@adhdev/mesh-shared 1.0.82-rc.33 → 1.0.82-rc.35

package/dist/mesh-tool-names.d.ts

@@ -18,10 +18,10 @@
  * Order mirrors mcp-server `ALL_MESH_TOOLS` for easy visual diffing, but the consistency
  * checks are set-based (order-insensitive).
  */
-export declare const CANONICAL_MESH_TOOL_NAMES: readonly ["mesh_status", "mesh_route_preview", "mesh_list_nodes", "mesh_enqueue_batch", "mesh_enqueue_task", "mesh_view_queue", "mesh_queue_cancel", "mesh_queue_requeue", "mesh_queue_revise", "mesh_send_task", "mesh_read_chat", "mesh_read_debug", "mesh_read_terminal", "mesh_send_keys", "mesh_launch_session", "mesh_git_status", "mesh_read_node_logs", "mesh_fast_forward_node", "mesh_restart_daemon", "mesh_checkpoint", "mesh_approve", "mesh_answer_question", "mesh_list_pending_approvals", "mesh_create", "mesh_add_node", "mesh_attach_remote", "mesh_clone_node", "mesh_remove_node", "mesh_cleanup_worktree_nodes", "mesh_refine_node", "mesh_refine_batch", "mesh_config", "mesh_init", "mesh_cleanup_sessions", "mesh_task_history", "mesh_ledger_query", "mesh_note", "mesh_reconcile_ledger", "mesh_mission_upsert", "mesh_mission_list", "mesh_review_inbox", "mesh_node_slots", "driver_list", "driver_describe", "artifact_list"];
+export declare const CANONICAL_MESH_TOOL_NAMES: readonly ["mesh_status", "mesh_route_preview", "mesh_list_nodes", "mesh_enqueue_batch", "mesh_enqueue_task", "mesh_view_queue", "mesh_queue_cancel", "mesh_queue_requeue", "mesh_queue_revise", "mesh_send_task", "mesh_read_chat", "mesh_read_debug", "mesh_read_terminal", "mesh_send_keys", "mesh_launch_session", "mesh_git_status", "mesh_read_node_logs", "mesh_fast_forward_node", "mesh_restart_daemon", "mesh_checkpoint", "mesh_approve", "mesh_answer_question", "mesh_list_pending_approvals", "mesh_create", "mesh_add_node", "mesh_reattach_source_parent", "mesh_attach_remote", "mesh_clone_node", "mesh_remove_node", "mesh_cleanup_worktree_nodes", "mesh_refine_node", "mesh_refine_batch", "mesh_config", "mesh_init", "mesh_cleanup_sessions", "mesh_task_history", "mesh_ledger_query", "mesh_note", "mesh_reconcile_ledger", "mesh_mission_upsert", "mesh_mission_list", "mesh_review_inbox", "mesh_node_slots", "driver_list", "driver_describe", "artifact_list", "artifact_read", "artifact_register"];
 export type CanonicalMeshToolName = typeof CANONICAL_MESH_TOOL_NAMES[number];
 /** The count the `NN tools` barrel doc comments and consistency test assert against. */
-export declare const CANONICAL_MESH_TOOL_COUNT: 45;
+export declare const CANONICAL_MESH_TOOL_COUNT: 48;
 /**
  * Tool names retired by the 2026-09-26 tool-surface consolidation (60 → 48).
  * Every capability behind them is still reachable: each retired name maps to the

package/dist/mission-items.d.ts

@@ -0,0 +1,202 @@
+/**
+ * mission-items — structured mission records: the item kinds a mission carries
+ * (remaining work, live checks, owner decisions, evidence), their normalization
+ * and limits, dedupe-key derivation and the close outcome enum
+ * (docs/design/2026-10-28-structured-missions-and-owner-decisions.md §4, §5).
+ *
+ * Philosophy (owner 2026-10-28, design §0): NEVER reject for size or shape —
+ * over-long text is truncated, extra refs are dropped, unusable items are
+ * reported per-item. The only hard rule lives elsewhere (the daemon): a
+ * coordinator or worker can never ANSWER a decision, so `answer`/`delivery`
+ * are stripped from every caller-supplied `decision` here.
+ *
+ * Dependency-free leaf: pure functions over plain data, no storage.
+ */
+export declare const MISSION_ITEM_KINDS: readonly ["remaining", "live_check", "decision", "evidence"];
+export type MissionItemKind = typeof MISSION_ITEM_KINDS[number];
+export declare const MISSION_ITEM_STATES: readonly ["open", "done", "dropped", "moved", "answered", "expired", "withdrawn", "superseded"];
+export type MissionItemState = typeof MISSION_ITEM_STATES[number];
+/** States a coordinator/worker may SET through items_update, per kind. `answered`/`expired` are daemon-owned. */
+export declare const COORDINATOR_SETTABLE_ITEM_STATES: Readonly<Record<MissionItemKind, readonly MissionItemState[]>>;
+export declare const MISSION_OUTCOMES: readonly ["merged", "verified_live", "superseded", "not_needed", "owner_abandoned", "unspecified"];
+export type MissionOutcome = typeof MISSION_OUTCOMES[number];
+export declare function isMissionOutcome(value: unknown): value is MissionOutcome;
+export declare const MISSION_REF_KINDS: readonly ["commit", "branch", "pr", "task", "artifact", "mission", "url"];
+export type MissionRefKind = typeof MISSION_REF_KINDS[number];
+export declare const MISSION_LIMITS: {
+    readonly summary: 300;
+    readonly outcomeReason: 500;
+    readonly itemText: 300;
+    readonly machine: 80;
+    readonly refs: 8;
+    readonly refValue: 300;
+    readonly refRepo: 120;
+    readonly refNote: 200;
+    readonly dedupeKey: 400;
+    readonly question: 300;
+    readonly context: 600;
+    readonly options: 5;
+    readonly optionLabel: 60;
+    readonly optionDetail: 200;
+    /** Open items per mission before the oldest `remaining` fold into a "N more" summary item. */
+    readonly openItemsPerMission: 200;
+    /** One event payload (serialized). */
+    readonly eventPayloadBytes: number;
+    /** items_add / items_update entries honoured per call (extra entries are reported, not applied). */
+    readonly itemsPerCall: 50;
+};
+export declare const MISSION_DECISION_OPTION_IDS: readonly ["a", "b", "c", "d", "e"];
+export declare const MISSION_DECISION_URGENCIES: readonly ["normal", "blocking"];
+export type MissionDecisionUrgency = typeof MISSION_DECISION_URGENCIES[number];
+export declare const MISSION_DECISION_ON_DUE: readonly ["remind", "apply_recommended"];
+export type MissionDecisionOnDue = typeof MISSION_DECISION_ON_DUE[number];
+export interface MissionItemRef {
+    kind: MissionRefKind;
+    repo?: string;
+    value: string;
+    note?: string;
+}
+export interface MissionDecisionOption {
+    id: string;
+    label: string;
+    detail?: string;
+}
+/** Who/where an answer came from. Written only by the daemon's (owner-side) answer path — never from tool input. */
+export interface MissionDecisionAnswer {
+    optionId?: string;
+    text?: string;
+    by: 'owner' | 'auto_recommended';
+    via: 'dashboard' | 'assistant' | 'push' | 'cli' | 'auto';
+    interpretedFrom?: string;
+    at: string;
+    ingress?: string;
+}
+export interface MissionDecisionDelivery {
+    messageId: string;
+    /**
+     * `queued`: the coordinator's input queue accepted it but has not typed it yet — the daemon
+     * confirms it against the send receipt (a daemon restart drops that queue). Daemon-written.
+     */
+    state: 'pending' | 'queued' | 'sent' | 'acked';
+    lastAttemptAt?: string;
+    /** Coordinator session + funnel messageId of a `queued` delivery (receipt lookup). Daemon-written. */
+    sessionId?: string;
+    wireMessageId?: string;
+    /** Failed send attempts of this revision (retry backoff). Daemon-written. */
+    attempts?: number;
+    /** What the coordinator is told: a first answer, a changed answer, or an undone one. Daemon-written. */
+    kind?: 'answered' | 'changed' | 'undone';
+}
+export interface MissionDecision {
+    question: string;
+    context?: string;
+    options: MissionDecisionOption[];
+    recommended?: string;
+    allowFreeText: boolean;
+    dueAt?: string;
+    onDue: MissionDecisionOnDue;
+    urgency: MissionDecisionUrgency;
+    answer?: MissionDecisionAnswer;
+    delivery?: MissionDecisionDelivery;
+    /**
+     * Coordinator-prompt watermark (bundle B): ISO time the coordinator last "saw" this item's
+     * answer. An answered decision is shown in the coordinator prompt while this is absent or
+     * older than `answer.at` (a changed answer re-surfaces). Written only by the daemon.
+     */
+    promptAckedAt?: string;
+    /** Counts answer writes (answer / change / undo); delivery messageIds are `decision:<itemId>:r<n>`. Daemon-written. */
+    answerRevision?: number;
+    /** ISO time an `onDue: remind` crossing was recorded (once per dueAt). Daemon-written. */
+    remindedAt?: string;
+}
+export interface NormalizedMissionItem {
+    kind: MissionItemKind;
+    text: string;
+    machine?: string;
+    refs: MissionItemRef[];
+    decision?: MissionDecision;
+    dedupeKey: string;
+    /** Fields that were truncated/dropped — informational, never an error. */
+    truncated: string[];
+}
+export declare function truncateMissionText(value: string, max: number): string;
+export declare function normalizeMissionSummary(value: unknown): {
+    value: string;
+    truncated: boolean;
+} | null;
+export declare function normalizeOutcomeReason(value: unknown): {
+    value: string;
+    truncated: boolean;
+} | null;
+/** Refs: ≤8, `{kind, repo?, value, note?}`. Unusable entries are dropped; the 9th and later are dropped. */
+export declare function normalizeMissionRefs(value: unknown): {
+    refs: MissionItemRef[];
+    truncated: boolean;
+};
+/**
+ * Caller-supplied decision → stored shape. `answer`/`delivery` (and any other
+ * unknown key) are DROPPED: a coordinator/worker cannot pre-answer its own
+ * question. `recommended` must name one of the options, else it is dropped.
+ */
+export declare function normalizeDecisionInput(raw: Record<string, unknown>, truncated: string[]): MissionDecision | null;
+/** Normalized text for dedupe: lower-case, whitespace-collapsed, trailing punctuation trimmed. */
+export declare function normalizeForDedupe(text: string): string;
+export declare function deriveItemDedupeKey(kind: MissionItemKind, parts: {
+    text?: string;
+    machine?: string;
+    refs?: readonly MissionItemRef[];
+    question?: string;
+    explicit?: string;
+}): string;
+/**
+ * Normalize one caller-supplied `items_add[]` entry. Returns `null` + `error`
+ * only when nothing usable remains (no text/question) — everything else is
+ * clamped, never rejected.
+ */
+export declare function normalizeMissionItemInput(raw: unknown): {
+    item: NormalizedMissionItem;
+} | {
+    error: string;
+};
+export interface MissionItemUpdateInput {
+    id: string;
+    state?: MissionItemState;
+    text?: string;
+    machine?: string | null;
+    refs?: MissionItemRef[];
+}
+/** Normalize one `items_update[]` entry (id required). The kind-specific state rule is applied by the daemon, which knows the stored kind. */
+export declare function normalizeMissionItemUpdate(raw: unknown): {
+    update: MissionItemUpdateInput;
+    truncated: string[];
+} | {
+    error: string;
+};
+/** Cap a serialized event payload at {@link MISSION_LIMITS.eventPayloadBytes}; over-size payloads become a stub that says so. */
+export declare function boundEventPayload(payload: Record<string, unknown>): string;
+/** The carry-over mission's fixed title (design §5.1). */
+export declare const CARRY_OVER_MISSION_TITLE = "Carry-over \u2014 open items from closed missions";
+/** The title earlier builds stored; existing DBs still hold it, so it keeps matching (no rename). */
+export declare const LEGACY_CARRY_OVER_MISSION_TITLE = "\uC774\uC6D4 \u2014 \uB2EB\uD78C \uBBF8\uC158\uC5D0\uC11C \uB118\uC5B4\uC628 \uD56D\uBAA9";
+/** Canonical goal text of a newly created carry-over mission. */
+export declare const CARRY_OVER_MISSION_GOAL = "Open items carried over from closed missions, and decisions requested without a mission. Managed automatically \u2014 do not close.";
+/**
+ * THE one predicate for "is this the auto carry-over mission". The daemon's `is_carry_over`
+ * column (`isCarryOver`) is the source of truth; wire views that cannot carry the flag (older
+ * strict decoders reject unknown keys) fall back to the fixed title. Use this everywhere.
+ */
+export declare function isCarryOverMissionRecord(m: {
+    isCarryOver?: boolean;
+    title?: unknown;
+} | null | undefined): boolean;
+/** The carry-over mission's title is fixed (the daemon ignores renames), so a title match identifies it on wire views that carry no flag. */
+export declare function isCarryOverMissionTitle(title: unknown): boolean;
+/** Prefix of the owner-confirmation decision a coordinator's `owner_abandoned` close creates. */
+export declare const OWNER_ABANDON_CONFIRM_KEY_PREFIX = "owner-abandon-confirm:";
+export declare const OWNER_ABANDON_CONFIRM_QUESTION = "The coordinator closed this as 'owner abandoned' \u2014 correct?";
+export declare const OWNER_ABANDON_CONFIRM_OPTIONS: readonly ["Correct", "Reopen"];
+/** worker `report_completion.decisions_needed` cap. */
+export declare const WORKER_DECISIONS_NEEDED_MAX = 3;
+/** worker `report_completion.commits` cap and shape. */
+export declare const WORKER_COMMITS_MAX = 20;
+export declare function normalizeReportCommits(value: unknown): string[] | null;

package/dist/protocol/daemon-server.d.ts

@@ -32,15 +32,38 @@ import { type CommandPayload, type Envelope, type MessageId } from './envelope';
  * time (UserSession.ts), so adding a member here without adding it there — or
  * vice versa — fails `tsc`.
  */
-export declare const DAEMON_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress"];
+export declare const DAEMON_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress", "agent:decision_needed"];
 export type DaemonStatusEventName = typeof DAEMON_STATUS_EVENT_NAMES[number];
-export declare const isDaemonStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress";
+export declare const isDaemonStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress" | "agent:decision_needed";
 /**
  * Server-bound status event. Content boundary: identifiers, enums, counters
  * and booleans only — plus the approved approval-modal exception
  * (`modalMessage`/`modalButtons`, CLAUDE.md "Push notification exception").
  * Mirror of daemon-core `DaemonStatusEventPayload`.
  */
+/**
+ * Owner-decision push payload (design §9, owner decision D1 2026-10-28). The ONLY mission text that
+ * reaches the server: the question (<=80 chars) and up to 3 option labels (<=24 chars). Never
+ * `context`, free-text answers, mission goal/summary or chat content.
+ */
+export type DecisionPushWire = {
+    meshId: string;
+    missionId: string;
+    itemId: string;
+    question: string;
+    options: Array<{
+        id: string;
+        label: string;
+    }>;
+    recommended?: string;
+    urgency: 'normal' | 'blocking';
+    dueAt?: string;
+    /** `new` = freshly asked; `remind` = a blocking decision crossed its due time. */
+    reason: 'new' | 'remind';
+};
+export declare const DECISION_PUSH_QUESTION_MAX = 80;
+export declare const DECISION_PUSH_OPTION_LABEL_MAX = 24;
+export declare const DECISION_PUSH_OPTIONS_MAX = 3;
 export type DaemonStatusEventWirePayload = {
     event: DaemonStatusEventName;
     timestamp: number;
@@ -57,6 +80,8 @@ export type DaemonStatusEventWirePayload = {
     waitKind?: 'external';
     surfaceHidden?: boolean;
     muted?: boolean;
+    /** Present only on `agent:decision_needed`. */
+    decision?: DecisionPushWire;
 };
 /** Routing-only session entry the daemon reports over the server WS. Mirror of daemon-core `RoutingSessionEntry`. */
 export type RoutingSessionWireEntry = {
@@ -218,6 +243,7 @@ export type P2POfferWirePayload = {
     peerId: string;
     attemptId?: number;
     attemptEpoch?: string;
+    probe?: boolean;
 };
 export type P2PIceWirePayload = {
     candidate: string;
@@ -225,6 +251,7 @@ export type P2PIceWirePayload = {
     peerId: string;
     attemptId?: number;
     attemptEpoch?: string;
+    probe?: boolean;
 };
 /**
  * A dashboard-originated signal as relayed to the daemon. `peerId` is stamped
@@ -238,6 +265,10 @@ export type RelayedP2PSignalWirePayload = {
     daemonId?: string;
     attemptId?: number;
     attemptEpoch?: string;
+    /** p2p_ready only: the dashboard's stale-connect backoff index (see DashboardP2PReadyWirePayload). */
+    backoffStep?: number;
+    /** Make-before-break relay->direct re-probe of an existing peer (see DashboardP2PReadyWirePayload). */
+    probe?: boolean;
     sharePermission?: string;
     shareTargetSessionId?: string;
     sdp?: string;

package/dist/protocol/dashboard-server.d.ts

@@ -21,9 +21,9 @@ import { type DaemonStatusEventName, type P2PIceWirePayload, type P2POfferWirePa
 /** Server-originated events the dashboard receives in addition to the daemon set. */
 export declare const SERVER_STATUS_EVENT_NAMES: readonly ["daemon:disconnect", "team:session_viewed", "team:view_request", "team:view_request_approved", "team:view_request_rejected"];
 /** Mirror of daemon-core `DashboardStatusEventName`; pinned equal by the server at compile time. */
-export declare const DASHBOARD_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress", "daemon:disconnect", "team:session_viewed", "team:view_request", "team:view_request_approved", "team:view_request_rejected"];
+export declare const DASHBOARD_STATUS_EVENT_NAMES: readonly ["agent:generating_started", "agent:waiting_approval", "agent:waiting_choice", "agent:generating_completed", "agent:stopped", "monitor:no_progress", "agent:decision_needed", "daemon:disconnect", "team:session_viewed", "team:view_request", "team:view_request_approved", "team:view_request_rejected"];
 export type DashboardStatusEventName = DaemonStatusEventName | typeof SERVER_STATUS_EVENT_NAMES[number];
-export declare const isDashboardStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress" | "daemon:disconnect" | "team:session_viewed" | "team:view_request" | "team:view_request_approved" | "team:view_request_rejected";
+export declare const isDashboardStatusEventName: (value: unknown) => value is "agent:generating_started" | "agent:waiting_approval" | "agent:waiting_choice" | "agent:generating_completed" | "agent:stopped" | "monitor:no_progress" | "agent:decision_needed" | "daemon:disconnect" | "team:session_viewed" | "team:view_request" | "team:view_request_approved" | "team:view_request_rejected";
 /**
  * Sanitized status event as the server relays it (UserSession
  * `buildDashboardStatusEvent`). Mirror of daemon-core
@@ -111,6 +111,7 @@ export type DashboardP2POfferWirePayload = {
     peerId?: string;
     attemptId?: number;
     attemptEpoch?: string;
+    probe?: boolean;
     sdp: string;
     type: string;
 };
@@ -119,6 +120,7 @@ export type DashboardP2PIceWirePayload = {
     peerId?: string;
     attemptId?: number;
     attemptEpoch?: string;
+    probe?: boolean;
     candidate: string;
     mid?: string;
     sdpMid?: string | null;
@@ -155,11 +157,15 @@ export declare const isDashboardToUserSessionType: (value: unknown) => value is
 export declare const DASHBOARD_P2P_SIGNAL_TYPES: readonly ["p2p_ready", "p2p_answer", "p2p_ice"];
 export type DashboardP2PSignalType = typeof DASHBOARD_P2P_SIGNAL_TYPES[number];
 export declare const isDashboardP2PSignalType: (value: unknown) => value is "p2p_ready" | "p2p_answer" | "p2p_ice";
+/** `backoffStep`: the dashboard's stale-connect backoff index (0 = 15s, 1 = 30s, 2 = 60s), so the daemon holds the connecting slot for the same window. */
+/** `probe`: identifier-only flag — this signal belongs to a make-before-break relay->direct re-probe of the SAME logical peer (never a new peer for the connection cap). */
 export type DashboardP2PReadyWirePayload = {
     daemonId: string;
     peerId: string;
     attemptId?: number;
     attemptEpoch?: string;
+    backoffStep?: number;
+    probe?: boolean;
 };
 export type DashboardP2PAnswerWirePayload = {
     daemonId: string;
@@ -168,12 +174,14 @@ export type DashboardP2PAnswerWirePayload = {
     type: string;
     attemptId?: number;
     attemptEpoch?: string;
+    probe?: boolean;
 };
 export type DashboardP2PLocalIceWirePayload = {
     daemonId: string;
     peerId: string;
     attemptId?: number;
     attemptEpoch?: string;
+    probe?: boolean;
     candidate: string;
     sdpMid: string | null;
     sdpMLineIndex: number | null;

package/dist/relay-reprobe.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Relay -> direct re-probe scheduler (pure, dependency-free).
+ *
+ * A P2P connection that settled on a TURN relay never looks for a direct path
+ * again. The owning transport (dashboard `P2PConnection`, daemon peer manager)
+ * uses this scheduler to periodically attempt a make-before-break probe: a
+ * SECOND peer connection (STUN-only) is built next to the working relay one and
+ * only swapped in once it is verified direct. The scheduler owns nothing but
+ * timing: backoff 60s -> 5min (doubling), jitter, and the stop conditions. The
+ * transport supplies `shouldProbe` (open + idle + visible) and `probe`.
+ */
+export type RelayReprobeOutcome = 'direct' | 'relay' | 'failed' | 'skipped';
+export interface RelayReprobeTiming {
+    /** First delay and the unit of growth (default 60s). */
+    baseDelayMs?: number;
+    /** Backoff ceiling before jitter (default 5min). */
+    maxDelayMs?: number;
+    /** +/- fraction applied to every delay (default 0.2). */
+    jitterRatio?: number;
+}
+export declare const RELAY_REPROBE_BASE_DELAY_MS = 60000;
+export declare const RELAY_REPROBE_MAX_DELAY_MS: number;
+export declare const RELAY_REPROBE_JITTER_RATIO = 0.2;
+/** Delay before the next attempt after `failures` consecutive non-direct outcomes. */
+export declare function computeRelayReprobeDelay(failures: number, random: () => number, timing?: RelayReprobeTiming): number;
+export interface RelayReprobeSchedulerOptions extends RelayReprobeTiming {
+    random: () => number;
+    setTimer: (callback: () => void, ms: number) => unknown;
+    clearTimer: (handle: unknown) => void;
+    /** Connected over relay, idle, tab visible, auth epoch unchanged... Re-checked on every tick. */
+    shouldProbe: () => boolean;
+    /** One make-before-break attempt. Must never throw into the scheduler; a rejection counts as 'failed'. */
+    probe: () => Promise<RelayReprobeOutcome>;
+}
+export declare class RelayReprobeScheduler {
+    private readonly options;
+    private handle;
+    private running;
+    private inFlight;
+    private failureCount;
+    private generation;
+    constructor(options: RelayReprobeSchedulerOptions);
+    get isRunning(): boolean;
+    get failures(): number;
+    get probing(): boolean;
+    /** Begin probing (idempotent). Call when a connection is selected as relay. */
+    start(): void;
+    /** Stop for good (direct path found, connection closed, auth epoch changed). */
+    stop(): void;
+    private schedule;
+    private tick;
+}

package/dist/turn-ipc-mission.d.ts

@@ -30,8 +30,40 @@ export interface MissionUpsertRequest {
      * this wire guard only checks SHAPE, not that decision.
      */
     brief?: MissionBriefWire | null;
+    /**
+     * Structured-missions bundle A (design 2026-10-28 §5.1). Every key below is optional
+     * and ABSENT on a legacy call. `structured: true` is the caller's capability flag: the
+     * daemon only puts the new keys on the response (mission summary/outcome/version,
+     * `result`) when it is set, so an older mcp-server that never sends it keeps decoding
+     * byte-identical responses (mixed-version fleets, design §13.1).
+     */
+    structured?: boolean;
+    summary?: string;
+    outcome?: string;
+    outcomeReason?: string;
+    /** Mission id open items move to when this call closes the mission (default: the carry-over mission). */
+    carryOverTo?: string;
+    /** Route to the mesh's auto-created carry-over mission instead of `id`/`title` (decision requests without a mission). `title` may then be empty. */
+    toCarryOver?: boolean;
+    itemsAdd?: readonly Record<string, unknown>[];
+    itemsUpdate?: readonly Record<string, unknown>[];
+}
+export interface MeshMissionOpenItemCountsWire {
+    remaining: number;
+    live_check: number;
+    decision: number;
+    evidence: number;
+}
+/** Structured-missions fields (only with `structured: true` on the request). */
+export interface MeshMissionStructuredWire {
+    summary?: string;
+    outcome?: string;
+    outcomeReason?: string;
+    version?: number;
+    carryOver?: boolean;
+    openItems?: MeshMissionOpenItemCountsWire;
 }
-export interface MeshMissionRecordWire {
+export interface MeshMissionRecordWire extends MeshMissionStructuredWire {
     id: string;
     meshId: string;
     title: string;
@@ -42,6 +74,8 @@ export interface MeshMissionRecordWire {
 }
 export interface MissionUpsertResponse {
     mission: MeshMissionRecordWire;
+    /** Structured calls only: per-item results, movedItems/movedTo, restoredItems, ownerConfirmationItemId, warnings. */
+    result?: Record<string, unknown>;
 }
 export declare function decodeMissionUpsertRequest(value: unknown): MissionUpsertRequest | null;
 export declare function isMissionUpsertResponse(value: unknown): value is MissionUpsertResponse;
@@ -77,6 +111,12 @@ export interface MissionListQueryRequest {
      * option except `historyIdLimit` is ignored. An older daemon rejects the key.
      */
     meshStatusView?: 'compact' | 'verbose';
+    /** Structured-missions capability flag (see MissionUpsertRequest.structured): rows then carry summary/outcome/openItems/carryOver/version. */
+    structured?: boolean;
+    /** Structured only: attach each mission's items. */
+    items?: boolean;
+    /** Structured only: attach each mission's change history (bounded tail). */
+    history?: boolean;
 }
 export interface MeshMissionTaskAggregateWire {
     total: number;
@@ -115,6 +155,15 @@ export interface MissionListSummaryVerboseWire {
     createdAt?: string;
     updatedAt?: string;
     closeCandidateEmittedAt?: string | null;
+    /** Structured lists only. */
+    summary?: string;
+    outcome?: string;
+    outcomeReason?: string;
+    version?: number;
+    carryOver?: boolean;
+    openItems?: MeshMissionOpenItemCountsWire;
+    items?: readonly Record<string, unknown>[];
+    history?: readonly Record<string, unknown>[];
 }
 /** Compact (default) mission row. `goalPreview`/`goalTruncated` present, `goal` absent. */
 export interface MissionListSummarySlimWire {
@@ -132,6 +181,15 @@ export interface MissionListSummarySlimWire {
     createdAt?: string;
     updatedAt?: string;
     closeCandidateEmittedAt?: string | null;
+    /** Structured lists only. */
+    summary?: string;
+    outcome?: string;
+    outcomeReason?: string;
+    version?: number;
+    carryOver?: boolean;
+    openItems?: MeshMissionOpenItemCountsWire;
+    items?: readonly Record<string, unknown>[];
+    history?: readonly Record<string, unknown>[];
 }
 export type MissionListSummaryWire = MissionListSummaryVerboseWire | MissionListSummarySlimWire;
 export interface MeshMissionHistoryFoldWire {

package/dist/worker-protocol.d.ts

@@ -30,7 +30,7 @@
  * the protocol contract the marker demarcates.
  */
 import { type MissionBrief } from './mission-brief';
-export declare const WORKER_TOOLS: readonly ["report_completion", "progress_update", "peer_context_pull", "git_status", "git_log", "git_diff", "driver_list", "driver_describe", "driver_invoke", "artifact_register"];
+export declare const WORKER_TOOLS: readonly ["report_completion", "progress_update", "peer_context_pull", "git_status", "git_log", "git_diff", "driver_list", "driver_describe", "driver_invoke", "driver_scaffold", "driver_validate", "driver_export", "driver_install", "artifact_register", "artifact_list", "artifact_read", "contract_read", "contract_observe", "contract_current"];
 export type WorkerTool = typeof WORKER_TOOLS[number];
 export declare function isWorkerTool(value: unknown): value is WorkerTool;
 /** Stable marker line so a body is never footered twice and tests can find it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/mesh-shared",
-  "version": "1.0.82-rc.33",
+  "version": "1.0.82-rc.35",
   "description": "ADHDev mesh-shared — pure mesh/git status normalizers shared by daemon-core and web-core",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/assistant-protocol.ts

@@ -34,6 +34,10 @@ export const ASSISTANT_TOOLS = [
     'launch_defaults_set',
     'driver_list',
     'driver_describe',
+    'artifact_list',
+    'artifact_read',
+    'decision_answer',
+    'decision_request',
 ] as const
 
 export type AssistantTool = typeof ASSISTANT_TOOLS[number]
@@ -67,6 +71,12 @@ export const ASSISTANT_VERB = {
     projectNote: 'assistant_project_note',
     launchDefaults: 'assistant_launch_defaults',
     launchDefaultsSet: 'assistant_launch_defaults_set',
+    artifactList: 'assistant_artifact_list',
+    artifactRead: 'assistant_artifact_read',
+    /** Owner-decision inbox (structured-missions design 2026-10-28 §6.3): the owner's words recorded as answers. */
+    decisionAnswer: 'assistant_decision_answer',
+    /** Register a plain-text question a coordinator put to the owner as a decision item (§5.2). */
+    decisionRequest: 'assistant_decision_request',
     // assistant-side daemon verbs without a tool of the same name
     launch: 'launch_assistant',
     pendingRelays: 'assistant_pending_relays',
@@ -101,6 +111,10 @@ export const ASSISTANT_TOOL_VERBS: Readonly<Record<AssistantTool, AssistantVerb>
     project_note: ASSISTANT_VERB.projectNote,
     launch_defaults: ASSISTANT_VERB.launchDefaults,
     launch_defaults_set: ASSISTANT_VERB.launchDefaultsSet,
+    artifact_list: ASSISTANT_VERB.artifactList,
+    artifact_read: ASSISTANT_VERB.artifactRead,
+    decision_answer: ASSISTANT_VERB.decisionAnswer,
+    decision_request: ASSISTANT_VERB.decisionRequest,
 }
 
 /**
@@ -109,7 +123,7 @@ export const ASSISTANT_TOOL_VERBS: Readonly<Record<AssistantTool, AssistantVerb>
  * because they cause effects (a coordinator message or launch, a new
  * project), and MCP clients use readOnlyHint to skip confirmation.
  */
-export const ASSISTANT_WRITE_TOOLS: readonly AssistantTool[] = ['project_watch', 'assistant_action', 'memory', 'skill_manage', 'project_note', 'project_send', 'project_add', 'project_attach_remote', 'launch_defaults_set']
+export const ASSISTANT_WRITE_TOOLS: readonly AssistantTool[] = ['project_watch', 'assistant_action', 'memory', 'skill_manage', 'project_note', 'project_send', 'project_add', 'project_attach_remote', 'launch_defaults_set', 'decision_answer', 'decision_request']
 
 /** Owner-only verbs: never reachable from the assistant's MCP server (no `ipc`). */
 export const ASSISTANT_OWNER_VERBS: readonly AssistantVerb[] = [
@@ -164,7 +178,7 @@ export const ASSISTANT_REMOTE_FOLLOW_COMMAND = 'assistant_remote_follow' as cons
  * `assistant_remote_project` when the host's `assistantRemoteAccess` ACL is active.
  * `note`, `terminal`, and `inventory` remain strictly roster-member-only.
  */
-export const ASSISTANT_FOLLOWER_ALLOWED_OPS = ['status', 'read', 'poll', 'report', 'send'] as const
+export const ASSISTANT_FOLLOWER_ALLOWED_OPS = ['status', 'read', 'poll', 'report', 'send', 'artifact_list', 'artifact_read', 'decision_list', 'decision_answer', 'decision_request'] as const
 export type AssistantFollowerAllowedOp = typeof ASSISTANT_FOLLOWER_ALLOWED_OPS[number]
 
 const ASSISTANT_FOLLOWER_ALLOWED_OP_SET: ReadonlySet<string> = new Set(ASSISTANT_FOLLOWER_ALLOWED_OPS)
@@ -173,6 +187,25 @@ export function isAssistantFollowerAllowedOp(value: unknown): value is Assistant
     return typeof value === 'string' && ASSISTANT_FOLLOWER_ALLOWED_OP_SET.has(value)
 }
 
+/**
+ * Owner-decision ops were added after grants were persisted with an explicit
+ * `allowedOps` list. A grant that already lets the follower read status (list)
+ * or send to the coordinator (answer / register) covers the matching decision op,
+ * so no existing grant needs re-issuing.
+ */
+const DECISION_OP_IMPLIED_BY: Readonly<Record<string, AssistantFollowerAllowedOp>> = {
+    decision_list: 'status',
+    decision_answer: 'send',
+    decision_request: 'send',
+}
+
+export function followerOpPermitted(op: string, allowedOps: readonly AssistantFollowerAllowedOp[]): boolean {
+    if (!isAssistantFollowerAllowedOp(op)) return false
+    if ((allowedOps as readonly string[]).includes(op)) return true
+    const implied = DECISION_OP_IMPLIED_BY[op]
+    return implied !== undefined && allowedOps.includes(implied)
+}
+
 /**
  * Host-authoritative narrow project ACL persisted on the hosting daemon's
  * `LocalMeshEntry` in `meshes.json`. Revocation increments `grantRevision`
@@ -188,6 +221,7 @@ export interface AssistantRemoteAccessBinding {
     status: 'active' | 'revoked'
     allowedOps: readonly AssistantFollowerAllowedOp[]
     allowCoordinatorLaunch?: boolean
+    allowArtifactRead?: boolean
     grantedAt: number
     revokedAt?: number
 }
@@ -234,6 +268,7 @@ export interface FollowedRemoteProjectEntry {
     bindingRevision: number
     grantRevision: number
     allowCoordinatorLaunch?: boolean
+    allowArtifactRead?: boolean
     state: FollowedRemoteProjectState
     followedAt: number | string
     updatedAt: number | string
@@ -264,6 +299,7 @@ export interface RemoteProjectCatalogItem {
     sanitizedRepoIdentity: string | null
     coordinatorState?: 'none' | 'idle' | 'working' | 'waiting' | string
     allowCoordinatorLaunch?: boolean
+    allowArtifactRead?: boolean
     capabilities: {
         status: true
         read: true
@@ -272,6 +308,7 @@ export interface RemoteProjectCatalogItem {
         send: true
         coordinatorPresent?: boolean
         allowCoordinatorLaunch?: boolean
+        allowArtifactRead?: boolean
     }
     observedAt: number | string
 }

package/src/decision-push-relay.ts

@@ -0,0 +1,23 @@
+/**
+ * Opt-in "answer a decision from the push notification" relay (mission 4ae3edf2, owner 2026-10-29).
+ *
+ * ★ A deliberate, narrow exception to "no dashboard command relay over server WS" (CLAUDE.md).
+ * With the user's opt-in setting ON and no dashboard window open, the notification's
+ * recommended-option action is POSTed by the service worker to the server, which forwards it to the
+ * owning daemon over the existing daemon WS as ONE fixed command. What crosses the server is exactly
+ * `{ meshId, itemId, optionId }` (+ the single-use answer token that authorizes it) — never the
+ * question, context or free text. Shared so the server's frame and the daemon's ingress cannot drift.
+ */
+
+/** Daemon command the server sends; its only accepted source is {@link DECISION_PUSH_RELAY_SOURCE}. */
+export const DECISION_PUSH_RELAY_COMMAND = 'mission_decision_push_relay_answer'
+
+/** Command source the server stamps on the relayed frame (never settable by REST/API callers). */
+export const DECISION_PUSH_RELAY_SOURCE = 'push_relay'
+
+/** The complete relayed payload — ids only. */
+export type DecisionPushRelayPayload = {
+    meshId: string
+    itemId: string
+    optionId: string
+}