thinkpool-pair 0.7.194 → 0.7.197

package/bridge.mjs

@@ -50,7 +50,10 @@ import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
-import { startCodexSession, readCodexDefaultModel, readCodexModels } from './codex-session.mjs'
+import { startCodexSession, readCodexDefaultModel, readCodexModels, codexConfigForMode } from './codex-session.mjs'
+import { createManagedLaneWorktree, removeManagedLaneWorktree } from './lane-worktree.mjs'
+
+const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
 import { normalizePlanOutput, laneModelFor } from './flow-task-graph.mjs'   // FL-B1 — validate the conductor's submit_flow_plan task-graph; laneModelFor — per-slice model tier (2026-07-03-flow-lane-model-tiers)
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
@@ -1050,7 +1053,7 @@ const announce = () => {
       // turnActive). Authoritative — the bridge owns the turn — so the /code
       // dashboard reads "N agents working" off the roster instead of sniffing
       // the live code-event stream (which a passive dashboard channel misses).
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.runtime === 'codex' ? { approvalPolicy: 'never', models: s.models || [] } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', runtime: s.runtime || 'claude', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.runtime === 'codex' ? { approvalPolicy: codexConfigForMode(s.mode).approvalPolicy, models: s.models || [] } : {}), ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
         // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
         // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
         // built-in/default Claude path (no badge). Makes the lane's provider badge +
@@ -1543,10 +1546,10 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, runtime = 'claude', model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
+function openStructured({ id, runtime = 'claude', model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, managedWorktree, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
   if (sessions.has(id)) return
   runtime = runtime === 'codex' ? 'codex' : 'claude'
-  if (runtime === 'codex') mode = 'bypassPermissions'
+  mode = STRUCTURED_MODES.has(mode) ? mode : 'default'
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
   // label (entry.model) and the SDK's `model` option below. These used to be computed
   // separately: the label resolved the provider's configured model while the SDK got the
@@ -1573,7 +1576,7 @@ function openStructured({ id, runtime = 'claude', model, resume, log, commands,
       : (!provider || provider === 'anthropic')
       ? (laneModel || null)
       : (laneModel || providerNameMap()[provider] || provider),
-    provider: provider || null, spawnedBy: spawnedBy || undefined, flowSessionId: flowSessionId || null, flowTaskKey: flowTaskKey || null, cwd: cwd || null,
+    provider: provider || null, spawnedBy: spawnedBy || undefined, flowSessionId: flowSessionId || null, flowTaskKey: flowTaskKey || null, cwd: cwd || null, managedWorktree: managedWorktree || null,
     // Stable creation order — persisted so a bridge restart restores tabs in the SAME
     // order (not readdir/filesystem order). Legacy recs (no openedAt) derive it from the
     // first transcript event ts, so even the first post-fix restart is ordered right.
@@ -1764,7 +1767,7 @@ function openStructured({ id, runtime = 'claude', model, resume, log, commands,
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, runtime: entry.runtime, log: entry.log, commands: entry.commands, mode: entry.mode, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, managedWorktree: entry.managedWorktree, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -1926,11 +1929,11 @@ function openStructured({ id, runtime = 'claude', model, resume, log, commands,
       // fork-bomb breaker, now one level deeper (2026-07-10 cascade-spawn-depth spec).
       tool(
         'spawn_terminal',
-        'Open a NEW agent terminal (a fresh Claude lane) in this ThinkPool Code room — YOUR lane to use, not a sibling that is already working. Use it to fan work out: give it an initial `task` and it runs in parallel in its own lane; collect its result later with read_terminal, then ALWAYS close_terminal it — a finished lane left open holds a slot against the room cap and blocks the next fan-out. By default the new lane INHERITS your current permission mode — so if you are in bypass, it runs autonomously with no per-action clicking; pass `mode` to override. ALWAYS prefer spawning a fresh lane over post_to_terminal into one that is already busy. Tier guidance: default worker lanes to opus; use sonnet for mechanical work (renames, boilerplate, doc sweeps); reserve your own model for planning/review. Bounded by the room terminal cap and a per-turn limit.',
+        'Open a NEW agent terminal (Claude or Codex) in this ThinkPool Code room — YOUR lane to use, not a sibling that is already working. The runtime defaults to inheriting this lane, or pass `runtime` to dispatch across runtimes. Use it to fan work out or run a cascade: give it an initial `task`, collect its result later with read_terminal, then ALWAYS close_terminal it — a finished lane left open holds a slot against the room cap and blocks the next fan-out. By default the new lane INHERITS your current permission mode. ALWAYS prefer spawning a fresh lane over post_to_terminal into one that is already busy. Bounded by cascade depth, the room terminal cap, and per-turn limits.',
         {
           name: z.string().max(80).optional().describe('a short label for the new lane so the room (and you) can find it, e.g. "Research: topologies"'),
           task: z.string().optional().describe('an initial task to hand the new lane immediately; omit to open it idle'),
-          model: z.string().optional().describe('optional model for the lane, e.g. opus / sonnet / haiku'),
+          model: z.string().optional().describe('optional model for the chosen runtime, e.g. opus / sonnet / gpt-5.6-sol'),
           runtime: z.enum(['claude', 'codex']).optional().describe('agent runtime for the new lane; defaults to inheriting this lane'),
           provider: z.string().optional().describe('optional registered LLM provider id to run this lane on (from the account\'s provider registry); omit for the default Claude/Anthropic path'),
           mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('permission mode for the new lane; defaults to inheriting YOUR current mode. Raising a lane to bypassPermissions from a non-bypass lane asks the room to confirm once.'),
@@ -2112,6 +2115,21 @@ function openStructured({ id, runtime = 'claude', model, resume, log, commands,
     // ANTHROPIC_MODEL supplied by resolveProviderEnv() in `env` below, so an inherited
     // Claude id here defeats the whole per-provider env. undefined → option omitted.
     cwd: cwd || process.cwd(), model: laneModel, resume, mode, rolePrompt,
+    // Idle ordinary tabs create nothing. Immediately before the FIRST real
+    // turn (human prompt, dispatch, or cascade task), the runtime calls this
+    // while still cold; subsequent turns reuse the persisted worktree.
+    prepareCwd: (!cwd && !flowSessionId && !flowTaskKey) ? () => {
+      if (entry.managedWorktree?.dir) return entry.managedWorktree.dir
+      try {
+        entry.managedWorktree = createManagedLaneWorktree({ terminalId: id, cwd: process.cwd() })
+        entry.cwd = entry.managedWorktree.dir
+        try { entry.flush?.() } catch { /* first turn may precede flush wiring */ }
+        return entry.cwd
+      } catch (error) {
+        process.stderr.write(`\n  ◇ terminal worktree unavailable (${String(id).slice(0, 8)}): ${error?.message || error}; using bridge checkout.\n`)
+        return cwd || process.cwd()
+      }
+    } : null,
     // Haiku composer-prefill is an Anthropic-subscription freebie. This lane's env carries a
     // CUSTOM provider's base URL + auth token, so on a non-anthropic lane that call would bill
     // the user's own BYOK key for a feature they didn't ask for (and 400 on strict providers).
@@ -2127,7 +2145,7 @@ function openStructured({ id, runtime = 'claude', model, resume, log, commands,
     },
     // defer: a restored-idle terminal cold-boots its query only on first use — restore is
     // then instant for display, and only used terminals pay the ~50s MCP boot (Max, 2026-07-02).
-    lazy: !!defer,
+    lazy: !!defer || (!cwd && !flowSessionId && !flowTaskKey),
     reviewGate,
     // A Flow CONDUCTOR (flowSessionId set, no flowTaskKey) must DECOMPOSE, not explore via
     // a fan-out of Task/Explore subagents, and must not build. Hard-block Task/Bash/Write for
@@ -2564,6 +2582,10 @@ function endStructured(id) {
     reapTerminalRow(id)    // bridge-side reap: delete the code_terminals row ourselves — the
                            // client reap (#205) evaporates if no fresh tab caught the broadcast
     fireImageCleanup(id)   // drop this term's screenshots from Storage (COGS)
+    // A deliberate terminal deletion owns cleanup of a bridge-created ordinary
+    // lane worktree. Flow worktrees have their separate assembly/revert lifecycle,
+    // and arbitrary cwd values never authorize deletion.
+    try { removeManagedLaneWorktree({ terminalId: id, managedWorktree: s.managedWorktree }) } catch { /* best-effort; never strand terminal deletion */ }
     // EN-m3 — closing a spawner ORPHANS the lanes it spawned (only that spawner could
     // close_terminal them; they can never be closed otherwise + keep occupying the caps).
     // Cascade-close its direct children (spawnedBy === this id — a real terminal id, not a
@@ -2963,9 +2985,17 @@ channel
   })
   .on('broadcast', { event: 'code-mode' }, ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
-    if (s) {
+    if (s && STRUCTURED_MODES.has(payload.mode)) {
       if (s.runtime === 'codex') {
-        s.mode = 'bypassPermissions'
+        if (!s.session.setMode(payload.mode)) {
+          const evt = { kind: 'control', text: 'finish or stop the current Codex turn before switching permissions' }
+          pushLog(s, evt)
+          bcast('code-event', { term: payload.term, evt })
+          announce()
+          return
+        }
+        s.mode = payload.mode
+        s.flush?.()
         announce()
         return
       }
@@ -3135,7 +3165,7 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, provider: rec.runtime === 'codex' ? undefined : rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage,
+            openStructured({ id: rec.id, runtime: rec.runtime || 'claude', model: rec.model || undefined, provider: rec.runtime === 'codex' ? undefined : rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, managedWorktree: rec.managedWorktree, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).

package/claude-session.mjs

@@ -205,7 +205,7 @@ const TP_ROOM_REMINDER = [
   'Verify before claiming done — show runtime evidence you produced, not "should work, go test it".',
 ].join(' ')
 
-export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null, suggest = true }) {
+export function startClaudeSession({ cwd, model, resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null, suggest = true, prepareCwd = null }) {
   // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
   // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
   // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
@@ -1148,7 +1148,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   return {
     // A lazy (restored-idle) session cold-boots the query on its first turn. input.push
     // is queue-backed, so the pushed turn buffers and runs once the query is ready.
-    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; stallRetried = false; forceStopped = false;
+    sendTurn(text) { if (!closed) { if (!started && prepareCwd) { try { const next = prepareCwd(); if (next) { cwd = next; opts.cwd = next } } catch { /* keep original cwd */ } } if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; stallRetried = false; forceStopped = false;
       const t = String(text)
       // Arm the compaction window BEFORE the push: from here until the `compaction` milestone
       // (or the turn's result) the SDK is allowed to be silent for minutes without the stall

package/codex-mcp-http.mjs

@@ -0,0 +1,59 @@
+// Expose one bridge-owned, in-process MCP server to a Codex CLI child.
+// Claude's Agent SDK consumes createSdkMcpServer() directly; Codex is a
+// separate process and needs a transport. This private loopback endpoint keeps
+// the handlers in the bridge, preserving the same room registry and gates.
+import http from 'node:http'
+import { randomUUID } from 'node:crypto'
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
+
+export async function startCodexMcpHttp({ sdkServer, host = '127.0.0.1' } = {}) {
+  const instance = sdkServer?.instance
+  if (!instance?.connect) throw new TypeError('Codex MCP requires an SDK MCP server instance')
+
+  const secretPath = `/mcp/${randomUUID()}`
+  // Stateful sessions (not stateless): a stateless transport (sessionIdGenerator
+  // undefined) 500s on the `notifications/initialized` POST that every MCP client
+  // sends right after initialize — it has no session to attach the notification to.
+  // Each connecting Codex process gets its own session id; the bridge owns one
+  // server per lane, so the in-memory session map is bounded by the live lanes.
+  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() })
+  await instance.connect(transport)
+
+  const server = http.createServer(async (req, res) => {
+    if (req.url !== secretPath) {
+      res.writeHead(404).end('not found')
+      return
+    }
+    try {
+      await transport.handleRequest(req, res)
+    } catch {
+      if (!res.headersSent) res.writeHead(500)
+      res.end()
+    }
+  })
+
+  try {
+    await new Promise((resolve, reject) => {
+      server.once('error', reject)
+      server.listen(0, host, resolve)
+    })
+  } catch (error) {
+    await transport.close().catch(() => {})
+    throw error
+  }
+  const address = server.address()
+  const url = `http://${host}:${address.port}${secretPath}`
+
+  let closed = false
+  return {
+    url,
+    async close() {
+      if (closed) return
+      closed = true
+      await Promise.allSettled([
+        transport.close(),
+        new Promise((resolve) => server.close(resolve)),
+      ])
+    },
+  }
+}

package/codex-session.mjs

@@ -10,10 +10,10 @@
 // no tool_use↔function-call loss. Auth = the HOST's `codex login` (ChatGPT,
 // flat sub) by default; BYOK via env CODEX_API_KEY works too (exec-only).
 //
-// v1 TRADEOFF (spec §tradeoff, G3): `codex exec` is non-interactive — fixed
-// --sandbox, NO per-tool human gate. The room OBSERVES each command/file-change
-// live (item.started→item.completed) but cannot approve/deny mid-run. Codex's
-// own sandbox governs safety. Default sandbox: workspace-write.
+// `codex exec` is non-interactive, so ThinkPool maps its shared permission modes
+// onto Codex's native sandbox + approval policy. A mode change starts a fresh
+// Codex thread so the new sandbox actually takes effect; the visible transcript
+// remains in ThinkPool.
 //
 // ONE-SHOT-PER-TURN model: unlike Claude's long-lived query(), `codex exec` is
 // one prompt → run → exit. sendTurn spawns an exec; continuity across turns uses
@@ -22,15 +22,26 @@
 //
 // GOTCHA (spike): `codex exec` blocks reading stdin when backgrounded
 // ("Reading additional input from stdin…"). Spawn with stdin set to /dev/null.
-import { spawn } from 'node:child_process'
+import { execFileSync, spawn } from 'node:child_process'
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import readline from 'node:readline'
 import { CodexEventMapper } from './codex-event-mapper.mjs'
+import { startCodexMcpHttp } from './codex-mcp-http.mjs'
 
 const DEFAULT_SANDBOX = 'workspace-write'
-const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write'])
+const SAFE_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
+export const CODEX_MODE_CONFIG = {
+  default:           { sandbox: 'workspace-write', approvalPolicy: 'untrusted' },
+  acceptEdits:       { sandbox: 'workspace-write', approvalPolicy: 'on-request' },
+  plan:              { sandbox: 'read-only',       approvalPolicy: 'never' },
+  bypassPermissions: { sandbox: 'danger-full-access', approvalPolicy: 'never' },
+}
+
+export function codexConfigForMode(mode) {
+  return CODEX_MODE_CONFIG[mode] || CODEX_MODE_CONFIG.default
+}
 
 export function readCodexDefaultModel({ home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), fsImpl = fs } = {}) {
   try {
@@ -57,6 +68,27 @@ export function normalizeCodexSandbox(value) {
   return SAFE_SANDBOXES.has(value) ? value : DEFAULT_SANDBOX
 }
 
+export function codexPublishAccess({ cwd, env = process.env, tmpdir = os.tmpdir(), execFile = execFileSync } = {}) {
+  const writableDirs = []
+  try {
+    const raw = String(execFile('git', ['rev-parse', '--git-common-dir'], { cwd, encoding: 'utf8' }) || '').trim()
+    if (raw) {
+      const commonDir = path.resolve(cwd, raw)
+      const workspace = path.resolve(cwd)
+      if (commonDir !== workspace && !commonDir.startsWith(workspace + path.sep)) writableDirs.push(commonDir)
+    }
+  } catch { /* non-git cwd: Codex already uses --skip-git-repo-check */ }
+  return {
+    writableDirs,
+    env: {
+      ...env,
+      // Auth still comes read-only from ~/.npmrc; only cache writes move to a
+      // lane-safe temp location.
+      NPM_CONFIG_CACHE: path.join(tmpdir, 'thinkpool-npm-cache'),
+    },
+  }
+}
+
 export function buildCodexPrompt({ text, rolePrompt, roomContext }) {
   const context = typeof roomContext === 'function' ? roomContext() : roomContext
   const additions = [rolePrompt, context].map((v) => String(v || '').trim()).filter(Boolean)
@@ -64,7 +96,7 @@ export function buildCodexPrompt({ text, rolePrompt, roomContext }) {
   return `<thinkpool-context>\n${additions.join('\n\n')}\n</thinkpool-context>\n\n${String(text ?? '')}`
 }
 
-export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig, prompt }) {
+export function buildCodexExecArgs({ sessionId, model, sandbox, approvalPolicy = 'untrusted', providerConfig, mcpUrl, writableDirs = [], prompt }) {
   const safeSandbox = normalizeCodexSandbox(sandbox)
   const args = sessionId
     // `codex exec resume` deliberately has no --sandbox option. The resumed
@@ -73,7 +105,13 @@ export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig,
     ? ['exec', 'resume', '--json', '--skip-git-repo-check']
     : ['exec', '--json', '--sandbox', safeSandbox, '--skip-git-repo-check']
   if (model) args.push('-m', model)
+  args.push('-c', `approval_policy="${approvalPolicy}"`)
   if (providerConfig) args.push('-c', providerConfig)
+  // `resume` retains the roots selected by the fresh rollout and does not
+  // accept --add-dir itself. Supply these only when creating the thread.
+  if (!sessionId) for (const dir of writableDirs) args.push('--add-dir', dir)
+  // Per-lane override only: never mutate the person's global Codex config.
+  if (mcpUrl) args.push('-c', `mcp_servers.thinkpool.url=${JSON.stringify(mcpUrl)}`)
   if (sessionId) args.push(sessionId)
   args.push(String(prompt ?? ''))
   return args
@@ -91,9 +129,12 @@ export function buildCodexExecArgs({ sessionId, model, sandbox, providerConfig,
  * @param {string} [o.providerConfig] optional -c overrides / provider block (M2: from the provider registry)
  * @returns {{ sendTurn(text), abort(), end(), readonly sessionId }}
  */
-export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_SANDBOX, onEvent, providerConfig, rolePrompt, roomContext }) {
-  sandbox = normalizeCodexSandbox(sandbox)
-  const childEnv = { ...process.env, ...(env || {}) }
+export function startCodexSession({ cwd, model, resume, env, sandbox, mode = 'default', onEvent, providerConfig, rolePrompt, roomContext, mcpServers, prepareCwd = null }) {
+  let activeMode = CODEX_MODE_CONFIG[mode] ? mode : 'default'
+  let modeConfig = codexConfigForMode(activeMode)
+  sandbox = normalizeCodexSandbox(sandbox || modeConfig.sandbox)
+  const publishAccess = codexPublishAccess({ cwd, env: { ...process.env, ...(env || {}) } })
+  const childEnv = publishAccess.env
   let sessionId = resume || null
   let turnNo = resume ? 1 : 0
   let child = null
@@ -101,21 +142,37 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
   let ended = false
   let turnActive = false
   let activeModel = model || null
+  let mcpHttpPromise = null
   // serialize turns: one exec at a time
   let chain = Promise.resolve()
   const queue = []
 
   const mapper = new CodexEventMapper({ onEvent, model: model || null })
 
-  function runExec(prompt) {
+  const note = (text) => { try { onEvent?.({ kind: 'note', text }) } catch { /* noop */ } }
+
+  async function ensureMcpHttp() {
+    const thinkpool = mcpServers?.thinkpool
+    if (!thinkpool) return null
+    if (!mcpHttpPromise) mcpHttpPromise = startCodexMcpHttp({ sdkServer: thinkpool })
+    return mcpHttpPromise
+  }
+
+  async function runExec(prompt) {
     // First turn: fresh exec. Later turns: resume THIS lane's captured thread.
     // `--last` is process-global and can cross-wire two concurrently-active Codex
     // lanes, so it is never safe in a multi-lane bridge.
+    let peer
+    try { peer = await ensureMcpHttp() }
+    catch (e) { note(`Thinkpool peer tools unavailable: ${e?.message || e}`) }
     const args = buildCodexExecArgs({
       sessionId: turnNo === 0 ? null : sessionId,
       model: activeModel,
       sandbox,
+      approvalPolicy: modeConfig.approvalPolicy,
       providerConfig,
+      mcpUrl: peer?.url,
+      writableDirs: publishAccess.writableDirs,
       prompt,
     })
 
@@ -193,6 +250,9 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
     get started() { return turnNo > 0 || turnActive },
     sendTurn(text) {
       if (ended) return false
+      if (!turnActive && turnNo === 0 && prepareCwd) {
+        try { cwd = prepareCwd() || cwd } catch { /* keep original cwd */ }
+      }
       queue.push(text)
       // start the pump if idle
       if (queue.length === 1) pump()
@@ -207,6 +267,7 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
       ended = true
       queue.length = 0
       if (child) { try { child.kill() } catch { /* noop */ } }
+      void mcpHttpPromise?.then((h) => h.close()).catch(() => {})
     },
     setModel(nextModel) {
       if (!nextModel || turnActive) return false
@@ -214,10 +275,17 @@ export function startCodexSession({ cwd, model, resume, env, sandbox = DEFAULT_S
       mapper.setModel(activeModel)
       return true
     },
-    // Codex v1 has a fixed sandbox for the lifetime of the lane. The bridge may
-    // still call setMode from shared chrome; report unsupported rather than
-    // pretending the Claude permission mode changed Codex's sandbox.
-    setMode() { return false },
+    setMode(nextMode) {
+      if (turnActive || !CODEX_MODE_CONFIG[nextMode]) return false
+      activeMode = nextMode
+      modeConfig = codexConfigForMode(activeMode)
+      sandbox = modeConfig.sandbox
+      // Resume retains the original sandbox. Start a fresh native thread on the
+      // next turn so the selected mode is real, while ThinkPool keeps the lane log.
+      sessionId = null
+      turnNo = 0
+      return true
+    },
     clearContext() {
       if (turnActive) return false
       sessionId = null

package/lane-worktree.mjs

@@ -0,0 +1,40 @@
+// Lifecycle for ordinary bridge-created terminal worktrees. Deletion authority
+// is the persisted managedWorktree record, never a lane's arbitrary cwd.
+import { execFileSync } from 'node:child_process'
+import path from 'node:path'
+import fs from 'node:fs'
+
+export function createManagedLaneWorktree({ terminalId, cwd = process.cwd(), git = runGit, fsImpl = fs } = {}) {
+  const id = String(terminalId || '')
+  const short = id.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8)
+  if (!short) throw new Error('terminal id required for managed worktree')
+  const root = String(git(['rev-parse', '--show-toplevel'], cwd) || '').trim()
+  if (!root) throw new Error('not a git repository')
+  const dir = path.join(root, '.thinkpool', 'worktrees', `terminal-${short}`)
+  const branch = `thinkpool/terminal/${short}`
+  fsImpl.mkdirSync(path.dirname(dir), { recursive: true })
+  git(['worktree', 'add', '-b', branch, dir, 'HEAD'], root)
+  return { terminalId: id, root, dir, branch }
+}
+
+export function removeManagedLaneWorktree({ terminalId, managedWorktree, git = runGit } = {}) {
+  const id = String(terminalId || '')
+  const rec = managedWorktree && typeof managedWorktree === 'object' ? managedWorktree : null
+  if (!id || !rec || rec.terminalId !== id) return { removed: false, reason: 'not managed by this terminal' }
+
+  const root = path.resolve(String(rec.root || ''))
+  const dir = path.resolve(String(rec.dir || ''))
+  const branch = String(rec.branch || '')
+  const ownedRoot = path.join(root, '.thinkpool', 'worktrees')
+  const short = id.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8)
+  if (!root || dir === ownedRoot || !dir.startsWith(ownedRoot + path.sep)) return { removed: false, reason: 'path outside managed worktrees' }
+  if (!short || !path.basename(dir).includes(short) || !branch.startsWith(`thinkpool/terminal/${short}`)) return { removed: false, reason: 'ownership marker mismatch' }
+
+  try { git(['worktree', 'remove', dir, '--force'], root) } catch { /* already absent */ }
+  try { git(['branch', '-D', branch], root) } catch { /* already absent */ }
+  return { removed: true, dir, branch }
+}
+
+function runGit(args, cwd) {
+  return execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.194",
+  "version": "0.7.197",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -14,6 +14,8 @@
     "context-windows.mjs",
     "claude-session.mjs",
     "codex-session.mjs",
+    "codex-mcp-http.mjs",
+    "lane-worktree.mjs",
     "codex-event-mapper.mjs",
     "turn-stall.mjs",
     "update-gate.mjs",
@@ -58,6 +60,7 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.198",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@supabase/supabase-js": "^2.45.0",
     "zod": "^4.4.3"
   },

package/service.mjs

@@ -234,12 +234,18 @@ WantedBy=default.target
 // Blocking sleep (installService runs synchronously from the interactive menu; the
 // user is watching, so we WANT to wait + report the real outcome, not fire-and-forget).
 const sleepMs = (ms) => { try { execSync(`sleep ${(ms / 1000).toFixed(2)}`) } catch { /* noop */ } }
-// Which thinkpool-pair versions are running right now (the account supervisor shows as
-// `npm exec thinkpool-pair@<ver>`). Returns a Set of version strings.
+// Parse both legacy npx commands (`thinkpool-pair@<ver>`) and stable runtime commands
+// (`.../runtimes/<ver>/...`).
+export function parseRunningPairVersions(out) {
+  const versions = String(out).match(/(?:thinkpool-pair@|runtimes\/)(\d+\.\d+\.\d+)/g) || []
+  return new Set(versions.map((s) => s.match(/\d+\.\d+\.\d+/)?.[0]).filter(Boolean))
+}
+
+// Which thinkpool-pair versions are running right now. Returns a Set of versions.
 const runningPairVersions = () => {
   try {
-    const out = execSync(`ps ax -o command= 2>/dev/null | grep -oE 'thinkpool-pair@[0-9]+\\.[0-9]+\\.[0-9]+' | sort -u`, { encoding: 'utf8', shell: '/bin/bash' })
-    return new Set(out.split('\n').map((l) => l.trim().split('@')[1]).filter(Boolean))
+    const out = execSync('ps ax -o command= 2>/dev/null', { encoding: 'utf8', shell: '/bin/bash' })
+    return parseRunningPairVersions(out)
   } catch { return new Set() }
 }
 const darwinSvcLoaded = (lbl) => { try { execSync(`launchctl print gui/$(id -u)/${lbl}`, { stdio: 'ignore' }); return true } catch { return false } }