thinkpool-pair 0.7.152 → 0.7.154

package/bridge.mjs

@@ -81,7 +81,7 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, loadSummary, saveSummary } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'
@@ -1593,16 +1593,20 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
+          const now = Date.now()
           const gate = spawnDecision({
             hop: entry.hop || 0,
-            spawnCount: entry.spawnCount || 0,
+            spawnTimes: entry.spawnTimes || [],                                     // sliding-window burst breaker (replenishes on wall-clock, not on a human turn)
+            now,
             spawnedLive: [...sessions.values()].filter((s) => s.spawnedBy).length,  // dispatch budget counts ONLY spawned lanes
             totalLive: sessions.size + terms.size,                                  // machine cap counts everything
             plan: ownerPlan,                                                        // Free 3 / Plus 6 dispatch ceiling
             disabled: process.env.TP_SPAWN_OFF === '1',
           })
           if (!gate.ok) return okText(gate.reason)
-          entry.spawnCount = (entry.spawnCount || 0) + 1
+          // Record this spawn, pruning timestamps that have already left the window
+          // (identical predicate to recentSpawnCount) so the array can't grow unbounded.
+          entry.spawnTimes = [...(entry.spawnTimes || []).filter((t) => Number.isFinite(t) && t > now - SPAWN.windowMs), now]
           const newId = randomUUID()
           const newRef = String(newId).slice(0, 8)
           const fromRef = String(id).slice(0, 8)
@@ -1623,7 +1627,7 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
           if (args?.task) {
             // One hop deep: the spawned lane cannot spawn/post onward until a person
             // speaks to it (code-turn resets hop to 0). Mirrors the Tier C injection.
-            ne.hop = 1; ne.peekCount = 0; ne.postCount = 0; ne.spawnCount = 0
+            ne.hop = 1; ne.peekCount = 0; ne.postCount = 0; ne.spawnTimes = []
             const msg = `[Task from terminal ${fromRef}'s agent — relayed via ThinkPool cross-terminal; you are a fresh lane it opened for you]\n${args.task}`
             const evt = { kind: 'you', text: msg, by: `terminal ${fromRef} (agent)`, crosspost: true }
             stampEvent(evt); pushLog(ne, evt); bcast('code-event', { term: newId, evt })
@@ -1780,6 +1784,22 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
     // Tier C precheck — the PreToolUse gate calls this BEFORE raising a card, so a
     // disabled/looping/over-cap post never bothers a person. Closes over `entry`.
     crossPostGate: () => crossPostDecision({ hop: entry.hop || 0, postCount: entry.postCount || 0, disabled: process.env.TP_CROSSPOST_OFF === '1' }),
+    // Tier C consent scope (2026-07-03) — the PreToolUse gate asks whether THIS lane
+    // spawned the post's target, so a parent→child post auto-allows without a human
+    // tap. Resolves the sibling exactly like the post_to_terminal handler does, then
+    // checks the ownership marker (spawn_terminal sets ne.spawnedBy = spawner id). A
+    // flow lane's spawnedBy is `flow:<id>` (not a session id), so it never matches
+    // here — flow posts ride the bypass rule instead. Fails safe (false → card).
+    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
+    didSpawnTarget: (terminalRef) => {
+      try {
+        const sib = siblingsOf({ selfId: id, sessions, terms, names: termNames })
+        const target = resolveSibling(sib, terminalRef)
+        if (!target) return false
+        const te = sessions.get(target.id)
+        return !!te && te.spawnedBy === id
+      } catch { return false }
+    },
     // Tier 3 — the SENDER-side gate for post_to_session (the receipt card lives in
     // the target room). roomHop/crossRoomPostCount reset on a real human turn (code-turn).
     crossRoomPostGate: () => crossRoomPostDecision({ roomHop: entry.roomHop || 0, postCount: entry.crossRoomPostCount || 0, disabled: process.env.TP_PAIRBUS_OFF === '1' }),
@@ -2250,7 +2270,7 @@ channel
     s.postCount = 0
     s.pairPeekCount = 0   // cross-room read budget resets with the in-room ones (Tier 1)
     s.crossRoomPostCount = 0   // Tier 3 cross-room post budget resets on a real human turn
-    s.spawnCount = 0   // EN-M3 — spawn budget MUST reset too, else turn 2+ can never spawn a lane
+    s.spawnTimes = []  // EN-M3 — a real human turn clears the spawn burst window instantly (the window also self-replenishes on wall-clock for UNATTENDED cascades that never reach this handler)
     s.hop = 0
     s.roomHop = 0   // a human turn is room-hop 0 — clears any injected cross-room hop depth
     const text = String(payload.text)

package/claude-session.mjs

@@ -16,6 +16,7 @@ import { randomUUID } from 'node:crypto'
 import { query } from '@anthropic-ai/claude-agent-sdk'
 import { sanitizeSession } from './transcript-sanitize.mjs'
 import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
+import { crossPostNeedsCard } from './cross-terminal.mjs'
 
 // ── risk classification — the accent/danger tier of the permission card ──
 // low (read-only) · medium (writes/runs) · network (leaves the machine) ·
@@ -186,7 +187,7 @@ export async function oneShotSummary({ prompt, env, cwd, timeoutMs = 25000 }) {
   return null
 }
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
   // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
@@ -482,16 +483,31 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       const allowed = decision === 'allow'
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: allowed ? 'allow' : 'deny', permissionDecisionReason: allowed ? 'Bypass spawn approved in the ThinkPool room — the new lane runs autonomously.' : 'Bypass spawn denied in the room — do not retry as bypass; re-spawn without mode:bypassPermissions to get a gated lane, or ask what to do.' } }
     }
-    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane —
-    // human-gated EVERY time, never remembered. First a bridge-side precheck
-    // (kill-switch / loop-breaker / per-turn cap) so a blocked or runaway post
-    // never even raises a card; then the standard permission round-trip at 'high'
-    // risk (card offers Deny / Allow-once only — no "always"). Spec INV-4.
+    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane.
+    // First a bridge-side precheck (kill-switch / loop-breaker / per-turn cap) so a
+    // blocked or runaway post never even raises a card. THEN the consent SCOPE
+    // (crossPostNeedsCard, 2026-07-03): a post auto-allows with NO card in exactly
+    // two cases — (a) this lane is in bypassPermissions (bypass means bypass), or
+    // (b) this lane SPAWNED the target (parent→child orchestration; bridge-side
+    // didSpawnTarget resolves the sibling + checks spawnedBy). Every OTHER post — a
+    // non-owner into a lane it did not spawn, in any non-bypass mode — still round-
+    // trips the 'high'-risk card (Deny / Allow-once only). This unblocks automated
+    // conductor→lane orchestration (the 3-stacked-Dispatch-cards bug) WITHOUT loosening
+    // the invariant: a lane can never be posted into by a non-owner without a human tap,
+    // except in bypass. Cross-ROOM post_to_session (dual-consent) is untouched below.
+    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
     if (toolName === 'mcp__thinkpool__post_to_terminal') {
       const gate = crossPostGate ? crossPostGate() : { ok: true }
       if (!gate.ok) {
         return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: gate.reason || 'Cross-terminal post not allowed right now.' } }
       }
+      const spawnedByMe = didSpawnTarget ? !!didSpawnTarget(toolInput?.terminal) : false
+      if (!crossPostNeedsCard({ mode, spawnedByMe })) {
+        const why = mode === 'bypassPermissions'
+          ? 'Auto-approved (cross-terminal post in bypassPermissions mode — bypass means bypass).'
+          : 'Auto-approved (cross-terminal post into a lane you spawned — parent→child orchestration, no per-post tap).'
+        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: why } }
+      }
       let decision = 'deny'
       try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'high' }) ?? 'deny' } catch { decision = 'deny' }
       const allowed = decision === 'allow'

package/cross-terminal.mjs

@@ -193,6 +193,24 @@ export const crossPostDecision = ({ hop = 0, postCount = 0, disabled = false } =
   return { ok: true }
 }
 
+// ── Tier C consent SCOPE — does this post_to_terminal need a human card? ──────
+// Runs AFTER crossPostDecision's kill-switch/hop/cap precheck passes, and decides
+// only whether a person must TAP a card before the (already-permitted) post is
+// delivered. Two — and only two — cases auto-allow (no card):
+//   (1) bypassPermissions mode — bypass means bypass, cross-lane posts included.
+//       Without this, a conductor's post into its OWN lane queued behind a human
+//       tap even in a bypass session (the 3-stacked-Dispatch-cards bug, 2026-07-03).
+//   (2) the SENDER SPAWNED the target lane (parent→child orchestration) — a
+//       conductor posting into a lane it Dispatched with spawn_terminal is not a
+//       stranger writing into someone else's work, so no per-post tap is needed.
+// The CARD REMAINS for every other post: a non-owner posting into a lane it did
+// not spawn, in any non-bypass mode. That is the load-bearing invariant — a lane
+// can never be posted into by a non-owner without a human tap, except in bypass.
+// Cross-ROOM post_to_session is a SEPARATE path (dual-consent) and is untouched.
+// Spec: docs/specs/2026-07-03-xpost-consent-scope.md
+export const crossPostNeedsCard = ({ mode = 'default', spawnedByMe = false } = {}) =>
+  !(mode === 'bypassPermissions' || spawnedByMe === true)
+
 // ── Tier C+: cross-terminal SPAWN (open a FRESH lane the agent owns) ──────────
 // Pure gate for whether a session may open a new terminal on THIS call. The
 // motivating bug: an agent dumped a fan-out into SIBLINGS that were already
@@ -209,15 +227,25 @@ export const crossPostDecision = ({ hop = 0, postCount = 0, disabled = false } =
 //     own terminals, and the human's terminals never eat the dispatch budget. Under
 //     BYOK-only the tokens are the user's, so this is feature-shaping + machine
 //     safety, NOT a ThinkPool-COGS control.
-//   • perTurnCap — a per-turn runaway breaker (mirrors PEEK/CROSSPOST)
+//   • burst window — a SLIDING-window runaway breaker: ≤ perWindowCap spawns per
+//     rolling windowMs. Replaces the old per-HUMAN-turn cap, which starved an
+//     UNATTENDED conductor: agent turns woken by Monitor/task notifications never
+//     traverse the 'code-turn' handler that reset the per-turn counter, so a cascade
+//     that spent its 4 spawns could NEVER spawn again until a person typed. The
+//     window replenishes on wall-clock alone — no turn boundary required — while a
+//     real human turn still clears it instantly (the reset point is unchanged).
 // The caller measures: spawnedLive (live sessions with spawnedBy set), totalLive
-// (sessions.size + terms.size), and resolves `plan` from the room owner.
+// (sessions.size + terms.size), resolves `plan` from the room owner, and passes the
+// lane's recent spawn timestamps (`spawnTimes`) plus the current clock (`now`) — so
+// this stays a PURE function (no Date.now inside; the clock is injected, like
+// spawnCount was before).
 export const SPAWN = {
-  maxHop: 1,            // human turn = hop 0; a spawned/injected lane = hop ≥ 1, CANNOT spawn onward
-  perTurnCap: 4,        // spawn_terminal calls allowed per turn
-  freeMaxSpawned: 3,    // Free plan dispatch ceiling (concurrent spawned lanes)
-  plusMaxSpawned: 6,    // Plus plan dispatch ceiling
-  machineMax: 10,       // hard cap on TOTAL live lanes (the laptop/runaway backstop)
+  maxHop: 1,               // human turn = hop 0; a spawned/injected lane = hop ≥ 1, CANNOT spawn onward
+  perWindowCap: 4,         // spawn_terminal calls allowed per rolling window (burst breaker)
+  windowMs: 10 * 60 * 1000, // sliding window over which perWindowCap applies (10 min)
+  freeMaxSpawned: 3,       // Free plan dispatch ceiling (concurrent spawned lanes)
+  plusMaxSpawned: 6,       // Plus plan dispatch ceiling
+  machineMax: 10,          // hard cap on TOTAL live lanes (the laptop/runaway backstop)
 }
 
 // Plan → dispatch ceiling. Anything not 'plus' is treated as Free (the safe default).
@@ -226,14 +254,24 @@ export const maxSpawnedFor = (plan, limits = SPAWN) => {
   return plan === 'plus' ? o.plusMaxSpawned : o.freeMaxSpawned
 }
 
-export const spawnDecision = ({ hop = 0, spawnCount = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) => {
+// Count spawn timestamps still inside the sliding window ending at `now`. Timestamps
+// strictly older than `now - windowMs` have replenished (fallen out of the window).
+// Non-finite entries are ignored defensively. Exported so the bridge can prune its
+// stored spawnTimes with the identical predicate (no unbounded growth).
+export const recentSpawnCount = (spawnTimes, now, windowMs = SPAWN.windowMs) =>
+  (Array.isArray(spawnTimes) ? spawnTimes : []).filter((t) => Number.isFinite(t) && t > now - windowMs).length
+
+export const spawnDecision = ({ hop = 0, spawnTimes = [], now = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) => {
   const o = { ...SPAWN, ...(limits || {}) }
   if (disabled) return { ok: false, reason: 'Spawning terminals is disabled in this room.' }
   if (hop >= o.maxHop) return { ok: false, reason: 'Spawn limit reached — a terminal reached via cross-terminal cannot itself open further terminals; a person must open the next lane.' }
   if (totalLive >= o.machineMax) return { ok: false, reason: `Room is at the machine cap (${o.machineMax} live lanes) — close one before opening another.` }
   const cap = maxSpawnedFor(plan, o)
   if (spawnedLive >= cap) return { ok: false, reason: `Dispatch ceiling reached (${cap} lane${cap === 1 ? '' : 's'} on the ${plan} plan)${plan !== 'plus' ? ` — Plus raises it to ${o.plusMaxSpawned}.` : '.'} Close a dispatched lane to open another.` }
-  if (spawnCount >= o.perTurnCap) return { ok: false, reason: `Spawn limit reached for this turn (${o.perTurnCap}).` }
+  if (recentSpawnCount(spawnTimes, now, o.windowMs) >= o.perWindowCap) {
+    const mins = Math.round(o.windowMs / 60000)
+    return { ok: false, reason: `Spawn burst limit reached (${o.perWindowCap} in ${mins} min) — this replenishes as the window slides forward, or instantly when a person types into this lane.` }
+  }
   return { ok: true }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.152",
+  "version": "0.7.154",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {