thinkpool-pair 0.6.14 → 0.6.15

package/claude-session.mjs

@@ -54,6 +54,21 @@ export function isSafeDocWrite(toolName, input) {
   return SAFE_DOC_RE.test(p)
 }
 
+// The full auto-allow decision (exported for the contract test, so the policy
+// can't drift away from docs/specs/2026-06-15-paired-permission-safe-doc-writes.md).
+// Mirrors the PreToolUse policy: reads always; bypass mode always; acceptEdits for
+// non-high writes; mandated safe-doc writes always; per tool:risk "always allow".
+export function autoAllow({ toolName, input, mode = 'default', alwaysAllow = new Set() }) {
+  const risk = classifyRisk(toolName, input)
+  return (
+    risk === 'low' ||
+    mode === 'bypassPermissions' ||
+    (mode === 'acceptEdits' && WRITE_TOOLS.has(toolName) && risk !== 'high') ||
+    isSafeDocWrite(toolName, input) ||
+    alwaysAllow.has(`${toolName}:${risk}`)
+  )
+}
+
 // ── input stream — a generator we keep open and feed turns into ──
 function makeInputStream() {
   const queue = []
@@ -162,12 +177,7 @@ export function startClaudeSession({ cwd, model, resume, onEvent, requestPermiss
     // never silently allows a future destructive one (high always re-asks).
     const sig = `${toolName}:${risk}`
     const safeDoc = isSafeDocWrite(toolName, toolInput)
-    const auto =
-      risk === 'low' ||
-      mode === 'bypassPermissions' ||
-      (mode === 'acceptEdits' && WRITE_TOOLS.has(toolName) && risk !== 'high') ||
-      safeDoc ||
-      alwaysAllow.has(sig)
+    const auto = autoAllow({ toolName, input: toolInput, mode, alwaysAllow })
     let decision = 'allow'
     if (!auto) {
       try {
@@ -186,7 +196,9 @@ export function startClaudeSession({ cwd, model, resume, onEvent, requestPermiss
         permissionDecision: denied ? 'deny' : 'allow',
         permissionDecisionReason: denied
           ? 'Denied by the user in the ThinkPool room. Do not retry this tool — ask what to do instead.'
-          : auto ? `Auto-approved (${mode}).` : 'Approved in the ThinkPool room.',
+          : auto
+            ? (safeDoc ? 'Auto-approved (mandated doc write — .claude/SESSIONS/ or CLAUDE.md).' : `Auto-approved (${mode}).`)
+            : 'Approved in the ThinkPool room.',
       },
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.6.14",
+  "version": "0.6.15",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {