thinkpool-pair 0.7.194 → 0.7.196

package/bridge.mjs

@@ -50,7 +50,9 @@ import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
-import { startCodexSession, readCodexDefaultModel, readCodexModels } from './codex-session.mjs'
+import { startCodexSession, readCodexDefaultModel, readCodexModels, codexConfigForMode } from './codex-session.mjs'
+
+const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
 import { normalizePlanOutput, laneModelFor } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph; laneModelFor — per-slice model tier (2026-07-03-flow-lane-model-tiers)
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
@@ -1050,7 +1052,7 @@ const announce = () => {
       // turnActive). Authoritative — the bridge owns the turn — so the /code
       // dashboard reads "N agents working" off the roster instead of sniffing
       // the live code-event stream (which a passive dashboard channel misses).
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.runtime === 'codex' ? { approvalPolicy: 'never', models: s.models || [] } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [] } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
         // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
         // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
         // built-in/default Claude path (no badge). Makes the lane's provider badge +
@@ -1546,7 +1548,7 @@ function worktreeSnapshot(cwd) {
 function openStructured({ id, runtime = 'claude', model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
   if (sessions.has(id)) return
   runtime = runtime === 'codex' ? 'codex' : 'claude'
-  if (runtime === 'codex') mode = 'bypassPermissions'
+  mode = STRUCTURED_MODES.has(mode) ? mode : 'default'
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
   // label (entry.model) and the SDK's `model` option below. These used to be computed
   // separately: the label resolved the provider's configured model while the SDK got the
@@ -2963,9 +2965,17 @@ channel
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) {
+    if (s && STRUCTURED_MODES.has(payload.mode)) {
       if (s.runtime === 'codex') {
-        s.mode = 'bypassPermissions'
+        if (!s.session.setMode(payload.mode)) {
+          const evt = { kind: 'control', text: 'finish or stop the current Codex turn before switching permissions' }
+          pushLog(s, evt)
+          bcast('code-event', { term: payload.term, evt })
+          announce()
+          return
+        }
+        s.mode = payload.mode
+        s.flush?.()
         announce()
         return
       }

package/codex-session.mjs

@@ -10,10 +10,10 @@
 // no tool_use↔function-call loss. Auth = the HOST's `codex login` (ChatGPT,
 // flat sub) by default; BYOK via env CODEX_API_KEY works too (exec-only).
 //
-// v1 TRADEOFF (spec §tradeoff, G3): `codex exec` is non-interactive — fixed
-// --sandbox, NO per-tool human gate. The room OBSERVES each command/file-change
-// live (item.started→item.completed) but cannot approve/deny mid-run. Codex's
-// own sandbox governs safety. Default sandbox: workspace-write.
+// `codex exec` is non-interactive, so ThinkPool maps its shared permission modes
+// onto Codex's native sandbox + approval policy. A mode change starts a fresh
+// Codex thread so the new sandbox actually takes effect; the visible transcript
+// remains in ThinkPool.
 //
 // ONE-SHOT-PER-TURN model: unlike Claude's long-lived query(), `codex exec` is
 // one prompt → run → exit. sendTurn spawns an exec; continuity across turns uses
@@ -30,7 +30,17 @@ import readline from 'node:readline'
 import { CodexEventMapper } from './codex-event-mapper.mjs'
 
 const DEFAULT_SANDBOX = 'workspace-write'
-const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write'])
+const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
+export const CODEX_MODE_CONFIG = {
+  default:           { sandbox: 'workspace-write', approvalPolicy: 'untrusted' },
+  acceptEdits:       { sandbox: 'workspace-write', approvalPolicy: 'on-request' },
+  plan:              { sandbox: 'read-only',       approvalPolicy: 'never' },
+  bypassPermissions: { sandbox: 'danger-full-access', approvalPolicy: 'never' },
+}
+
+export function codexConfigForMode(mode) {
+  return CODEX_MODE_CONFIG[mode] || CODEX_MODE_CONFIG.default
+}
 
 export function readCodexDefaultModel({ home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), fsImpl = fs } = {}) {
   try {
@@ -64,7 +74,7 @@ export function buildCodexPrompt({ text, rolePrompt, roomContext }) {
   return `<thinkpool-context>\n${additions.join('\n\n')}\n</thinkpool-context>\n\n${String(text ?? '')}`
 }
 
-export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig, prompt }) {
+export function buildCodexExecArgs({ sessionId, model, sandbox, approvalPolicy = 'untrusted', providerConfig, prompt }) {
   const safeSandbox = normalizeCodexSandbox(sandbox)
   const args = sessionId
     // `codex exec resume` deliberately has no --sandbox option. The resumed
@@ -73,6 +83,7 @@ export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig,
     ? ['exec', 'resume', '--json', '--skip-git-repo-check']
     : ['exec', '--json', '--sandbox', safeSandbox, '--skip-git-repo-check']
   if (model) args.push('-m', model)
+  args.push('-c', `approval_policy="${approvalPolicy}"`)
   if (providerConfig) args.push('-c', providerConfig)
   if (sessionId) args.push(sessionId)
   args.push(String(prompt ?? ''))
@@ -91,8 +102,10 @@ export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig,
  * @param {string} [o.providerConfig] optional -c overrides / provider block (M2: from the provider registry)
  * @returns {{ sendTurn(text), abort(), end(), readonly sessionId }}
  */
-export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_SANDBOX, onEvent, providerConfig, rolePrompt, roomContext }) {
-  sandbox = normalizeCodexSandbox(sandbox)
+export function startCodexSession({ cwd, model, resume, env, sandbox, mode = 'default', onEvent, providerConfig, rolePrompt, roomContext }) {
+  let activeMode = CODEX_MODE_CONFIG[mode] ? mode : 'default'
+  let modeConfig = codexConfigForMode(activeMode)
+  sandbox = normalizeCodexSandbox(sandbox || modeConfig.sandbox)
   const childEnv = { ...process.env, ...(env || {}) }
   let sessionId = resume || null
   let turnNo = resume ? 1 : 0
@@ -115,6 +128,7 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
       sessionId: turnNo === 0 ? null : sessionId,
       model: activeModel,
       sandbox,
+      approvalPolicy: modeConfig.approvalPolicy,
       providerConfig,
       prompt,
     })
@@ -214,10 +228,17 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
       mapper.setModel(activeModel)
       return true
     },
-    // Codex v1 has a fixed sandbox for the lifetime of the lane. The bridge may
-    // still call setMode from shared chrome; report unsupported rather than
-    // pretending the Claude permission mode changed Codex's sandbox.
-    setMode() { return false },
+    setMode(nextMode) {
+      if (turnActive || !CODEX_MODE_CONFIG[nextMode]) return false
+      activeMode = nextMode
+      modeConfig = codexConfigForMode(activeMode)
+      sandbox = modeConfig.sandbox
+      // Resume retains the original sandbox. Start a fresh native thread on the
+      // next turn so the selected mode is real, while ThinkPool keeps the lane log.
+      sessionId = null
+      turnNo = 0
+      return true
+    },
     clearContext() {
       if (turnActive) return false
       sessionId = null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.194",
+  "version": "0.7.196",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/service.mjs

@@ -234,12 +234,18 @@ WantedBy=default.target
 // Blocking sleep (installService runs synchronously from the interactive menu; the
 // user is watching, so we WANT to wait + report the real outcome, not fire-and-forget).
 const sleepMs = (ms) => { try { execSync(`sleep ${(ms / 1000).toFixed(2)}`) } catch { /* noop */ } }
-// Which thinkpool-pair versions are running right now (the account supervisor shows as
-// `npm exec thinkpool-pair@<ver>`). Returns a Set of version strings.
+// Parse both legacy npx commands (`thinkpool-pair@<ver>`) and stable runtime commands
+// (`.../runtimes/<ver>/...`).
+export function parseRunningPairVersions(out) {
+  const versions = String(out).match(/(?:thinkpool-pair@|runtimes\/)(\d+\.\d+\.\d+)/g) || []
+  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+/)?.[0]).filter(Boolean))
+}
+
+// Which thinkpool-pair versions are running right now. Returns a Set of versions.
 const runningPairVersions = () => {
   try {
-    const out = execSync(`ps ax -o command= 2>/dev/null | grep -oE 'thinkpool-pair@[0-9]+\\.[0-9]+\\.[0-9]+' | sort -u`, { encoding: 'utf8', shell: '/bin/bash' })
-    return new Set(out.split('\n').map((l) => l.trim().split('@')[1]).filter(Boolean))
+    const out = execSync('ps ax -o command= 2>/dev/null', { encoding: 'utf8', shell: '/bin/bash' })
+    return parseRunningPairVersions(out)
   } catch { return new Set() }
 }
 const darwinSvcLoaded = (lbl) => { try { execSync(`launchctl print gui/$(id -u)/${lbl}`, { stdio: 'ignore' }); return true } catch { return false } }