thinkpool-pair 0.7.152 → 0.7.153

package/bridge.mjs

@@ -1780,6 +1780,22 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
     // Tier C precheck — the PreToolUse gate calls this BEFORE raising a card, so a
     // disabled/looping/over-cap post never bothers a person. Closes over `entry`.
     crossPostGate: () => crossPostDecision({ hop: entry.hop || 0, postCount: entry.postCount || 0, disabled: process.env.TP_CROSSPOST_OFF === '1' }),
+    // Tier C consent scope (2026-07-03) — the PreToolUse gate asks whether THIS lane
+    // spawned the post's target, so a parent→child post auto-allows without a human
+    // tap. Resolves the sibling exactly like the post_to_terminal handler does, then
+    // checks the ownership marker (spawn_terminal sets ne.spawnedBy = spawner id). A
+    // flow lane's spawnedBy is `flow:<id>` (not a session id), so it never matches
+    // here — flow posts ride the bypass rule instead. Fails safe (false → card).
+    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
+    didSpawnTarget: (terminalRef) => {
+      try {
+        const sib = siblingsOf({ selfId: id, sessions, terms, names: termNames })
+        const target = resolveSibling(sib, terminalRef)
+        if (!target) return false
+        const te = sessions.get(target.id)
+        return !!te && te.spawnedBy === id
+      } catch { return false }
+    },
     // Tier 3 — the SENDER-side gate for post_to_session (the receipt card lives in
     // the target room). roomHop/crossRoomPostCount reset on a real human turn (code-turn).
     crossRoomPostGate: () => crossRoomPostDecision({ roomHop: entry.roomHop || 0, postCount: entry.crossRoomPostCount || 0, disabled: process.env.TP_PAIRBUS_OFF === '1' }),

package/claude-session.mjs

@@ -16,6 +16,7 @@ import { randomUUID } from 'node:crypto'
 import { query } from '@anthropic-ai/claude-agent-sdk'
 import { sanitizeSession } from './transcript-sanitize.mjs'
 import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
+import { crossPostNeedsCard } from './cross-terminal.mjs'
 
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
@@ -186,7 +187,7 @@ export async function oneShotSummary({ prompt, env, cwd, timeoutMs = 25000 }) {
   return null
 }
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
   // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
@@ -482,16 +483,31 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       const allowed = decision === 'allow'
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: allowed ? 'allow' : 'deny', permissionDecisionReason: allowed ? 'Bypass spawn approved in the ThinkPool room — the new lane runs autonomously.' : 'Bypass spawn denied in the room — do not retry as bypass; re-spawn without mode:bypassPermissions to get a gated lane, or ask what to do.' } }
     }
-    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane —
-    // human-gated EVERY time, never remembered. First a bridge-side precheck
-    // (kill-switch / loop-breaker / per-turn cap) so a blocked or runaway post
-    // never even raises a card; then the standard permission round-trip at 'high'
-    // risk (card offers Deny / Allow-once only — no "always"). Spec INV-4.
+    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane.
+    // First a bridge-side precheck (kill-switch / loop-breaker / per-turn cap) so a
+    // blocked or runaway post never even raises a card. THEN the consent SCOPE
+    // (crossPostNeedsCard, 2026-07-03): a post auto-allows with NO card in exactly
+    // two cases — (a) this lane is in bypassPermissions (bypass means bypass), or
+    // (b) this lane SPAWNED the target (parent→child orchestration; bridge-side
+    // didSpawnTarget resolves the sibling + checks spawnedBy). Every OTHER post — a
+    // non-owner into a lane it did not spawn, in any non-bypass mode — still round-
+    // trips the 'high'-risk card (Deny / Allow-once only). This unblocks automated
+    // conductor→lane orchestration (the 3-stacked-Dispatch-cards bug) WITHOUT loosening
+    // the invariant: a lane can never be posted into by a non-owner without a human tap,
+    // except in bypass. Cross-ROOM post_to_session (dual-consent) is untouched below.
+    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
     if (toolName === 'mcp__thinkpool__post_to_terminal') {
       const gate = crossPostGate ? crossPostGate() : { ok: true }
       if (!gate.ok) {
         return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: gate.reason || 'Cross-terminal post not allowed right now.' } }
       }
+      const spawnedByMe = didSpawnTarget ? !!didSpawnTarget(toolInput?.terminal) : false
+      if (!crossPostNeedsCard({ mode, spawnedByMe })) {
+        const why = mode === 'bypassPermissions'
+          ? 'Auto-approved (cross-terminal post in bypassPermissions mode — bypass means bypass).'
+          : 'Auto-approved (cross-terminal post into a lane you spawned — parent→child orchestration, no per-post tap).'
+        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: why } }
+      }
       let decision = 'deny'
       try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'high' }) ?? 'deny' } catch { decision = 'deny' }
       const allowed = decision === 'allow'

package/cross-terminal.mjs

@@ -193,6 +193,24 @@ export const crossPostDecision = ({ hop = 0, postCount = 0, disabled = false } =
   return { ok: true }
 }
 
+// ── Tier C consent SCOPE — does this post_to_terminal need a human card? ──────
+// Runs AFTER crossPostDecision's kill-switch/hop/cap precheck passes, and decides
+// only whether a person must TAP a card before the (already-permitted) post is
+// delivered. Two — and only two — cases auto-allow (no card):
+//   (1) bypassPermissions mode — bypass means bypass, cross-lane posts included.
+//       Without this, a conductor's post into its OWN lane queued behind a human
+//       tap even in a bypass session (the 3-stacked-Dispatch-cards bug, 2026-07-03).
+//   (2) the SENDER SPAWNED the target lane (parent→child orchestration) — a
+//       conductor posting into a lane it Dispatched with spawn_terminal is not a
+//       stranger writing into someone else's work, so no per-post tap is needed.
+// The CARD REMAINS for every other post: a non-owner posting into a lane it did
+// not spawn, in any non-bypass mode. That is the load-bearing invariant — a lane
+// can never be posted into by a non-owner without a human tap, except in bypass.
+// Cross-ROOM post_to_session is a SEPARATE path (dual-consent) and is untouched.
+// Spec: docs/specs/2026-07-03-xpost-consent-scope.md
+export const crossPostNeedsCard = ({ mode = 'default', spawnedByMe = false } = {}) =>
+  !(mode === 'bypassPermissions' || spawnedByMe === true)
+
 // ── Tier C+: cross-terminal SPAWN (open a FRESH lane the agent owns) ──────────
 // Pure gate for whether a session may open a new terminal on THIS call. The
 // motivating bug: an agent dumped a fan-out into SIBLINGS that were already

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.152",
+  "version": "0.7.153",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {