thinkpool-pair 0.7.151 → 0.7.153

package/bridge.mjs

@@ -988,11 +988,25 @@ const mockupSeen = new Map()   // `${term}/${slug}` → mtimeMs of the last mani
 // in the Map" guess meant closing the generating terminal moved the cards to
 // whatever terminal was now first — they leaked into Terminal 1.)
 const handleManifest = async (box, file, term) => {
-  if (!file || !file.endsWith('.json')) return
+  // Ignore our own delivery receipts — writing <slug>.receipt.json into the
+  // watched outbox re-fires fs.watch; without this guard it would re-trigger
+  // handleManifest in a loop (it still ends in .json). Must come first.
+  if (!file || file.endsWith('.receipt.json') || !file.endsWith('.json')) return
   const full = path.join(box, file)
   let stat
   try { stat = fs.statSync(full) } catch { return }            // tmp/removed mid-write
   const slug = file.replace(/\.json$/, '')
+  // Delivery receipt (atomic tmp+mv) so render.sh can confirm the card actually
+  // reached the room — written on success AND failure. Best-effort: a receipt
+  // that can't be written just leaves render.sh at "delivery unconfirmed".
+  const writeReceipt = (ok, status) => {
+    try {
+      const rc = path.join(box, `${slug}.receipt.json`)
+      const tmp = `${rc}.tmp`
+      fs.writeFileSync(tmp, JSON.stringify({ ok, status, ts: Date.now() }))
+      fs.renameSync(tmp, rc)
+    } catch { /* receipts are best-effort */ }
+  }
   const seenKey = `${term}/${slug}`
   if (mockupSeen.get(seenKey) === stat.mtimeMs) return         // already handled
   mockupSeen.set(seenKey, stat.mtimeMs)
@@ -1017,11 +1031,16 @@ const handleManifest = async (box, file, term) => {
         desktopPng: readB64(m.desktop), mobilePng: readB64(m.mobile), html: readTxt(m.html),
       }),
     })
-    if (!res.ok) { process.stderr.write(`\n  ◇ mockup "${m.slug}" upload failed (${res.status}).\n`); return }
+    if (!res.ok) {
+      writeReceipt(false, res.status)
+      process.stderr.write(`\n  ◇ mockup "${m.slug}" upload failed (${res.status}).\n`); return
+    }
     const { paths } = await res.json()
     bcast('code-event', { term, evt: { kind: 'mockup', __struct: true, cid, term, slug: m.slug, title: m.title || m.slug, ts: m.ts, paths } })
+    writeReceipt(true, 200)
     process.stderr.write(`\n  ◆ mockup "${m.title || m.slug}" pushed to the room.\n`)
   } catch (e) {
+    writeReceipt(false, 'error')
     process.stderr.write(`\n  ◇ mockup "${m.slug}" send failed: ${e?.message || e}\n`)
   }
 }
@@ -1761,6 +1780,22 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
     // Tier C precheck — the PreToolUse gate calls this BEFORE raising a card, so a
     // disabled/looping/over-cap post never bothers a person. Closes over `entry`.
     crossPostGate: () => crossPostDecision({ hop: entry.hop || 0, postCount: entry.postCount || 0, disabled: process.env.TP_CROSSPOST_OFF === '1' }),
+    // Tier C consent scope (2026-07-03) — the PreToolUse gate asks whether THIS lane
+    // spawned the post's target, so a parent→child post auto-allows without a human
+    // tap. Resolves the sibling exactly like the post_to_terminal handler does, then
+    // checks the ownership marker (spawn_terminal sets ne.spawnedBy = spawner id). A
+    // flow lane's spawnedBy is `flow:<id>` (not a session id), so it never matches
+    // here — flow posts ride the bypass rule instead. Fails safe (false → card).
+    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
+    didSpawnTarget: (terminalRef) => {
+      try {
+        const sib = siblingsOf({ selfId: id, sessions, terms, names: termNames })
+        const target = resolveSibling(sib, terminalRef)
+        if (!target) return false
+        const te = sessions.get(target.id)
+        return !!te && te.spawnedBy === id
+      } catch { return false }
+    },
     // Tier 3 — the SENDER-side gate for post_to_session (the receipt card lives in
     // the target room). roomHop/crossRoomPostCount reset on a real human turn (code-turn).
     crossRoomPostGate: () => crossRoomPostDecision({ roomHop: entry.roomHop || 0, postCount: entry.crossRoomPostCount || 0, disabled: process.env.TP_PAIRBUS_OFF === '1' }),

package/claude-session.mjs

@@ -16,6 +16,7 @@ import { randomUUID } from 'node:crypto'
 import { query } from '@anthropic-ai/claude-agent-sdk'
 import { sanitizeSession } from './transcript-sanitize.mjs'
 import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
+import { crossPostNeedsCard } from './cross-terminal.mjs'
 
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
@@ -186,7 +187,7 @@ export async function oneShotSummary({ prompt, env, cwd, timeoutMs = 25000 }) {
   return null
 }
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
   // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
@@ -482,16 +483,31 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       const allowed = decision === 'allow'
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: allowed ? 'allow' : 'deny', permissionDecisionReason: allowed ? 'Bypass spawn approved in the ThinkPool room — the new lane runs autonomously.' : 'Bypass spawn denied in the room — do not retry as bypass; re-spawn without mode:bypassPermissions to get a gated lane, or ask what to do.' } }
     }
-    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane —
-    // human-gated EVERY time, never remembered. First a bridge-side precheck
-    // (kill-switch / loop-breaker / per-turn cap) so a blocked or runaway post
-    // never even raises a card; then the standard permission round-trip at 'high'
-    // risk (card offers Deny / Allow-once only — no "always"). Spec INV-4.
+    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane.
+    // First a bridge-side precheck (kill-switch / loop-breaker / per-turn cap) so a
+    // blocked or runaway post never even raises a card. THEN the consent SCOPE
+    // (crossPostNeedsCard, 2026-07-03): a post auto-allows with NO card in exactly
+    // two cases — (a) this lane is in bypassPermissions (bypass means bypass), or
+    // (b) this lane SPAWNED the target (parent→child orchestration; bridge-side
+    // didSpawnTarget resolves the sibling + checks spawnedBy). Every OTHER post — a
+    // non-owner into a lane it did not spawn, in any non-bypass mode — still round-
+    // trips the 'high'-risk card (Deny / Allow-once only). This unblocks automated
+    // conductor→lane orchestration (the 3-stacked-Dispatch-cards bug) WITHOUT loosening
+    // the invariant: a lane can never be posted into by a non-owner without a human tap,
+    // except in bypass. Cross-ROOM post_to_session (dual-consent) is untouched below.
+    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
     if (toolName === 'mcp__thinkpool__post_to_terminal') {
       const gate = crossPostGate ? crossPostGate() : { ok: true }
       if (!gate.ok) {
         return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: gate.reason || 'Cross-terminal post not allowed right now.' } }
       }
+      const spawnedByMe = didSpawnTarget ? !!didSpawnTarget(toolInput?.terminal) : false
+      if (!crossPostNeedsCard({ mode, spawnedByMe })) {
+        const why = mode === 'bypassPermissions'
+          ? 'Auto-approved (cross-terminal post in bypassPermissions mode — bypass means bypass).'
+          : 'Auto-approved (cross-terminal post into a lane you spawned — parent→child orchestration, no per-post tap).'
+        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: why } }
+      }
       let decision = 'deny'
       try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'high' }) ?? 'deny' } catch { decision = 'deny' }
       const allowed = decision === 'allow'

package/cross-terminal.mjs

@@ -193,6 +193,24 @@ export const crossPostDecision = ({ hop = 0, postCount = 0, disabled = false } =
   return { ok: true }
 }
 
+// ── Tier C consent SCOPE — does this post_to_terminal need a human card? ──────
+// Runs AFTER crossPostDecision's kill-switch/hop/cap precheck passes, and decides
+// only whether a person must TAP a card before the (already-permitted) post is
+// delivered. Two — and only two — cases auto-allow (no card):
+//   (1) bypassPermissions mode — bypass means bypass, cross-lane posts included.
+//       Without this, a conductor's post into its OWN lane queued behind a human
+//       tap even in a bypass session (the 3-stacked-Dispatch-cards bug, 2026-07-03).
+//   (2) the SENDER SPAWNED the target lane (parent→child orchestration) — a
+//       conductor posting into a lane it Dispatched with spawn_terminal is not a
+//       stranger writing into someone else's work, so no per-post tap is needed.
+// The CARD REMAINS for every other post: a non-owner posting into a lane it did
+// not spawn, in any non-bypass mode. That is the load-bearing invariant — a lane
+// can never be posted into by a non-owner without a human tap, except in bypass.
+// Cross-ROOM post_to_session is a SEPARATE path (dual-consent) and is untouched.
+// Spec: docs/specs/2026-07-03-xpost-consent-scope.md
+export const crossPostNeedsCard = ({ mode = 'default', spawnedByMe = false } = {}) =>
+  !(mode === 'bypassPermissions' || spawnedByMe === true)
+
 // ── Tier C+: cross-terminal SPAWN (open a FRESH lane the agent owns) ──────────
 // Pure gate for whether a session may open a new terminal on THIS call. The
 // motivating bug: an agent dumped a fan-out into SIBLINGS that were already

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.151",
+  "version": "0.7.153",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/sdk-smoke.mjs

@@ -46,6 +46,7 @@ const version = ver()
 try {
   const sdk = await import('@anthropic-ai/claude-agent-sdk')
   if (typeof sdk.query !== 'function') { emit('FAIL', version, 'query is not a function'); clearTimeout(guard); process.exit(1) }
+  // eslint-disable-next-line require-yield -- deliberately empty: an async generator that ends immediately (the SDK's "no input" stream), never yields.
   async function* noInput() { return }   // ends immediately — never blocks the construct
   const q = sdk.query({ prompt: noInput(), options: { permissionMode: 'default' } })
   const need = ['interrupt', 'setModel', 'setPermissionMode', 'supportedModels']