thinkpool-pair 0.7.193 → 0.7.196

package/bridge.mjs

@@ -50,7 +50,9 @@ import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
-import { startCodexSession, readCodexDefaultModel, readCodexModels } from './codex-session.mjs'
+import { startCodexSession, readCodexDefaultModel, readCodexModels, codexConfigForMode } from './codex-session.mjs'
+
+const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
 import { normalizePlanOutput, laneModelFor } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph; laneModelFor — per-slice model tier (2026-07-03-flow-lane-model-tiers)
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
@@ -1050,7 +1052,7 @@ const announce = () => {
       // turnActive). Authoritative — the bridge owns the turn — so the /code
       // dashboard reads "N agents working" off the roster instead of sniffing
       // the live code-event stream (which a passive dashboard channel misses).
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.runtime === 'codex' ? { approvalPolicy: 'never', models: s.models || [] } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [] } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
         // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
         // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
         // built-in/default Claude path (no badge). Makes the lane's provider badge +
@@ -1546,7 +1548,7 @@ function worktreeSnapshot(cwd) {
 function openStructured({ id, runtime = 'claude', model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
   if (sessions.has(id)) return
   runtime = runtime === 'codex' ? 'codex' : 'claude'
-  if (runtime === 'codex') mode = 'bypassPermissions'
+  mode = STRUCTURED_MODES.has(mode) ? mode : 'default'
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
   // label (entry.model) and the SDK's `model` option below. These used to be computed
   // separately: the label resolved the provider's configured model while the SDK got the
@@ -2963,9 +2965,17 @@ channel
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) {
+    if (s && STRUCTURED_MODES.has(payload.mode)) {
       if (s.runtime === 'codex') {
-        s.mode = 'bypassPermissions'
+        if (!s.session.setMode(payload.mode)) {
+          const evt = { kind: 'control', text: 'finish or stop the current Codex turn before switching permissions' }
+          pushLog(s, evt)
+          bcast('code-event', { term: payload.term, evt })
+          announce()
+          return
+        }
+        s.mode = payload.mode
+        s.flush?.()
         announce()
         return
       }

package/codex-session.mjs

@@ -10,10 +10,10 @@
 // no tool_use↔function-call loss. Auth = the HOST's `codex login` (ChatGPT,
 // flat sub) by default; BYOK via env CODEX_API_KEY works too (exec-only).
 //
-// v1 TRADEOFF (spec §tradeoff, G3): `codex exec` is non-interactive — fixed
-// --sandbox, NO per-tool human gate. The room OBSERVES each command/file-change
-// live (item.started→item.completed) but cannot approve/deny mid-run. Codex's
-// own sandbox governs safety. Default sandbox: workspace-write.
+// `codex exec` is non-interactive, so ThinkPool maps its shared permission modes
+// onto Codex's native sandbox + approval policy. A mode change starts a fresh
+// Codex thread so the new sandbox actually takes effect; the visible transcript
+// remains in ThinkPool.
 //
 // ONE-SHOT-PER-TURN model: unlike Claude's long-lived query(), `codex exec` is
 // one prompt → run → exit. sendTurn spawns an exec; continuity across turns uses
@@ -30,7 +30,17 @@ import readline from 'node:readline'
 import { CodexEventMapper } from './codex-event-mapper.mjs'
 
 const DEFAULT_SANDBOX = 'workspace-write'
-const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write'])
+const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
+export const CODEX_MODE_CONFIG = {
+  default:           { sandbox: 'workspace-write', approvalPolicy: 'untrusted' },
+  acceptEdits:       { sandbox: 'workspace-write', approvalPolicy: 'on-request' },
+  plan:              { sandbox: 'read-only',       approvalPolicy: 'never' },
+  bypassPermissions: { sandbox: 'danger-full-access', approvalPolicy: 'never' },
+}
+
+export function codexConfigForMode(mode) {
+  return CODEX_MODE_CONFIG[mode] || CODEX_MODE_CONFIG.default
+}
 
 export function readCodexDefaultModel({ home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), fsImpl = fs } = {}) {
   try {
@@ -64,7 +74,7 @@ export function buildCodexPrompt({ text, rolePrompt, roomContext }) {
   return `<thinkpool-context>\n${additions.join('\n\n')}\n</thinkpool-context>\n\n${String(text ?? '')}`
 }
 
-export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig, prompt }) {
+export function buildCodexExecArgs({ sessionId, model, sandbox, approvalPolicy = 'untrusted', providerConfig, prompt }) {
   const safeSandbox = normalizeCodexSandbox(sandbox)
   const args = sessionId
     // `codex exec resume` deliberately has no --sandbox option. The resumed
@@ -73,6 +83,7 @@ export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig,
     ? ['exec', 'resume', '--json', '--skip-git-repo-check']
     : ['exec', '--json', '--sandbox', safeSandbox, '--skip-git-repo-check']
   if (model) args.push('-m', model)
+  args.push('-c', `approval_policy="${approvalPolicy}"`)
   if (providerConfig) args.push('-c', providerConfig)
   if (sessionId) args.push(sessionId)
   args.push(String(prompt ?? ''))
@@ -91,8 +102,10 @@ export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig,
  * @param {string} [o.providerConfig] optional -c overrides / provider block (M2: from the provider registry)
  * @returns {{ sendTurn(text), abort(), end(), readonly sessionId }}
  */
-export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_SANDBOX, onEvent, providerConfig, rolePrompt, roomContext }) {
-  sandbox = normalizeCodexSandbox(sandbox)
+export function startCodexSession({ cwd, model, resume, env, sandbox, mode = 'default', onEvent, providerConfig, rolePrompt, roomContext }) {
+  let activeMode = CODEX_MODE_CONFIG[mode] ? mode : 'default'
+  let modeConfig = codexConfigForMode(activeMode)
+  sandbox = normalizeCodexSandbox(sandbox || modeConfig.sandbox)
   const childEnv = { ...process.env, ...(env || {}) }
   let sessionId = resume || null
   let turnNo = resume ? 1 : 0
@@ -115,6 +128,7 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
       sessionId: turnNo === 0 ? null : sessionId,
       model: activeModel,
       sandbox,
+      approvalPolicy: modeConfig.approvalPolicy,
       providerConfig,
       prompt,
     })
@@ -214,10 +228,17 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
       mapper.setModel(activeModel)
       return true
     },
-    // Codex v1 has a fixed sandbox for the lifetime of the lane. The bridge may
-    // still call setMode from shared chrome; report unsupported rather than
-    // pretending the Claude permission mode changed Codex's sandbox.
-    setMode() { return false },
+    setMode(nextMode) {
+      if (turnActive || !CODEX_MODE_CONFIG[nextMode]) return false
+      activeMode = nextMode
+      modeConfig = codexConfigForMode(activeMode)
+      sandbox = modeConfig.sandbox
+      // Resume retains the original sandbox. Start a fresh native thread on the
+      // next turn so the selected mode is real, while ThinkPool keeps the lane log.
+      sessionId = null
+      turnNo = 0
+      return true
+    },
     clearContext() {
       if (turnActive) return false
       sessionId = null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.193",
+  "version": "0.7.196",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -66,9 +66,30 @@ function npxPath(platform) {
   try { fs.accessSync(cand); return cand } catch { return platform === 'win32' ? 'npx.cmd' : 'npx' }
 }
 
+function npmPath(platform = process.platform) {
+  const bin = path.dirname(process.execPath)
+  const cand = path.join(bin, platform === 'win32' ? 'npm.cmd' : 'npm')
+  try { fs.accessSync(cand); return cand } catch { return platform === 'win32' ? 'npm.cmd' : 'npm' }
+}
+
+// Persistent services never execute through npx. Provision an immutable, versioned
+// runtime from the tarball URL (which bypasses stale npm packument metadata), then point
+// launchd/systemd directly at its bridge.mjs with the current Node binary.
+export function provisionRuntime(version, { exec = execSync } = {}) {
+  if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(String(version))) throw new Error(`invalid runtime version: ${version}`)
+  const dir = path.join(os.homedir(), '.thinkpool-pair', 'runtimes', String(version))
+  const entry = path.join(dir, 'node_modules', 'thinkpool-pair', 'bridge.mjs')
+  if (fs.existsSync(entry)) return entry
+  fs.mkdirSync(dir, { recursive: true })
+  const tarball = `https://registry.npmjs.org/thinkpool-pair/-/thinkpool-pair-${version}.tgz`
+  exec(`${shq(npmPath())} install --prefix ${shq(dir)} ${shq(tarball)} --prefer-online --no-audit --no-fund`, { stdio: 'inherit', shell: '/bin/bash' })
+  if (!fs.existsSync(entry)) throw new Error(`runtime install completed without ${entry}`)
+  return entry
+}
+
 // Pure artifact builder — returned shape is testable without side effects.
 // room falsy → ACCOUNT service (bare `thinkpool-pair`, auto-serves all sessions).
-export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate = false, version = VERSION, staleProof = false } = {}) {
+export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate = false, version = VERSION, staleProof = false, runtimeEntry = null } = {}) {
   const npx = npxPath(platform)
   const cwd = process.cwd()
   const id = slug(room)
@@ -97,7 +118,9 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   if (platform === 'darwin') {
     // launchd KeepAlive supervises. staleProof → wrap in a cache-wiping /bin/bash launch so
     // every (re)start re-fetches the pinned version fresh (deliberate-update path).
-    const args = staleProof
+    const args = runtimeEntry
+      ? [process.execPath, runtimeEntry, ...(room ? [room] : []), ...tail]
+      : staleProof
       ? ['/bin/bash', '-lc', `${cacheWipe('"$HOME"')}; exec ${[npx, ...pkgArgs, ...tail].map(shq).join(' ')}`]
       : [npx, ...pkgArgs, ...tail]
     const file = path.join(os.homedir(), 'Library', 'LaunchAgents', `${label(room)}.plist`)
@@ -153,11 +176,15 @@ export function buildArtifact(platform, { room = null, cmdArgs = [], autoUpdate
   }
 
   if (platform === 'linux') {
-    const args = [npx, ...pkgArgs, ...tail]   // systemd Restart=always supervises
+    const args = runtimeEntry
+      ? [process.execPath, runtimeEntry, ...(room ? [room] : []), ...tail]
+      : [npx, ...pkgArgs, ...tail]   // systemd Restart=always supervises
     const file = path.join(os.homedir(), '.config', 'systemd', 'user', `${label(room)}.service`)
     // staleProof → cache-wiping /bin/bash launch (same intent as darwin). `$$HOME` so systemd
     // emits a literal $HOME to bash rather than expanding it itself (empty + warning).
-    const execStart = staleProof
+    const execStart = runtimeEntry
+      ? args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(' ')
+      : staleProof
       ? `/bin/bash -lc "${cacheWipe('$$HOME')}; exec ${[npx, ...pkgArgs, ...tail].join(' ')}"`
       : args.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(' ')
     const content = `[Unit]
@@ -192,7 +219,9 @@ WantedBy=default.target
     // so it gets login-persistence only — no in-process crash-restart on Windows.
     const startup = path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup')
     const file = path.join(startup, `thinkpool-pair-${id}.cmd`)
-    const inner = room
+    const inner = runtimeEntry
+      ? [process.execPath, runtimeEntry, ...(room ? [room, '--supervise'] : []), ...tail].map((s) => `"${s}"`).join(' ')
+      : room
       ? ['npx', '-y', ...onlineFlag, verSpec, room, '--supervise', ...tail].join(' ')
       : ['npx', '-y', ...onlineFlag, verSpec].join(' ')
     const content = `@echo off\r\ntitle thinkpool-pair ${id}\r\n${inner}\r\n`
@@ -205,12 +234,18 @@ WantedBy=default.target
 // Blocking sleep (installService runs synchronously from the interactive menu; the
 // user is watching, so we WANT to wait + report the real outcome, not fire-and-forget).
 const sleepMs = (ms) => { try { execSync(`sleep ${(ms / 1000).toFixed(2)}`) } catch { /* noop */ } }
-// Which thinkpool-pair versions are running right now (the account supervisor shows as
-// `npm exec thinkpool-pair@<ver>`). Returns a Set of version strings.
+// Parse both legacy npx commands (`thinkpool-pair@<ver>`) and stable runtime commands
+// (`.../runtimes/<ver>/...`).
+export function parseRunningPairVersions(out) {
+  const versions = String(out).match(/(?:thinkpool-pair@|runtimes\/)(\d+\.\d+\.\d+)/g) || []
+  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+/)?.[0]).filter(Boolean))
+}
+
+// Which thinkpool-pair versions are running right now. Returns a Set of versions.
 const runningPairVersions = () => {
   try {
-    const out = execSync(`ps ax -o command= 2>/dev/null | grep -oE 'thinkpool-pair@[0-9]+\\.[0-9]+\\.[0-9]+' | sort -u`, { encoding: 'utf8', shell: '/bin/bash' })
-    return new Set(out.split('\n').map((l) => l.trim().split('@')[1]).filter(Boolean))
+    const out = execSync('ps ax -o command= 2>/dev/null', { encoding: 'utf8', shell: '/bin/bash' })
+    return parseRunningPairVersions(out)
   } catch { return new Set() }
 }
 const darwinSvcLoaded = (lbl) => { try { execSync(`launchctl print gui/$(id -u)/${lbl}`, { stdio: 'ignore' }); return true } catch { return false } }
@@ -299,7 +334,14 @@ export function sweepExistingServices(keepLabel, platform = process.platform) {
 // pinned version is fetched fresh on every (re)start. buildArtifact keeps staleProof=false
 // so its unit tests assert the pure pinned shape.
 export function installService(room, cmdArgs = [], { autoUpdate = false, version = VERSION, staleProof = true } = {}) {
-  const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof })
+  // Pinned services get a stable local runtime. The legacy @latest opt-in keeps its
+  // existing npx behavior until it resolves a concrete version through updateService.
+  let runtimeEntry = null
+  if (!autoUpdate) {
+    try { runtimeEntry = provisionRuntime(version) }
+    catch (e) { process.stderr.write(`  ⚠ runtime install failed; service left unchanged: ${e.message}\n`); return false }
+  }
+  const a = buildArtifact(process.platform, { room, cmdArgs, autoUpdate, version, staleProof, runtimeEntry })
   // F4: clear every OTHER pre-existing pair service first, so only the one we install remains
   // (the "two account services live" storm trigger). Our own label is bootout+bootstrapped
   // by a.post below, so keep it.
@@ -323,10 +365,11 @@ export function installService(room, cmdArgs = [], { autoUpdate = false, version
     ? (process.platform === 'win32'
         ? 'auto-update ON: a new thinkpool-pair@latest applies on the next login/restart (Windows has no in-process self-update).'
         : `auto-update ON: checks npm ~every 30 min and restarts to apply a new @latest once sessions are idle (≥${idleSecs}s quiet; they resume in place).`)
-    : `PINNED to ${version}${staleProof ? ' (stale-proof: every restart re-fetches it fresh, never a stale npx cache)' : ''} (safe default — a bad publish can't auto-roll to this always-on bridge). To update: use "Restart & update the bridge" (or re-run install-service from a newer thinkpool-pair). Pass --auto-update to track @latest instead.`
+    : `PINNED to ${version} (stable local runtime; restarts do not depend on npx or the network). To update: use "Restart & update the bridge" (or re-run install-service from a newer thinkpool-pair). Pass --auto-update to track @latest instead.`
   const removeArg = room ? ` ${room}` : ''
   const what = room ? `room ${room}` : 'your account (auto-serves every session)'
   process.stderr.write(`  ◆ ${what}\n  ◆ ${a.note}\n  ◆ ${updateNote}\n  ◆ logs: ${path.join(a.logDir, `${slug(room)}.log`)}\n  ◆ remove with: thinkpool-pair uninstall-service${removeArg}\n\n`)
+  return true
 }
 
 // Restart an already-installed boot-persistent service. launchd/systemd relaunch
@@ -376,8 +419,7 @@ export function updateService(room, { exec = execSync, install = installService,
     return false
   }
   process.stderr.write(`\n  ◆ updating the background service to v${target} and restarting…\n`)
-  install(room, [], { version: target, staleProof: true })
-  return true
+  return install(room, [], { version: target, staleProof: true }) !== false
 }
 
 // Ground truth: is the OS service manager ACTUALLY running our service right now?