thinkpool-pair 0.7.103 → 0.7.105

package/bridge.mjs

@@ -1322,6 +1322,11 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   })
   entry.session = startClaudeSession({
     cwd: cwd || process.cwd(), model, resume, mode, rolePrompt,
+    // A Flow CONDUCTOR (flowSessionId set, no flowTaskKey) must DECOMPOSE, not explore via
+    // a fan-out of Task/Explore subagents — those raise permission cards in plan mode (which
+    // now land on the hidden conductor terminal) and the model ignores the prompt rule not
+    // to. Hard-block the Task tool for conductors so it reads with Read/Grep/Glob + ExitPlanMode.
+    blockSubagents: !!flowSessionId && !flowTaskKey,
     mcpServers: { thinkpool: peekServer },
     // Tier C precheck — the PreToolUse gate calls this BEFORE raising a card, so a
     // disabled/looping/over-cap post never bothers a person. Closes over `entry`.
@@ -1433,6 +1438,26 @@ function drainPending(s) {
   s.pending.clear()
 }
 
+// Switching a terminal to bypassPermissions must RETROACTIVELY clear the cards the
+// current turn already raised — setPermissionMode is a streaming control request that
+// only applies going forward, so without this a user who flips to bypass mid-turn keeps
+// staring at "the agent wants to run X" cards on a terminal that's supposedly hands-off
+// (the 2026-06-30 "AGENT STILL ASKING PERMISSIONS" report — incl. subagent/Explore tool
+// calls whose requestPermission was invoked before the toggle). bypass = allow-all, so
+// resolving every pending card as 'allow' is exactly what the new mode means.
+function allowPending(s) {
+  if (!s?.pending) return
+  for (const [key, p] of s.pending) {
+    // Only auto-clear ordinary tool cards. A pending PLAN approval (risk:'plan') or an
+    // AskUserQuestion (risk:'ask') is a deliberate human gate — flipping to bypass means
+    // "run tools without asking", not "auto-approve my plan / answer my question" — leave
+    // those for the human.
+    if (p?.payload?.risk === 'plan' || p?.payload?.risk === 'ask') continue
+    try { p.resolve('allow') } catch { /* noop */ }
+    s.pending.delete(key)
+  }
+}
+
 function endStructured(id) {
   if (!id) return
   const s = sessions.get(id)
@@ -1712,7 +1737,11 @@ channel
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) { s.mode = payload.mode; s.session.setMode(payload.mode) }  // track for persist/restore
+    if (s) {
+      s.mode = payload.mode; s.session.setMode(payload.mode)  // track for persist/restore
+      // Flipping to bypass = "stop asking, including the cards this turn already raised."
+      if (payload.mode === 'bypassPermissions') allowPending(s)
+    }
   })
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
     endStructured(payload?.id)

package/claude-session.mjs

@@ -120,7 +120,7 @@ const simplifyBlocks = (blocks = []) => blocks.map((b) => {
  */
 const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false }) {
   const ac = new AbortController()
   let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
   let sessionId = resume || null
@@ -248,6 +248,15 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     // Surface it to the room when it changes; absent on models without effort.
     const lvl = hookInput.effort?.level
     if (lvl && lvl !== effort) { effort = lvl; emit({ kind: 'effort', level: effort }) }
+    // Flow CONDUCTOR hard-stop: a conductor must DECOMPOSE, never fan out Task/Explore
+    // subagents. The prompt asks it not to, but the model's parallelize instinct wins and
+    // it spawns Explore agents anyway — which (in plan mode) raise permission cards on the
+    // now-hidden conductor terminal and hang the whole flow. Deny the Task tool outright and
+    // tell it to read with Read/Grep/Glob + ExitPlanMode. (blockSubagents is set only for
+    // the conductor session — lanes are governed by their own one-hop prompt rule.)
+    if (blockSubagents && (toolName === 'Task' || toolName === 'Agent')) {
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'Flow conductors do NOT spawn subagents — it stalls the flow on a permission card. If you must inspect the codebase, read it yourself with Read/Grep/Glob (allowed here, no prompt). Then DECOMPOSE and call ExitPlanMode once. Do not call Task/Agent again.' } }
+    }
     // ThinkPool cross-terminal READ (B2) is read-only + within-room — never
     // prompt, in any mode. It still surfaces as a tool card so the room sees the peek.
     if (toolName === 'mcp__thinkpool__read_terminal') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.103",
+  "version": "0.7.105",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {