@adhdev/daemon-core 1.0.18-rc.9 → 1.0.19

package/src/cli-adapters/provider-cli-shared.ts

@@ -254,6 +254,54 @@ export interface CliProviderModule {
     _versionWarning?: string | null;
 }
 
+/**
+ * PURE-PTY TRANSCRIPT CLASS predicate (kimi and kin).
+ *
+ * A provider is "pure-PTY full-buffer" when it reconstructs its ENTIRE transcript
+ * from the rendered PTY buffer on every read and has NO alternate transcript
+ * source:
+ *   - transcriptAuthority !== 'provider'  (the daemon PTY parser owns the transcript,
+ *     not a provider-side canonical source)
+ *   - NO nativeHistory              (no on-disk / native-source history to fall back to)
+ *   - tui.transcriptPty.scope === 'buffer' (the parser walks the full rendered buffer)
+ *
+ * This class is invisible to two provider-authority-keyed code paths that other
+ * providers rely on for mesh completion semantics:
+ *   1. CliStateEngine.onTurnStarted only promotes to 'generating' for
+ *      transcriptAuthority==='provider' providers — so a pure-PTY session that
+ *      submits a prompt while already idle collapses idle→idle, the
+ *      generating→idle edge never occurs, and agent:generating_completed is never
+ *      emitted (the coordinator ledger leaves the task 'assigned' forever).
+ *   2. checkMeshWorkerStall's native-transcript completion reconcile is gated on
+ *      the native-source shape, so a finished pure-PTY worker's static idle is
+ *      misread as monitor:no_progress (a false task_stalled).
+ *
+ * The runtime capability, NOT any single spec field value, is authoritative: a
+ * given kimi manifest checkout may declare nativeHistory/transcriptAuthority, but
+ * the live-loaded pure-PTY session has none. Callers that only hold a
+ * CliProviderModule (the engine) share this exact predicate with the adapter
+ * (parsesFullPtyTranscriptFromBuffer) so the two never drift.
+ */
+export function isPurePtyTranscriptProvider(provider: {
+    transcriptAuthority?: 'provider' | 'daemon';
+    nativeHistory?: unknown;
+    tui?: Record<string, unknown>;
+} | null | undefined): boolean {
+    // No provider (e.g. an instance whose module isn't set when the stall watchdog
+    // ticks) ⇒ not the pure-PTY class. Guarding here protects every caller — the
+    // stall-reconcile and turn-start paths pass this.provider unguarded, and
+    // this.provider is genuinely nullable at runtime (see this.provider?.nativeHistory
+    // in cli-provider-instance.ts). Matches resolveLocalSessionPurePty's own
+    // no-provider ⇒ not-pure-PTY contract.
+    if (!provider) return false;
+    if (provider.transcriptAuthority === 'provider') return false;
+    // nativeHistory is a top-level provider field not surfaced on
+    // CliProviderModule; read it via the same structural shape the adapter uses.
+    if (provider.nativeHistory) return false;
+    const transcriptPty = (provider.tui as { transcriptPty?: { scope?: unknown } } | undefined)?.transcriptPty;
+    return transcriptPty?.scope === 'buffer';
+}
+
 function stripAnsi(str: string): string {
     // eslint-disable-next-line no-control-regex
     return str

package/src/commands/cli-manager.ts

@@ -34,6 +34,7 @@ import type { SessionRegistry } from '../sessions/registry.js';
 import type { ProviderInstance } from '../providers/provider-instance.js';
 import { LOG } from '../logging/logger.js';
 import { shouldRestoreHostedRuntime } from './hosted-runtime-restore.js';
+import { findProviderAutoApproveMode, resolveProviderAutoApproveMode } from '../providers/auto-approve-modes.js';
 
 // ─── external dependency interface ──────────────────────────
 
@@ -452,6 +453,40 @@ export function expandThinkingLaunchArgs(
     return template.map((part) => part.includes('{{level}}') ? part.replace('{{level}}', mapped) : part);
 }
 
+function matchesRemovedLaunchArg(arg: string, removeArg: string): boolean {
+    return arg === removeArg || (removeArg.startsWith('--') && arg.startsWith(`${removeArg}=`));
+}
+
+/**
+ * Apply a selected launch-args auto-approve mode without mutating provider metadata.
+ * removeArgs only targets provider-owned base spawn.args; launchArgs are prepended to
+ * per-launch args beside model/thinking args, making conflict removal order-independent.
+ */
+export function applyAutoApproveModeLaunchArgs(
+    provider: ProviderModule | undefined,
+    cliArgs: string[] | undefined,
+    settings: Record<string, unknown> | undefined,
+): { provider: ProviderModule | undefined; cliArgs: string[] | undefined } {
+    if (!provider) return { provider, cliArgs };
+    const resolved = resolveProviderAutoApproveMode(provider, settings);
+    if (!resolved.active || resolved.strategy !== 'launch-args') return { provider, cliArgs };
+    const mode = findProviderAutoApproveMode(provider, resolved.modeId);
+    if (!mode || !Array.isArray(mode.launchArgs) || mode.launchArgs.length === 0) return { provider, cliArgs };
+
+    const removeArgs = Array.isArray(mode.removeArgs) ? mode.removeArgs : [];
+    const baseArgs = provider.spawn?.args;
+    const filteredBaseArgs = Array.isArray(baseArgs) && removeArgs.length > 0
+        ? baseArgs.filter((arg) => !removeArgs.some((removeArg) => matchesRemovedLaunchArg(arg, removeArg)))
+        : baseArgs;
+    const launchProvider = filteredBaseArgs === baseArgs
+        ? provider
+        : { ...provider, spawn: { ...provider.spawn!, args: filteredBaseArgs } };
+    return {
+        provider: launchProvider,
+        cliArgs: [...mode.launchArgs, ...(cliArgs || [])],
+    };
+}
+
 function readSubcommandSessionId(args: string[], subcommands: string[]): string | undefined {
     const resumeIndex = args.findIndex((arg) => subcommands.includes(arg));
     if (resumeIndex < 0) return undefined;
@@ -707,6 +742,24 @@ export class DaemonCliManager {
                     clearInterval(checkStopped);
                     setTimeout(() => {
                         if (this.adapters.has(key)) {
+                            // KIMI-MESH-COMPLETION-EMIT (axis 2): before removeInstance closes the
+                            // event-emit window, give a mesh DELEGATED worker one last chance to emit
+                            // its completion. A native-source worker (e.g. kimi) can have its PTY
+                            // killed by a false stall AFTER it finished the task (transcript written)
+                            // but BEFORE the FSM's idle→completed event fired — the instance is the
+                            // only thing that can emit that event, and it is about to be removed. The
+                            // instance-side method is a no-op for a non-mesh session or when the
+                            // turn's completion already fired (double-emit guard) or when there is no
+                            // transcript evidence of a finished turn. Best-effort — never blocks cleanup.
+                            try {
+                                const inst = instanceManager?.getInstance(key) as (ProviderInstance & { flushMeshCompletionBeforeCleanup?: () => boolean }) | undefined;
+                                if (typeof inst?.flushMeshCompletionBeforeCleanup === 'function') {
+                                    const emitted = inst.flushMeshCompletionBeforeCleanup();
+                                    if (emitted) LOG.info('CLI', `Emitted pre-cleanup mesh completion for ${cliType} session ${key} before auto-clean`);
+                                }
+                            } catch (e) {
+                                LOG.warn('CLI', `pre-cleanup mesh completion flush failed for ${key}: ${(e as Error)?.message || e}`);
+                            }
                             this.adapters.delete(key);
                             this.deps.removeAgentTracking(key);
                             sessionRegistry?.unregisterByInstanceKey(key);
@@ -1030,6 +1083,17 @@ export class DaemonCliManager {
             console.log(colorize('cyan', `  📦 Using provider: ${provider.name} (${provider.type})`));
         }
 
+        const launchSettings = {
+            ...this.providerLoader.getSettings(normalizedType),
+            ...(options?.settingsOverride || {}),
+        };
+        const versionResolvedProvider = provider
+            ? (this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider)
+            : undefined;
+        const autoApproveLaunch = applyAutoApproveModeLaunchArgs(versionResolvedProvider, cliArgs, launchSettings);
+        const launchProvider = autoApproveLaunch.provider || provider;
+        const cliArgsWithAutoApprove = autoApproveLaunch.cliArgs;
+
  // ─── Model axis (MAGI kind-panel): expand initialModel → launch args ───
  // For a plain CLI provider the model is selected at spawn time via the manifest's
  // modelLaunchArgs template ('{{model}}' → the requested model). ACP providers took
@@ -1037,10 +1101,10 @@ export class DaemonCliManager {
  // or no requested model, is a no-op — model selection is best-effort and must never
  // fail a launch. The model args are prepended so a caller's explicit cliArgs (e.g. a
  // resume flag) still win positionally where order matters.
-        const modelLaunchArgs = expandModelLaunchArgs(provider?.modelLaunchArgs, initialModel);
+        const modelLaunchArgs = expandModelLaunchArgs(launchProvider?.modelLaunchArgs, initialModel);
         const cliArgsWithModel = modelLaunchArgs
-            ? [...modelLaunchArgs, ...(cliArgs || [])]
-            : cliArgs;
+            ? [...modelLaunchArgs, ...(cliArgsWithAutoApprove || [])]
+            : cliArgsWithAutoApprove;
         if (initialModel && !modelLaunchArgs) {
             LOG.warn('CLI', `[${normalizedType}] initialModel='${initialModel}' requested but provider declares no modelLaunchArgs template — launching without model selection.`);
         }
@@ -1051,7 +1115,7 @@ export class DaemonCliManager {
  // Best-effort; a provider with no template (or no requested level) is a no-op. ACP
  // providers route thinking through setConfigOption('thought_level') above.
         const initialThinkingLevel = options?.initialThinkingLevel;
-        const thinkingLaunchArgs = expandThinkingLaunchArgs(provider?.thinkingLaunchArgs, initialThinkingLevel, provider?.thinkingLevelMap);
+        const thinkingLaunchArgs = expandThinkingLaunchArgs(launchProvider?.thinkingLaunchArgs, initialThinkingLevel, launchProvider?.thinkingLevelMap);
         const cliArgsWithBrain = thinkingLaunchArgs
             ? [...thinkingLaunchArgs, ...(cliArgsWithModel || [])]
             : cliArgsWithModel;
@@ -1060,13 +1124,13 @@ export class DaemonCliManager {
         }
 
  // ─── Resolve launch options → provider session binding ───
-        const sessionBinding = resolveCliSessionBinding(provider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
+        const sessionBinding = resolveCliSessionBinding(launchProvider, normalizedType, cliArgsWithBrain, options?.resumeSessionId);
         const resolvedCliArgs = sessionBinding.cliArgs;
 
  // If InstanceManager exists, manage as CliProviderInstance unified
         const instanceManager = this.deps.getInstanceManager();
-        if (provider && instanceManager) {
-            const resolvedProvider = this.providerLoader.resolve(cliType, { version: cliInfo.version }) || provider;
+        if (launchProvider && instanceManager) {
+            const resolvedProvider = launchProvider;
             await this.registerCliInstance(
                 key,
                 normalizedType,
@@ -1074,7 +1138,7 @@ export class DaemonCliManager {
                 resolvedDir,
                 resolvedCliArgs,
                 resolvedProvider,
-                { ...this.providerLoader.getSettings(normalizedType), ...(options?.settingsOverride || {}) },
+                launchSettings,
                 false,
                 {
                     providerSessionId: sessionBinding.providerSessionId,

package/src/commands/high-family/mesh-events.ts

@@ -93,10 +93,21 @@ export const meshEventsHandlers: Record<string, HighFamilyHandler> = {
                 ? args.sessionId.trim()
                 : '';
         if (!sessionId) return { success: false, error: 'targetSessionId required' };
-        const response = normalizeInteractivePromptResponse(args?.response ?? args);
+        const rawResponse = args?.response ?? args;
         const instance = ctx.deps.instanceManager.getInstance(sessionId);
         if (!instance) return { success: false, error: `No running instance for session ${sessionId}` };
-        ctx.deps.instanceManager.sendEvent(sessionId, 'interactive_prompt_response', response);
+        // mesh_answer_question (mission f1d25e11) sends a coordinator-friendly answer array
+        // that is resolved against the AUTHORITATIVE active prompt inside the instance
+        // (resolveInteractivePromptResponse). Forward that shape RAW. The legacy strict
+        // (questionId-keyed) form is still validated here so a malformed dashboard-local
+        // answer is rejected before it reaches the instance.
+        const isFriendlyArrayForm = rawResponse
+            && typeof rawResponse === 'object'
+            && Array.isArray((rawResponse as { answers?: unknown }).answers);
+        const payload = isFriendlyArrayForm
+            ? rawResponse
+            : normalizeInteractivePromptResponse(rawResponse);
+        ctx.deps.instanceManager.sendEvent(sessionId, 'interactive_prompt_response', payload);
         return { success: true };
     },
 };

package/src/commands/med-family/mesh-crud.ts

@@ -399,6 +399,161 @@ export const meshCrudHandlers: Record<string, MedFamilyHandler> = {
         }
     },
 
+    // READ path for `.adhdev/mesh.json` — returns the currently-committed repo
+    // config (parsed + normalized) for a workspace so a UI can render/edit the
+    // existing declarative zones (notably `providerDefaults.autoApproveModes`)
+    // WITHOUT re-deriving them from the machine-local scaffold. Never writes.
+    // `config` is undefined when no repo file exists (sourceType 'unavailable') or
+    // it is unparseable (sourceType 'invalid', with the parse error surfaced).
+    read_mesh_json_config: async (_ctx: MedFamilyContext, args: any) => {
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        try {
+            const { loadRepoMeshJsonConfig } = await import('../../config/mesh-json-config.js');
+            const loaded = loadRepoMeshJsonConfig(workspace);
+            return {
+                success: true,
+                workspace,
+                sourceType: loaded.sourceType,
+                source: loaded.source,
+                ...(loaded.path ? { path: loaded.path } : {}),
+                ...(loaded.error ? { error: loaded.error } : {}),
+                config: loaded.config,
+                // Convenience projection so the UI does not have to reach into config.
+                providerDefaults: loaded.config?.providerDefaults,
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
+    // Partial-edit WRITE path for `.adhdev/mesh.json` `providerDefaults` — a
+    // READ-MODIFY-WRITE that preserves operator hand-edits. Unlike
+    // write_mesh_json_config (which rebuilds the WHOLE file from the machine-local
+    // scaffold and can silently drop hand-edited zones), this parses the existing
+    // repo file, merges ONLY the providerDefaults.autoApproveModes zone, and
+    // re-serializes — coordinator prompt, operating notes and limits authored in
+    // the repo are carried through untouched. Defaults to dry-run.
+    //
+    // args: { workspace?, autoApproveModes: Record<providerType,modeId>, write?, merge? }
+    //   merge=true (default): per-provider merge into the existing map; a modeId of
+    //     '' | null removes that provider's entry. merge=false: REPLACE the whole
+    //     autoApproveModes map with the supplied one.
+    set_mesh_provider_defaults: async (_ctx: MedFamilyContext, args: any) => {
+        const workspace = typeof args?.workspace === 'string' && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+        const write = args?.write === true;
+        const merge = args?.merge !== false; // default true
+        const inputModes = args?.autoApproveModes;
+        if (inputModes !== undefined && (typeof inputModes !== 'object' || inputModes === null || Array.isArray(inputModes))) {
+            return { success: false, error: 'autoApproveModes must be an object (providerType → modeId) when provided' };
+        }
+        try {
+            const {
+                loadRepoMeshJsonConfig,
+                normalizeRepoMeshDeclarativeConfig,
+                MESH_JSON_CONFIG_LOCATIONS,
+            } = await import('../../config/mesh-json-config.js');
+            const { existsSync, readFileSync, mkdirSync, writeFileSync } = await import('fs');
+            const { dirname, join } = await import('path');
+            const yaml = await import('js-yaml');
+
+            const relativePath = MESH_JSON_CONFIG_LOCATIONS[0];
+
+            // Read-modify-write: parse the EXISTING on-disk document (preferring the
+            // first existing json/yaml variant) so unrelated zones survive verbatim.
+            let baseDoc: Record<string, any> = { version: 1 };
+            let existingPath = join(workspace, relativePath);
+            let existedAsYaml = false;
+            for (const relative of MESH_JSON_CONFIG_LOCATIONS) {
+                const candidate = join(workspace, relative);
+                if (!existsSync(candidate)) continue;
+                try {
+                    const text = readFileSync(candidate, 'utf-8');
+                    const parsed = /\.json$/i.test(candidate) ? JSON.parse(text) : yaml.load(text);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                        baseDoc = parsed as Record<string, any>;
+                        existingPath = candidate;
+                        existedAsYaml = !/\.json$/i.test(candidate);
+                    }
+                } catch (e: any) {
+                    return { success: false, error: `existing ${relative} is unparseable, refusing to overwrite: ${e?.message || e}` };
+                }
+                break;
+            }
+
+            // Merge ONLY the providerDefaults.autoApproveModes zone.
+            const existingPd = baseDoc.providerDefaults && typeof baseDoc.providerDefaults === 'object' && !Array.isArray(baseDoc.providerDefaults)
+                ? baseDoc.providerDefaults as Record<string, any>
+                : {};
+            const existingModes = existingPd.autoApproveModes && typeof existingPd.autoApproveModes === 'object' && !Array.isArray(existingPd.autoApproveModes)
+                ? { ...existingPd.autoApproveModes as Record<string, string> }
+                : {};
+
+            const nextModes: Record<string, string> = merge ? existingModes : {};
+            if (inputModes) {
+                for (const [providerType, modeId] of Object.entries(inputModes as Record<string, unknown>)) {
+                    const type = typeof providerType === 'string' ? providerType.trim() : '';
+                    if (!type) continue;
+                    const id = typeof modeId === 'string' ? modeId.trim() : '';
+                    if (id) nextModes[type] = id;
+                    else delete nextModes[type]; // '' / null → remove this provider's entry
+                }
+            }
+
+            const nextDoc: Record<string, any> = { ...baseDoc, version: 1 };
+            if (Object.keys(nextModes).length) {
+                nextDoc.providerDefaults = { ...existingPd, autoApproveModes: nextModes };
+            } else {
+                // No entries left → drop the zone entirely so we don't leave an empty stub.
+                if (nextDoc.providerDefaults) {
+                    const { autoApproveModes, ...restPd } = nextDoc.providerDefaults;
+                    if (Object.keys(restPd).length) nextDoc.providerDefaults = restPd;
+                    else delete nextDoc.providerDefaults;
+                }
+            }
+
+            // Validate the merged document before it ever touches disk.
+            const validation = normalizeRepoMeshDeclarativeConfig(nextDoc);
+            if (!validation.valid) {
+                return { success: false, error: `merged mesh.json is invalid: ${validation.errors.join('; ')}` };
+            }
+
+            // Serialize in the on-disk format (JSON unless the existing file was YAML).
+            const absolutePath = existingPath;
+            const serialized = existedAsYaml
+                ? yaml.dump(nextDoc, { indent: 2 })
+                : `${JSON.stringify(nextDoc, null, 2)}\n`;
+
+            if (!write) {
+                return {
+                    success: true,
+                    written: false,
+                    dryRun: true,
+                    path: absolutePath,
+                    relativePath,
+                    merge,
+                    providerDefaults: nextDoc.providerDefaults,
+                    preview: serialized,
+                    note: 'Dry-run: nothing written. Re-run with write=true to persist. Only the providerDefaults zone is merged; other repo zones are preserved.',
+                };
+            }
+
+            mkdirSync(dirname(absolutePath), { recursive: true });
+            writeFileSync(absolutePath, serialized, 'utf-8');
+            return {
+                success: true,
+                written: true,
+                dryRun: false,
+                path: absolutePath,
+                relativePath,
+                merge,
+                providerDefaults: nextDoc.providerDefaults,
+                note: 'Wrote providerDefaults into .adhdev/mesh.json (read-modify-write; other zones preserved). Commit it to the repo.',
+            };
+        } catch (e: any) {
+            return { success: false, error: e.message };
+        }
+    },
+
     delete_mesh: async (_ctx: MedFamilyContext, args: any) => {
         const meshId = typeof args?.meshId === 'string' ? args.meshId.trim() : '';
         if (!meshId) return { success: false, error: 'meshId required' };

package/src/commands/med-family/mesh-queue.ts

@@ -9,6 +9,67 @@
  */
 import { readStringValue } from '../router.js';
 import type { MedFamilyContext, MedFamilyHandler } from './types.js';
+import { LOG } from '../../logging/logger.js';
+import type { CancelledTaskAssignment } from '../../mesh/mesh-work-queue.js';
+
+/**
+ * CANCEL-STICKY-TERMINAL (authoritative cancel): stop the worker a just-cancelled task was
+ * bound to. Mirrors the transport-aware stop mesh-event-forwarding's stopStaleMeshWorker
+ * performs for reclaimed workers, but runs from the command layer using ctx.deps (which the
+ * pure queue-store module lacks): local adapter → stop_cli directly; otherwise resolve the
+ * worker node's daemon id from mesh config and dispatch stop_cli over P2P/relay. Fully
+ * best-effort — a failed stop only loses the belt-and-suspenders; the cancelled row is already
+ * terminal and cannot be resurrected (updateTaskStatus terminal guard).
+ */
+async function stopCancelledTaskWorker(
+    ctx: MedFamilyContext,
+    meshId: string,
+    prior: CancelledTaskAssignment,
+): Promise<void> {
+    const { sessionId, nodeId, providerType } = prior;
+    const stopArgs: Record<string, unknown> = {
+        targetSessionId: sessionId,
+        ...(providerType ? { cliType: providerType } : {}),
+        mode: 'hard',
+        reason: 'mesh_task_cancelled',
+    };
+    try {
+        const cliManager = ctx.deps.cliManager as any;
+        const isLocal = cliManager?.adapters?.has?.(sessionId) === true;
+        if (isLocal) {
+            if (!stopArgs.cliType) {
+                const localType = cliManager?.adapters?.get?.(sessionId)?.cliType;
+                if (localType) stopArgs.cliType = localType;
+            }
+            await Promise.resolve(cliManager?.handleCliCommand?.('stop_cli', stopArgs))
+                .catch((e: any) => LOG.warn('MeshQueue', `Local stop of cancelled worker ${sessionId} failed: ${e?.message || e}`));
+            return;
+        }
+        // Remote: resolve the worker node's daemon id from mesh config, then dispatch stop_cli.
+        const dispatch = ctx.deps.dispatchMeshCommand;
+        let daemonId: string | undefined;
+        if (nodeId) {
+            try {
+                const [{ getMesh }, { meshNodeIdMatches }, { readMeshNodeDaemonId }] = await Promise.all([
+                    import('../../config/mesh-config.js'),
+                    import('@adhdev/mesh-shared'),
+                    import('../../mesh/mesh-node-identity.js'),
+                ]);
+                const mesh = getMesh(meshId) as { nodes?: any[] } | undefined;
+                const node = mesh?.nodes?.find((n: any) => meshNodeIdMatches(n, nodeId));
+                daemonId = node ? readMeshNodeDaemonId(node) || undefined : undefined;
+            } catch { /* best-effort resolution */ }
+        }
+        if (daemonId && dispatch) {
+            await Promise.resolve(dispatch(daemonId, 'stop_cli', stopArgs))
+                .catch((e: any) => LOG.warn('MeshQueue', `Remote stop of cancelled worker ${sessionId} on daemon ${daemonId} failed: ${e?.message || e}`));
+        } else {
+            LOG.warn('MeshQueue', `Cannot stop cancelled worker ${sessionId}: no local adapter and no resolvable remote daemon id (node ${nodeId ?? '?'}). Row is already terminal; if the worker completes it strand-fails harmlessly.`);
+        }
+    } catch (e: any) {
+        LOG.warn('MeshQueue', `stopCancelledTaskWorker error for ${sessionId}: ${e?.message || e}`);
+    }
+}
 
 export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
     get_mesh_queue: async (_ctx: MedFamilyContext, args: any) => {
@@ -50,10 +111,22 @@ export const meshQueueHandlers: Record<string, MedFamilyHandler> = {
         const ownerFailure = await ctx.requireMeshHostMutationOwner(meshId, args?.inlineMesh, 'queue cancellation');
         if (ownerFailure) return ownerFailure;
         try {
-            const { cancelTask } = await import('../../mesh/mesh-work-queue.js');
+            const { cancelTask, takeCancelledTaskAssignment } = await import('../../mesh/mesh-work-queue.js');
             const reason = typeof args?.reason === 'string' ? args.reason : undefined;
             const task = cancelTask(meshId, taskId, { reason });
             if (!task) return { success: false, error: `Queue task '${taskId}' not found` };
+            // CANCEL-STICKY-TERMINAL (authoritative cancel): stop the worker that was bound to the
+            // now-cancelled task. cancelTask already cleared the queue's assignment fields (so the
+            // reclaim watchdog no longer sees it as a live assignment), but a still-running worker
+            // keeps emitting delivery/turn signals that re-ignite reclaim. cancelTask runs in the
+            // pure queue-store module (no DaemonComponents), so the transport-aware stop is done
+            // here where ctx.deps holds cliManager / dispatchMeshCommand. Best-effort: a failed
+            // stop only loses the belt-and-suspenders — the row is already terminal and un-revivable
+            // thanks to the updateTaskStatus terminal guard.
+            const prior = takeCancelledTaskAssignment(meshId, taskId);
+            if (prior?.sessionId) {
+                void stopCancelledTaskWorker(ctx, meshId, prior);
+            }
             return { success: true, task };
         } catch (e: any) {
             return { success: false, error: e.message };

package/src/commands/router-refine.ts

@@ -36,8 +36,10 @@ import {
     RefineExecFileAsync,
     RefineStageOutcome,
     classifyPatchEquivalenceFailure,
+    convergeDivergedSubmoduleGitlinks,
     recordMeshRefineStage,
     resolveRefineryAutoPublishSubmoduleMainCommits,
+    rootRebaseResolvingGitlinks,
     runMeshRefineEffectiveDiffGate,
     runMeshRefinePatchEquivalenceGate,
     runMeshRefineSubmoduleReachabilityGate,
@@ -539,6 +541,9 @@ async function computeBranchBaseDivergence(
 export async function refineSyncBaseStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome> {
             const { repoRoot, baseHead, node, branch, baseBranch, refineStages, execFileAsync } = ctx;
             let branchHead = ctx.branchHead;
+            // Converged submodule gitlink resolutions (path → rebased commit) from STEP 1;
+            // consumed by the gitlink-aware root rebase (STEP 2) to resolve gitlink conflicts.
+            let gitlinkResolutions: Array<{ path: string; rebasedCommit: string }> = [];
             const syncStarted = Date.now();
             const divergence = await computeBranchBaseDivergence(execFileAsync, node.workspace, baseHead, branchHead);
 
@@ -571,25 +576,87 @@ export async function refineSyncBaseStage(self: DaemonCommandRouter, ctx: Refine
                 const preRebasePe = await runMeshRefinePatchEquivalenceGate(repoRoot, baseHead, branchHead);
                 const alreadyMerged = !preRebasePe.actualPatchId && !!preRebasePe.expectedPatchId;
                 const submoduleConflict = preRebasePe.actionableHint?.kind === 'submodule_conflict';
-                if (alreadyMerged || submoduleConflict) {
+                if (alreadyMerged) {
                     recordMeshRefineStage(refineStages, 'sync_base', 'passed', syncStarted, {
                         ahead: divergence.ahead,
                         behind: divergence.behind,
                         rebased: false,
-                        reason: alreadyMerged ? 'already_merged_via_other_path_skip_rebase' : 'submodule_conflict_defer_to_patch_equivalence',
+                        reason: 'already_merged_via_other_path_skip_rebase',
                     });
                     return { kind: 'continue', ctx };
                 }
+                if (submoduleConflict) {
+                    // DS3: a "submodule conflict" here means base and branch advanced the
+                    // SAME submodule to DIVERGED sibling commits (neither an ancestor of the
+                    // other), so the gitlink stays in the diff and patch-equivalence fails.
+                    // Attempt to auto-converge it (STEP 1): rebase the branch-side submodule
+                    // commit onto the base-side commit INSIDE the worktree submodule, so the
+                    // base-side commit becomes a strict ancestor of the rebased tip. The root
+                    // rebase below (STEP 2) then resolves the gitlink conflict to that rebased
+                    // commit. Together this automates the documented manual strict-ff bypass
+                    // and keeps the landed oss history linear. On any real submodule content
+                    // conflict it backs out cleanly → we FALL BACK to the historical
+                    // defer→patch_equivalence path below.
+                    const converge = convergeDivergedSubmoduleGitlinks(node.workspace, repoRoot, baseHead, branchHead);
+                    if (converge.converged) {
+                        gitlinkResolutions = converge.resolutions;
+                        recordMeshRefineStage(refineStages, 'submodule_gitlink_converge', 'passed', syncStarted, {
+                            reason: 'submodule_diverged_auto_rebased',
+                            gitlinks: converge.gitlinks,
+                        });
+                        LOG.info('Mesh', `[Refinery] Auto-converged diverged submodule gitlink(s) onto base for node ${node.id}: `
+                            + converge.resolutions.map(r => `${r.path}→${r.rebasedCommit.slice(0, 12)}`).join(', '));
+                        // Fall through (do NOT return) → the gitlink-aware root rebase below runs.
+                    } else {
+                        // Fail-safe: convergence declined (conflict / unreachable / not a real
+                        // divergence) → preserve the historical defer→blocked_review behavior.
+                        recordMeshRefineStage(refineStages, 'submodule_gitlink_converge', 'skipped', syncStarted, {
+                            reason: 'submodule_conflict_defer_to_patch_equivalence',
+                            convergeReason: converge.reason,
+                            gitlinks: converge.gitlinks,
+                        });
+                        recordMeshRefineStage(refineStages, 'sync_base', 'passed', syncStarted, {
+                            ahead: divergence.ahead,
+                            behind: divergence.behind,
+                            rebased: false,
+                            reason: 'submodule_conflict_defer_to_patch_equivalence',
+                        });
+                        return { kind: 'continue', ctx };
+                    }
+                }
             } catch { /* fail-open: on gate error, fall through to the rebase */ }
 
             // behind>0: strictly-behind OR diverged. Rebase the branch onto the pinned
             // baseHead. A conflict aborts and terminates blocked_review (retryable=false —
             // a real content conflict needs human resolution, not a base-movement retry).
+            //
+            // When STEP 1 converged a diverged submodule gitlink, use the gitlink-aware
+            // root rebase (STEP 2): git's recursive merge refuses to auto-merge the still-
+            // diverged intermediate gitlink, so we drive the rebase and resolve each
+            // submodule-gitlink conflict to the converged commit. A non-gitlink conflict
+            // aborts and falls through to the same blocked_review handling as a plain
+            // rebase conflict below (via the thrown gitlinkRebaseError).
             const rebaseStarted = Date.now();
             try {
-                execFileSync('git', ['rebase', baseHead], { cwd: node.workspace, stdio: ['ignore', 'pipe', 'pipe'] });
+                if (gitlinkResolutions.length > 0) {
+                    const gitlinkRebase = rootRebaseResolvingGitlinks(node.workspace, baseHead, gitlinkResolutions);
+                    if (!gitlinkRebase.ok) {
+                        // Surface as a rebase failure so the shared blocked_review handling
+                        // (submodule-hint recovery included) runs — nothing was left mid-rebase
+                        // (rootRebaseResolvingGitlinks aborts on failure).
+                        const err: any = new Error(`gitlink-aware rebase aborted: ${gitlinkRebase.reason || 'unknown'}`);
+                        err.gitlinkRebaseReason = gitlinkRebase.reason;
+                        err.gitlinkRebaseConflicts = gitlinkRebase.conflictPaths;
+                        err.alreadyAborted = true;
+                        throw err;
+                    }
+                } else {
+                    execFileSync('git', ['rebase', baseHead], { cwd: node.workspace, stdio: ['ignore', 'pipe', 'pipe'] });
+                }
             } catch (rebaseErr: any) {
-                try { execFileSync('git', ['rebase', '--abort'], { cwd: node.workspace, stdio: 'ignore' }); } catch { /* ignore */ }
+                if (!rebaseErr?.alreadyAborted) {
+                    try { execFileSync('git', ['rebase', '--abort'], { cwd: node.workspace, stdio: 'ignore' }); } catch { /* ignore */ }
+                }
                 // A rebase conflict on a submodule/gitlink divergence is a SPECIAL case the
                 // patch-equivalence gate describes with a rich actionable hint (which
                 // submodule, base vs branch commit, how to resolve). Run that gate against

package/src/commands/router.ts

@@ -227,6 +227,14 @@ const MESH_FORWARDABLE_SESSION_COMMANDS = new Set([
     // MUTATES the worker PTY, so forwarding to the real owner (not a wrong local session) is
     // doubly important. The daemon re-enforces the destructive-key confirm gate after the forward.
     'send_keys',
+    // interactive_prompt_response (mesh_answer_question, mission f1d25e11): the coordinator
+    // answers a REMOTE worker's AskUserQuestion (waiting_choice). The answer must reach the
+    // OWNING worker session's live instance — its activeInteractivePrompt (the authoritative
+    // prompt the labels/indexes resolve against) and its adapter.setInteractivePromptResponse
+    // live only there. Without forwarding, the coordinator's local high-family handler returns
+    // 'No running instance for session …' and the question is never answered — the exact
+    // remote-worker forwarding gap of mission 6938892f, now closed for questions too.
+    'interactive_prompt_response',
 ]);
 
 function normalizeCommandSource(source: string): CommandLogEntry['source'] {