against the AUTHORITATIVE active prompt (the daemon holds it),
+ * so index/label resolution and question ordering are correct by construction.
+ *
+ * Accepted `raw` shapes:
+ *   - The strict form ({ promptId, answers: { [questionId]: { selectedLabels } } })
+ *     — passed straight to normalizeInteractivePromptResponse (back-compat).
+ *   - The friendly form ({ promptId, answers: [ { questionId?, select?, freeform? } ] })
+ *     — entries map to questions by questionId, else by array position. `select`
+ *     is a label (string) / 1-based index (number) / array of either.
+ */
+export declare function resolveInteractivePromptResponse(prompt: InteractivePrompt, raw: unknown): InteractivePromptResponse;
 export declare function buildClaudeInteractiveToolResult(response: InteractivePromptResponse): string;
 export interface ClaudeInteractiveTuiPage {
     screenText: string;

package/dist/repo-mesh-types.d.ts

@@ -14,6 +14,8 @@ import type { GitRepoStatus, GitCompactSummary } from './git/git-types.js';
 import type { MeshMissionSummary, MeshMissionSlimSummary } from './mesh/mesh-missions.js';
 import type { MeshMagiActivitySummary } from './mesh/mesh-magi-status.js';
 import type { MagiKindPanelMap, DifficultyBrainMap, NodeCapabilitySlot } from '@adhdev/mesh-shared';
+import type { ProviderModule } from './providers/contracts.js';
+import type { RepoMeshDeclarativeConfig } from './config/mesh-json-config.js';
 export interface RepoMesh {
     id: string;
     name: string;
@@ -255,6 +257,8 @@ export interface RepoMeshPolicy {
      * A node policy may override this per-node (RepoMeshNodePolicy.delegatedWorkerAutoApprove).
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Explicit opt-in required before delegated workers may use a dangerous provider mode. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): opt-in to allow the coordinator to inject
      * DESTRUCTIVE keys (CTRL_C / ESC) into a worker PTY via mesh_send_keys. These
@@ -406,6 +410,8 @@ export interface RepoMeshNodePolicy {
      * precedence over the mesh-level policy for worker sessions launched onto this node.
      */
     delegatedWorkerAutoApprove?: boolean;
+    /** Per-node override for dangerous delegated worker mode authorization. */
+    delegatedWorkerDangerousModeAllow?: boolean;
     /**
      * MESH-SEND-KEYS (feature 3): per-node override for
      * RepoMeshPolicy.allowSendKeysDestructive.
@@ -524,13 +530,39 @@ export declare function normalizeAutoFastForwardPolicy(value: unknown): NonNulla
  */
 export declare function mergeAndNormalizePolicy(base: RepoMeshPolicy | undefined, patch: Partial<RepoMeshPolicy> | undefined): RepoMeshPolicy;
 /**
- * Resolve whether a delegated worker session launched onto `nodePolicy` (within a mesh
- * governed by `meshPolicy`) should auto-approve. Precedence: node override → mesh policy
- * → default true. The result is stamped into the worker launch settings envelope as
- * `autoApprove`; it wins over the global per-provider-type autoApprove config because the
- * launch path merges the envelope as a settingsOverride on top of the provider defaults.
+ * Resolve delegated worker auto-approve. Legacy providers return a boolean. Providers
+ * with modes return a mode id, except a dangerous mode is downgraded to a
+ * non-dangerous PTY mode unless mesh/node policy explicitly opts in.
+ *
+ * THREE EXPLICIT STAGES — do not collapse them; the ordering is a hard MAGI
+ * invariant:
+ *
+ *   ① ENABLE gate (machine-local policy only): node boolean > mesh boolean.
+ *      `enabled=false` returns `false` IMMEDIATELY, BEFORE any mode selection.
+ *      The repo `mesh.json` providerDefaults has ZERO influence here — a
+ *      node/mesh opt-out is never overridden by a repo-declared requested mode.
+ *
+ *   ② MODE selection (only when enabled === true):
+ *        task override [FUTURE — param reserved below, not yet wired] >
+ *        repo mesh.json providerDefaults.autoApproveModes[providerType] >
+ *        provider spec autoApproveModes.default.
+ *      A repo-requested mode ID is adopted ONLY when it exists in the provider's
+ *      own `autoApproveModes.modes`; an unknown/stale/typo'd ID is IGNORED and we
+ *      fall back to the provider default (fail-closed: never coerce into a
+ *      dangerous mode via a bad ID).
+ *
+ *   ③ DANGEROUS gate: whichever mode stage ② picked, if it is dangerous and the
+ *      machine-local delegatedWorkerDangerousModeAllow is not set, downgrade to a
+ *      non-dangerous PTY-parse mode (or `false` if none exists).
  */
-export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove'> | null): boolean;
+export declare function resolveDelegatedWorkerAutoApprove(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null, repoConfig?: RepoMeshDeclarativeConfig | null, providerType?: string | null): boolean | string;
+export declare function resolveDelegatedWorkerDangerousModeAllow(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerDangerousModeAllow'> | null): boolean;
+/** Shape a boolean-or-mode resolution for the settings precedence contract. */
+export declare function delegatedWorkerAutoApproveSettings(meshPolicy?: Pick<RepoMeshPolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, nodePolicy?: Pick<RepoMeshNodePolicy, 'delegatedWorkerAutoApprove' | 'delegatedWorkerDangerousModeAllow'> | null, provider?: Pick<ProviderModule, 'autoApproveModes'> | null, repoConfig?: RepoMeshDeclarativeConfig | null, providerType?: string | null): {
+    autoApprove: boolean | undefined;
+    autoApproveMode: string | undefined;
+    delegatedWorkerDangerousModeAllow: boolean;
+};
 /**
  * MESH-SEND-KEYS (feature 3): resolve whether DESTRUCTIVE key injection
  * (CTRL_C/ESC via mesh_send_keys) is permitted for a node. Node policy overrides

package/dist/shared-types.d.ts

@@ -13,7 +13,7 @@ export type { ProviderState, ProviderStatus, ActiveChatData, IdeProviderState, C
 export type { ProviderErrorReason } from './providers/provider-instance.js';
 import type { ActiveChatData as _ActiveChatData, ProviderErrorReason as _ProviderErrorReason } from './providers/provider-instance.js';
 import type { WorkspaceEntry } from './config/workspaces.js';
-import type { ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
+import type { AutoApproveModesConfig, ProviderMeshCoordinatorConfig, ProviderResumeCapability } from './providers/contracts.js';
 import type { GitCompactSummary, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams } from './git/git-types.js';
 import type { InteractivePrompt } from './providers/types/interactive-prompt.js';
 export type { GitCommandName, GitCompactSummary, GitDiffSummary, GitFailureReason, GitFileChange, GitFileChangeStatus, GitRepoIdentity, GitRepoStatus, GitSnapshot, GitSnapshotCompareSummary, GitSnapshotReason, GitWorkspaceUpdate, WorkspaceGitSubscriptionParams, } from './git/git-types.js';
@@ -428,6 +428,8 @@ export interface AvailableProviderInfo {
     lastVerification?: MachineProviderCheckResult;
     /** Provider-declared Repo Mesh coordinator/MCP behavior. */
     meshCoordinator?: ProviderMeshCoordinatorConfig;
+    /** Provider-declared auto-approve choices shown by session launch UIs. */
+    autoApproveModes?: AutoApproveModesConfig;
     /** BRAIN-ROUTING: suggested model values for the new-session model dropdown. */
     modelOptions?: string[];
     /** BRAIN-ROUTING: reasoning-effort values for the new-session thinking dropdown. */
@@ -624,7 +626,7 @@ export interface DashboardBootstrapDaemonEntry extends Partial<CloudDaemonSummar
     p2p?: StatusReportPayload['p2p'];
     timestamp?: number;
 }
-export type DaemonStatusEventName = 'agent:generating_started' | 'agent:waiting_approval' | 'agent:generating_completed' | 'agent:stopped' | 'monitor:no_progress' | 'monitor:long_generating';
+export type DaemonStatusEventName = 'agent:generating_started' | 'agent:waiting_approval' | 'agent:waiting_choice' | 'agent:generating_completed' | 'agent:stopped' | 'monitor:no_progress' | 'monitor:long_generating';
 /** Minimal daemon-originated event payload relayed through the server. */
 export interface DaemonStatusEventPayload {
     event: DaemonStatusEventName;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "1.0.18-rc.9",
+  "version": "1.0.19",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "1.0.18-rc.9",
-    "@adhdev/session-host-core": "1.0.18-rc.9",
+    "@adhdev/mesh-shared": "*",
+    "@adhdev/session-host-core": "*",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/cli-adapters/cli-state-engine.ts

@@ -15,6 +15,7 @@ import {
 import {
     buildCliScreenSnapshot,
     compactPromptText,
+    isPurePtyTranscriptProvider,
     normalizePromptText,
     promptLikelyVisible,
     type CliChatMessage,
@@ -361,7 +362,22 @@ export class CliStateEngine {
         // idle transition, unchanged. Scoped to transcriptAuthority:'provider'
         // only, so PTY-authoritative providers (whose spinner/settled parsing
         // already drives generating promptly) are unaffected.
-        if (this.provider.transcriptAuthority === 'provider' && this.currentStatus !== 'waiting_approval') {
+        //
+        // (fix: kimi pure-PTY completion-emit) The pure-PTY full-buffer class
+        // (kimi and kin — see isPurePtyTranscriptProvider) is NOT
+        // transcriptAuthority:'provider', so without this it stays idle when a
+        // prompt is submitted from idle: the FSM never crosses generating→idle,
+        // detectStatusTransition's generating|waiting_approval→idle arm never
+        // runs, and agent:generating_completed is never emitted — the mesh
+        // coordinator leaves the task 'assigned' and the status-agnostic stall
+        // watchdog then false-fires task_stalled on the finished-but-idle
+        // session. Promoting this class to generating on turn-start makes the
+        // existing PTY-parsed final-assistant idle gate produce a real
+        // generating→idle completion edge. Same idle safety as above: applyIdle
+        // / finishResponse still own the actual idle transition.
+        const promoteOnTurnStart = this.provider.transcriptAuthority === 'provider'
+            || isPurePtyTranscriptProvider(this.provider);
+        if (promoteOnTurnStart && this.currentStatus !== 'waiting_approval') {
             this.setStatus('generating', 'turn_started');
             this.callbacks.onStatusChange();
         }

package/src/cli-adapters/provider-cli-adapter.ts

@@ -39,6 +39,7 @@ import {
     compactPromptText,
     estimatePromptDisplayLines,
     extractPromptRetrySnippet,
+    isPurePtyTranscriptProvider,
     listCliScriptNames,
     normalizePromptText,
     normalizeScreenSnapshot,
@@ -456,12 +457,7 @@ export class ProviderCliAdapter implements CliAdapter {
      * provider-owned) so no other provider's turn-scoped parse changes.
      */
     private parsesFullPtyTranscriptFromBuffer(): boolean {
-        if (this.providerOwnsTranscript()) return false;
-        // nativeHistory is a top-level provider field not surfaced on
-        // CliProviderModule; read it via the same structural cast used for `tui`.
-        if ((this.provider as { nativeHistory?: unknown }).nativeHistory) return false;
-        const transcriptPty = (this.provider.tui as { transcriptPty?: { scope?: unknown } } | undefined)?.transcriptPty;
-        return transcriptPty?.scope === 'buffer';
+        return isPurePtyTranscriptProvider(this.provider);
     }
 
     /**