thinkpool-pair 0.6.0 → 0.6.3

package/bridge.mjs

@@ -124,6 +124,10 @@ const headless = argv.includes('--headless')
 // relay. Default OFF — the PTY path is untouched. Only applies to `claude`.
 // Spec: docs/specs/2026-06-11-code-structured-reader.md
 const STRUCTURED = process.env.TP_STRUCTURED === '1' || argv.includes('--structured')
+// Claude Code runs as a STRUCTURED Agent-SDK session by default now (the picked
+// design — structured reader, risk-tiered permissions). Other CLIs keep the PTY
+// relay. TP_PTY=1 forces claude back to the raw PTY if ever needed.
+const wantStructured = (cmd) => /(^|[/\\])claude$/.test(cmd || '') && process.env.TP_PTY !== '1'
 const installedAgents = KNOWN_AGENTS.filter(a => onPath(a.cmd))
 const dashIdx = argv.indexOf('--')
 // Own flags are only read from BEFORE `--`; after it, every token belongs
@@ -383,6 +387,11 @@ channel
       const agent = KNOWN_AGENTS.find(a => a.cmd === payload.cmd)
       if (agent?.resume) { try { if (agent.resume.probe()) args = [...agent.resume.args] } catch { /* fresh */ } }
     }
+    if (wantStructured(payload.cmd)) {
+      openStructured({ id: payload.id })
+      process.stderr.write(`\n  ◆ web opened a structured "${payload.cmd}" session.\n`)
+      return
+    }
     openTerm({ id: payload.id, cmd: payload.cmd, args })
     process.stderr.write(`\n  ◆ web opened a "${payload.cmd}"${args.length ? ' (continue)' : ''} terminal (headless).\n`)
   })
@@ -435,7 +444,17 @@ channel
   })
   .on('broadcast', { event: 'code-turn' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s && payload.text != null) s.session.sendTurn(payload.text)
+    if (s && payload.text != null) {
+      s.session.sendTurn(payload.text)
+      // Echo the turn so BOTH readers (and late joiners, via the log) show who
+      // said what — UNLESS silent (an @pool synthesis, which renders as its own
+      // 'pool' line). The sender rendered it optimistically; partner gets this.
+      if (!payload.silent) {
+        const evt = { kind: 'you', text: payload.text, cid: payload.cid, by: payload.by }
+        s.log.push(evt); if (s.log.length > STRUCTURED_LOG_MAX) s.log.shift()
+        bcast('code-event', { term: payload.term, evt })
+      }
+    }
   })
   .on('broadcast', { event: 'code-perm' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
@@ -446,6 +465,10 @@ channel
     const s = payload?.term && sessions.get(payload.term)
     if (s) s.session.abort()
   })
+  .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
+    const s = payload?.term && sessions.get(payload.term)
+    if (s) s.session.setMode(payload.mode)
+  })
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
     const s = payload?.id && sessions.get(payload.id)
     if (s) { try { s.session.end() } catch { /* noop */ } ; sessions.delete(payload.id); bcast('term-exit', { id: payload.id }); announce() }
@@ -456,7 +479,7 @@ channel
       channel.track({ name, role: 'bridge' })
       if (attachedCmd && !terms.size && !sessions.size) {
         // Claude + structured mode → Agent SDK session; everything else → PTY.
-        if (STRUCTURED && /(^|[/\\])claude$/.test(attachedCmd)) openStructured({ id: randomUUID() })
+        if (wantStructured(attachedCmd)) openStructured({ id: randomUUID() })
         else openTerm({ id: randomUUID(), cmd: attachedCmd, args: attachedArgs, attached: true })
       }
       announce()

package/claude-session.mjs

@@ -18,7 +18,10 @@ import { query } from '@anthropic-ai/claude-agent-sdk'
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
 // high (destructive, deny-first). See the permission spec + mockups.
-const DESTRUCTIVE = /\brm\s+-[a-z]*[rf]|\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)|\bdrop\s+(table|database)\b|\b(mkfs|dd)\b|\bsudo\b|>\s*\/dev\/|\bchmod\s+-R|\bchown\s+-R|\bkillall\b|\btruncate\b/i
+// Any `rm`/`rmdir` with an argument is destructive (a bare `rm NOTES.md`
+// deletes just as permanently as `rm -rf`). Plus force-push, hard reset,
+// clean -f, DROP, mkfs/dd, sudo, /dev redirects, recursive chmod/chown, etc.
+const DESTRUCTIVE = /\brm\s+\S|\brmdir\s+\S|\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)|\bdrop\s+(table|database)\b|\b(mkfs|dd)\b|\bsudo\b|>\s*\/dev\/|\bchmod\s+-R|\bchown\s+-R|\bkillall\b|\btruncate\b/i
 const READONLY_TOOLS = new Set(['Read', 'Grep', 'Glob', 'NotebookRead', 'TodoRead', 'LS'])
 const NETWORK_TOOLS = new Set(['WebFetch', 'WebSearch'])
 const WRITE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'TodoWrite'])
@@ -78,30 +81,48 @@ const simplifyBlocks = (blocks = []) => blocks.map((b) => {
  *        resolve 'allow'/'deny'. (Caller implements any auto-allow policy.)
  * @returns {{ sendTurn(text), abort(), end(), readonly sessionId }}
  */
+const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
+
 export function startClaudeSession({ cwd, model, resume, onEvent, requestPermission }) {
   const ac = new AbortController()
   const input = makeInputStream()
   let sessionId = resume || null
   let closed = false
+  let q = null            // the live Query — control requests (interrupt /
+                          // setPermissionMode) route through it once streaming.
+  let mode = 'default'    // mirrors Claude Code's ⇧⇥ cycle
 
   const emit = (evt) => { try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
 
-  // PreToolUse — fires on EVERY tool call (the universal gate). Classify
-  // risk, round-trip the decision to the room, return allow/deny.
+  // PreToolUse — fires on EVERY tool call (the universal gate). The mode policy
+  // mirrors Claude Code exactly: reads never prompt (any mode); Auto-accept
+  // edits auto-approves non-destructive writes; Bash / network / destructive
+  // always round-trip to the room's risk-tiered permission card.
   const preTool = async (hookInput) => {
     const toolName = hookInput.tool_name
     const toolInput = hookInput.tool_input
     const risk = classifyRisk(toolName, toolInput)
+    const auto =
+      risk === 'low' ||
+      mode === 'bypassPermissions' ||
+      (mode === 'acceptEdits' && WRITE_TOOLS.has(toolName) && risk !== 'high')
     let decision = 'allow'
-    try {
-      decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk }) ?? 'allow'
-    } catch { decision = 'deny' } // a broken permission path must fail safe (deny)
+    if (!auto) {
+      try {
+        decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk }) ?? 'allow'
+      } catch { decision = 'deny' } // a broken permission path must fail safe (deny)
+    }
+    // On deny, permissionDecisionReason IS what the model receives as the
+    // tool error — make it a real instruction, not an opaque tag.
+    const denied = decision === 'deny'
     return {
       continue: true,
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
-        permissionDecision: decision === 'deny' ? 'deny' : 'allow',
-        permissionDecisionReason: 'thinkpool-room',
+        permissionDecision: denied ? 'deny' : 'allow',
+        permissionDecisionReason: denied
+          ? 'Denied by the user in the ThinkPool room. Do not retry this tool — ask what to do instead.'
+          : auto ? `Auto-approved (${mode}).` : 'Approved in the ThinkPool room.',
       },
     }
   }
@@ -117,7 +138,8 @@ export function startClaudeSession({ cwd, model, resume, onEvent, requestPermiss
 
   ;(async () => {
     try {
-      for await (const m of query({ prompt: input.stream, options: opts })) {
+      q = query({ prompt: input.stream, options: opts })
+      for await (const m of q) {
         if (closed) break
         switch (m.type) {
           case 'system':
@@ -150,8 +172,20 @@ export function startClaudeSession({ cwd, model, resume, onEvent, requestPermiss
 
   return {
     sendTurn(text) { if (!closed) input.push(String(text)) },
-    abort() { try { ac.abort() } catch { /* noop */ } },
+    // Set the permission mode — Claude Code's ⇧⇥ cycle. setPermissionMode is a
+    // streaming control request (drives plan-mode behaviour SDK-side); the local
+    // `mode` drives our PreToolUse auto-approve policy. Echo so the room syncs.
+    async setMode(m) {
+      if (!MODES.has(m) || closed) return
+      mode = m
+      try { await q?.setPermissionMode?.(m) } catch { /* only valid mid-stream */ }
+      emit({ kind: 'mode', mode })
+    },
+    // Graceful interrupt (Esc / Stop) — stops the current turn but keeps the
+    // session alive for the next one. ac.abort() is teardown only (end()).
+    async abort() { try { await q?.interrupt?.() } catch { /* noop */ } },
     end() { closed = true; input.end(); try { ac.abort() } catch { /* noop */ } },
     get sessionId() { return sessionId },
+    get mode() { return mode },
   }
 }

package/package.json

@@ -1,11 +1,19 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
     "thinkpool-pair": "bridge.mjs"
   },
+  "files": [
+    "bridge.mjs",
+    "claude-session.mjs",
+    "README.md"
+  ],
+  "scripts": {
+    "release": "./publish.sh"
+  },
   "engines": {
     "node": ">=18"
   },

package/devbox/setup-devbox.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-# thinkpool devbox — turn an always-plugged-in Mac into a permanent
-# ThinkPool code host (the old-MacBook-on-a-shelf setup, 2026-06-11).
-#
-#   bash setup-devbox.sh <ROOM> [project-dir]
-#
-#   ROOM         fixed room code — thinkpool.io/code?r=<ROOM> becomes the
-#                permanent address you and your partner share
-#   project-dir  the repo the bridge shares (default: current directory)
-#
-# What it does:
-#   1. pmset: never sleep (lid closed included), restart after power loss
-#   2. Remote Login (SSH) on — your emergency way in
-#   3. LaunchAgent com.thinkpool.pair: runs `npx thinkpool-pair@latest
-#      <ROOM> --continue` from the project dir, restarts it forever
-#      (KeepAlive). --continue resumes the latest Claude Code session in
-#      that directory on every restart; harmless for agents without
-#      resume support (they start fresh).
-#
-# What it can NOT do (one-time manual steps, printed at the end):
-#   - Auto-login (System Settings → Users & Groups)
-#   - Tailscale install (recommended)
-#
-# Re-run any time — it rewrites the agent idempotently.
-
-set -euo pipefail
-
-ROOM="${1:?usage: setup-devbox.sh <ROOM> [project-dir]}"
-PROJ="${2:-$PWD}"
-ROOM="$(echo "$ROOM" | tr '[:lower:]' '[:upper:]')"
-PROJ="$(cd "$PROJ" && pwd)"
-PLIST="$HOME/Library/LaunchAgents/com.thinkpool.pair.plist"
-LOG="$HOME/Library/Logs/thinkpool-pair.log"
-
-echo "── thinkpool devbox setup ──"
-echo "   room:    $ROOM"
-echo "   project: $PROJ"
-
-# ── 1. power: never sleep, survive power cuts ───────────────────────────
-echo "── pmset (needs sudo) ──"
-sudo pmset -a sleep 0 disksleep 0 displaysleep 1
-sudo pmset -a disablesleep 1      # lid closed ≠ sleep, no external display needed
-sudo pmset -a autorestart 1       # power cut → boots back up
-sudo pmset -a womp 1 2>/dev/null || true   # wake on LAN, when supported
-
-# ── 2. SSH in case the bridge wedges ────────────────────────────────────
-sudo systemsetup -setremotelogin on >/dev/null 2>&1 || \
-  echo "   (Remote Login refused — enable it in System Settings → Sharing)"
-
-# ── 3. the forever-bridge LaunchAgent ───────────────────────────────────
-# Login shell (-l) so launchd's bare PATH still finds node/npx/claude
-# (nvm, Homebrew, ~/.local/bin — whatever this Mac uses).
-mkdir -p "$HOME/Library/LaunchAgents" "$HOME/Library/Logs"
-cat > "$PLIST" <<PLIST
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>            <string>com.thinkpool.pair</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/zsh</string>
-    <string>-l</string>
-    <string>-c</string>
-    <string>exec npx --yes thinkpool-pair@latest $ROOM --continue</string>
-  </array>
-  <key>WorkingDirectory</key> <string>$PROJ</string>
-  <key>RunAtLoad</key>        <true/>
-  <key>KeepAlive</key>        <true/>
-  <key>ThrottleInterval</key> <integer>15</integer>
-  <key>StandardOutPath</key>  <string>$LOG</string>
-  <key>StandardErrorPath</key><string>$LOG</string>
-</dict>
-</plist>
-PLIST
-
-launchctl unload "$PLIST" 2>/dev/null || true
-launchctl load "$PLIST"
-echo "   LaunchAgent loaded — log: $LOG"
-
-# ── done ────────────────────────────────────────────────────────────────
-cat <<EOF
-
-── done. two manual steps remain ──
-  1. System Settings → Users & Groups → automatically log in as this
-     user (the agent runs at login, not at boot, until you do this).
-  2. Recommended: install Tailscale so you can SSH from anywhere.
-
-  permanent room:  https://thinkpool.io/code?r=$ROOM
-  watch the log:   tail -f $LOG
-  stop it:         launchctl unload $PLIST
-
-  battery note: a dead 2017 battery on permanent AC can swell — glance
-  at the lid/trackpad for bulge now and then, or have it removed.
-EOF