@adhdev/daemon-standalone 1.0.58-rc.11 → 1.0.58-rc.12

package/dist/index.js

@@ -36882,10 +36882,10 @@ var require_dist3 = __commonJS({
     }
     function getDaemonBuildInfo() {
       if (cached2) return cached2;
-      const commit = readInjected(true ? "3ca2b5ad15d65b9747431bc63b717940d2431daa" : void 0) ?? "unknown";
-      const commitShort = readInjected(true ? "3ca2b5ad" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
-      const version2 = readInjected(true ? "1.0.58-rc.11" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
-      const builtAt = readInjected(true ? "2026-08-25T02:16:50.726Z" : void 0);
+      const commit = readInjected(true ? "530605d8d33a09d5e072b440a9634ba8dc909737" : void 0) ?? "unknown";
+      const commitShort = readInjected(true ? "530605d8" : void 0) ?? (commit !== "unknown" ? commit.slice(0, 7) : "unknown");
+      const version2 = readInjected(true ? "1.0.58-rc.12" : void 0) ?? readInjected(typeof process !== "undefined" ? process.env?.ADHDEV_PKG_VERSION : void 0) ?? "unknown";
+      const builtAt = readInjected(true ? "2026-08-25T05:36:54.741Z" : void 0);
       cached2 = builtAt ? { commit, commitShort, version: version2, builtAt } : { commit, commitShort, version: version2 };
       return cached2;
     }
@@ -44929,6 +44929,7 @@ ${error48.message || ""}`;
       normalizeCapabilityTags: () => normalizeCapabilityTags,
       normalizeMagiSlots: () => normalizeMagiSlots,
       normalizeRepoIdentity: () => normalizeRepoIdentity,
+      readMeshConfigFromDisk: () => readMeshConfigFromDisk,
       removeMagiKindPanel: () => removeMagiKindPanel,
       removeNode: () => removeNode,
       resolveScopedMeshId: () => resolveScopedMeshId,
@@ -44936,6 +44937,7 @@ ${error48.message || ""}`;
       setMagiKindPanel: () => setMagiKindPanel,
       setMeshHostPin: () => setMeshHostPin,
       setMeshQuotaRouting: () => setMeshQuotaRouting,
+      statMeshConfigFile: () => statMeshConfigFile,
       tokenIdForManualPairing: () => tokenIdForManualPairing,
       updateMesh: () => updateMesh,
       updateNode: () => updateNode
@@ -44987,17 +44989,28 @@ ${error48.message || ""}`;
         release2();
       }
     }
-    function readMeshConfigFile() {
+    function readMeshConfigFromDisk() {
       const path63 = getMeshConfigPath();
-      if (!(0, import_fs5.existsSync)(path63)) return { meshes: [] };
+      if (!(0, import_fs5.existsSync)(path63)) return null;
       try {
         const raw = JSON.parse((0, import_fs5.readFileSync)(path63, "utf-8"));
-        if (!raw || !Array.isArray(raw.meshes)) return { meshes: [] };
+        if (!raw || !Array.isArray(raw.meshes)) return null;
         return raw;
       } catch {
-        return { meshes: [] };
+        return null;
+      }
+    }
+    function statMeshConfigFile() {
+      try {
+        const stat2 = (0, import_fs5.statSync)(getMeshConfigPath());
+        return { mtimeMs: stat2.mtimeMs, size: stat2.size };
+      } catch {
+        return null;
       }
     }
+    function readMeshConfigFile() {
+      return readMeshConfigFromDisk() ?? { meshes: [] };
+    }
     function loadMeshConfig(options = {}) {
       const config2 = readMeshConfigFile();
       const migrated = migrateLoadedMeshConfig(config2);
@@ -127755,6 +127768,8 @@ ${ptyResult.output.slice(-2e3)}`);
     }
     init_debug_trace();
     init_mesh_host_ownership();
+    init_repo_mesh_types();
+    init_mesh_config();
     var fs58 = __toESM2(require("fs"));
     init_mesh_node_identity();
     init_router_refine();
@@ -128904,7 +128919,7 @@ ${ptyResult.output.slice(-2e3)}`);
         role: "member"
       };
     }
-    var DaemonCommandRouter = class {
+    var DaemonCommandRouter = class _DaemonCommandRouter {
       /** Public (not private) so the extracted ./router-refine.ts orchestration can reach it via `self`. */
       deps;
       /** In-memory cache for cloud-originating meshes passed via inlineMesh.
@@ -128923,6 +128938,15 @@ ${ptyResult.output.slice(-2e3)}`);
       /** Coordinator-owned whole-mesh aggregate status snapshots. Browser callers read this by default.
        *  Public (not private) so the extracted ./router-aggregate-status.ts orchestration can reach it via `self`. */
       aggregateMeshStatusCache = /* @__PURE__ */ new Map();
+      /**
+       * meshes.json policy resync state (see syncInlineMeshPoliciesFromDisk).
+       * checkedAtMs throttles the stat; mtimeMs/size are the last-seen file
+       * identity. -1 = no baseline recorded yet: the first check RECORDS the
+       * baseline without applying, so a stale local file mirror can never
+       * regress a fresher inline (cloud-coordinator) policy — only edits made
+       * while this daemon is alive and watching are pulled into memory.
+       */
+      meshPolicyDiskSync = { checkedAtMs: 0, mtimeMs: -1, size: -1 };
       /** Shared per-peer git_status probe dedup + recently-probed reuse gate.
        *  Spans separate mesh_status/get_mesh calls so the dashboard auto-retry
        *  loop cannot storm a slow peer with back-to-back refreshUpstream probes. */
@@ -128966,7 +128990,67 @@ ${ptyResult.output.slice(-2e3)}`);
       rememberAggregateMeshStatus(meshId, snapshot, refreshReason) {
         return rememberAggregateMeshStatus(this, meshId, snapshot, refreshReason);
       }
+      /**
+       * meshes.json → inline-cache policy resync (mtime-triggered lazy reload).
+       *
+       * Out-of-band edits to meshes.json (an operator hand-editing a policy flag)
+       * never reached the inline mesh cache: command-path updates (update_mesh)
+       * rewrite BOTH disk and cache, but a direct file edit changed nothing in
+       * memory, so mesh_status / refine gating kept serving the boot-time policy
+       * until a daemon restart (live evidence 2026-08-25: requireApprovalForPush
+       * flipped to false on disk 92 min after daemon boot; the daemon kept
+       * reporting and enforcing true).
+       *
+       * Fix: on inline-cache reads, stat meshes.json (throttled — routing and
+       * status polling are hot paths); when the file changed, re-apply ONLY each
+       * cached mesh's `policy` block from disk. Policy-only, never nodes/meshHost:
+       * the inline cache is the coordinator's live node truth, and the daemon's
+       * own mutators read-modify-write through disk, so they already carry the
+       * edit forward — overwriting the whole cached mesh here would clobber
+       * in-flight node truth for zero benefit. A changed policy also busts the
+       * aggregate status snapshot, whose scheduling projection is derived from it.
+       *
+       * Safety rules:
+       *   - unparseable file (torn mid-edit write) → keep the in-memory policy,
+       *     log only. Never fall back to defaults: that would silently LOOSEN
+       *     security flags (requireApprovalForPush / requireApprovalForDestructiveGit).
+       *   - mesh absent from disk (deleted, or inline-only cloud mesh) → keep the
+       *     cache entry untouched.
+       */
+      syncInlineMeshPoliciesFromDisk() {
+        if (this.inlineMeshCache.size === 0) return;
+        const now = Date.now();
+        const sync = this.meshPolicyDiskSync;
+        if (now - sync.checkedAtMs < _DaemonCommandRouter.MESH_POLICY_DISK_SYNC_THROTTLE_MS) return;
+        sync.checkedAtMs = now;
+        const stat2 = statMeshConfigFile();
+        if (!stat2) return;
+        if (stat2.mtimeMs === sync.mtimeMs && stat2.size === sync.size) return;
+        const hadBaseline = sync.mtimeMs >= 0;
+        sync.mtimeMs = stat2.mtimeMs;
+        sync.size = stat2.size;
+        if (!hadBaseline) return;
+        const disk = readMeshConfigFromDisk();
+        if (!disk) {
+          console.warn("[mesh-config] meshes.json changed but is unparseable (mid-edit?) \u2014 keeping in-memory mesh policies");
+          return;
+        }
+        const diskPolicyByMeshId = /* @__PURE__ */ new Map();
+        for (const mesh of disk.meshes) {
+          if (mesh?.id && mesh.policy && typeof mesh.policy === "object") diskPolicyByMeshId.set(mesh.id, mesh.policy);
+        }
+        for (const [meshId, cached5] of this.inlineMeshCache) {
+          const diskPolicy = diskPolicyByMeshId.get(meshId);
+          if (!diskPolicy) continue;
+          const nextPolicy = mergeAndNormalizePolicy(void 0, diskPolicy);
+          if (JSON.stringify(cached5?.policy ?? null) === JSON.stringify(nextPolicy)) continue;
+          cached5.policy = nextPolicy;
+          this.invalidateAggregateMeshStatus(meshId);
+        }
+      }
+      static MESH_POLICY_DISK_SYNC_THROTTLE_MS = 250;
       getCachedInlineMeshNodes() {
+        this.syncInlineMeshPoliciesFromDisk();
         const nodes = [];
         for (const mesh of this.inlineMeshCache.values()) {
           if (Array.isArray(mesh?.nodes)) {
@@ -128986,6 +129070,7 @@ ${ptyResult.output.slice(-2e3)}`);
        * the mesh policy is absent, matching the worker-launch stamp.
        */
       getCachedInlineMeshNodesWithVisibility() {
+        this.syncInlineMeshPoliciesFromDisk();
         const out = [];
         for (const mesh of this.inlineMeshCache.values()) {
           const spawnedSessionVisibility = mesh?.policy?.spawnedSessionVisibility === "visible" ? "visible" : "hidden";
@@ -129006,6 +129091,7 @@ ${ptyResult.output.slice(-2e3)}`);
         return resolveRemoteMeshSessionOwnerDaemonId(this, sessionId, ownerNodeIdHint);
       }
       getCachedInlineMesh(meshId, inlineMesh) {
+        this.syncInlineMeshPoliciesFromDisk();
         if (inlineMesh && typeof inlineMesh === "object") {
           return this.warmInlineMeshCache(meshId, inlineMesh);
         }