thinkpool-pair 0.7.235 → 0.7.237

package/bridge.mjs

@@ -2616,12 +2616,29 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       // run on different registered providers. (bridge-truth slice.)
       { const onBuiltin = entry.runtime !== 'hermes' && (!entry.provider || entry.provider === 'anthropic')
         const m = (entry.runtime === 'hermes' || onBuiltin) ? (evt.model || evt.ctx?.model) : null
-        if (m && m !== entry.model) { entry.model = m; announce() }
+        if (m && m !== entry.model) { entry.model = m; announce(); if (evt.kind === 'model-switch') persist() }
         // A custom Anthropic-compatible endpoint may expose its own catalog through the
         // same SDK method. Never publish that as the ROOM's Claude catalog: its models
         // already render in the provider group and otherwise leak under ANTHROPIC.
         if (entry.runtime === 'hermes' && evt.kind === 'models' && Array.isArray(evt.models) && evt.models.length) { entry.models = evt.models; announce() }
         else if (onBuiltin && evt.kind === 'models' && Array.isArray(evt.models) && evt.models.length) { roomModels = evt.models; announce() } }
+      // Hermes model changes are asynchronous ACP requests. Keep the previous model
+      // authoritative until Hermes acknowledges session/set_model; then settle the
+      // originating control line exactly once. A rejected model never poisons the
+      // saved session or leaves a cross-device chip claiming the optimistic pick.
+      if (evt.kind === 'model-switch') {
+        const request = entry.pendingModelSwitch
+        entry.pendingModelSwitch = null
+        const requested = evt.requested || request?.model || 'requested model'
+        const text = evt.status === 'success'
+          ? `switched model → ${evt.model || requested}`
+          : `couldn’t switch to ${requested} — still using ${entry.model || 'the previous model'}`
+        const control = { kind: 'control', text, by: request?.by || null, cid: request?.cid || undefined }
+        pushLog(entry, control)
+        bcast('code-event', { term: id, evt: control })
+        entry.flush?.()
+        announce()
+      }
       // Cache the last usage/ctx meter on the entry (persisted + replayed — see
       // openStructured). Chrome events bypass pushLog/persist in emitTail below, so
       // usage needs an explicit persist() here to survive a bridge restart.
@@ -2700,7 +2717,7 @@ function openStructured({ id, runtime = 'claude', model, effort, resume, log, co
       // card) and is intentionally NOT chrome, so it persists + replays.
       // 'suggestion' is Claude Code's predicted-next-prompt ghost text — ephemeral
       // composer UI, broadcast to both clients but never logged/persisted/replayed.
-      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled' || evt.kind === 'suggestion' || evt.kind === 'assistant_stream'
+      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled' || evt.kind === 'suggestion' || evt.kind === 'assistant_stream' || evt.kind === 'model-switch'
       // The compact turn settled with `entry.compacting` STILL TRUE — which, because the
       // `compaction` branch above clears the flag the moment the milestone lands, means
       // exactly one thing: NO compaction happened. Three ways to get here, all of which
@@ -3428,10 +3445,19 @@ channel
     const mm = text.match(/^\/model\b\s*(\S+)?/)
     if (mm) {
       if (mm[1]) {
+        if (s.runtime === 'hermes' && s.pendingModelSwitch) {
+          ctlLine(`finish the current Hermes model switch before choosing another model`)
+          return
+        }
         if (s.session.setModel(mm[1]) === false) {
           ctlLine(`finish or stop the current ${structuredRuntimeMetadata(s.runtime)?.label || 'agent'} turn before switching models`)
           return
         }
+        if (s.runtime === 'hermes') {
+          s.pendingModelSwitch = { model: mm[1], by: payload.by, cid: payload.cid }
+          bcast('code-event', { term: payload.term, evt: { kind: 'model-switch', status: 'pending', requested: mm[1], ts: Date.now() } })
+          return
+        }
         // Reflect the switch in the announce IMMEDIATELY (before any turn). The SDK
         // only echoes the resolved full id on the next turn, and meta/ctx model go
         // stale until then, so without this the chip snapped back to the old model

package/event-id.mjs

@@ -61,7 +61,7 @@ export function makeSeqCounter(startAfter = 0) {
 // consumed a seq + set the durable archive floor while the client dropped them, leaving
 // the client's oldest RENDERED seq above the floor → a phantom "load earlier history"
 // pill on a fresh lane (models fires on every session init) that fetched nothing.
-export const NO_SEQ_KINDS = new Set(['system', 'thinking_tokens', 'effort', 'models', 'queue-add', 'queue-cancel', 'propose-done', 'update-available'])
+export const NO_SEQ_KINDS = new Set(['system', 'thinking_tokens', 'effort', 'models', 'model-switch', 'queue-add', 'queue-cancel', 'propose-done', 'update-available'])
 export const seqable = (evt) => !!evt && typeof evt === 'object' && !NO_SEQ_KINDS.has(evt.kind)
 
 // Highest numeric `seq` across a log of events (0 when none) — the floor a restored

package/hermes-event-mapper.mjs

@@ -109,6 +109,18 @@ export class HermesEventMapper {
   }
 
   finishTurn({ stopReason = 'end_turn', usage = null } = {}) {
+    if (stopReason === 'cancelled') {
+      for (const [toolCallId, tool] of this.tools) {
+        this._emit({
+          kind: 'tool_result', toolUseId: toolCallId,
+          content: [{ type: 'text', text: '[cancelled]' }],
+          isError: false,
+          durationMs: tool.startedAt ? Date.now() - tool.startedAt : undefined,
+          parentToolUseId: null,
+        })
+      }
+    }
+    this.tools.clear()
     const blocks = []
     if (this.thought) blocks.push({ type: 'thinking', text: this.thought })
     if (this.text) blocks.push({ type: 'text', text: this.text })

package/hermes-probe.mjs

@@ -8,11 +8,14 @@ export function probeHermesRuntime({ command = 'thinkpool', prefixArgs = [], exe
     const version = clean(versionOutput).match(/Hermes Agent v([^\s]+)/i)?.[1] || null
     execFile(command, [...prefixArgs, 'acp', '--check'], { encoding: 'utf8', env, timeout: 15_000, stdio: ['ignore', 'pipe', 'pipe'] })
     const hooksOutput = execFile(command, [...prefixArgs, 'hooks', 'list'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const doctorOutput = execFile(command, [...prefixArgs, 'hooks', 'doctor'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
     const guardOutput = execFile(command, [...prefixArgs, 'hooks', 'test', 'pre_tool_call', '--for-tool', 'delegate_task'], { encoding: 'utf8', env, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] })
+    const doctorHealthy = /All shell hooks look healthy/i.test(doctorOutput)
+      && !/(?:issue\(s\) found|modified since approval|⚠)/i.test(doctorOutput)
     const delegationBlocked = /(?:action|decision)["']?\s*[:=]\s*["']block/i.test(guardOutput)
       && /ThinkPool blocks hidden Hermes delegation/i.test(guardOutput)
       && /pre_tool_call[\s\S]*delegate_task[\s\S]*(?:✓ allowed|allowed)/i.test(hooksOutput)
-    if (!delegationBlocked) return { available: false, version, reason: 'delegate_task is not structurally blocked by the dedicated Hermes profile' }
+    if (!doctorHealthy || !delegationBlocked) return { available: false, version, reason: 'delegate_task guard is not healthy, unchanged, allowlisted, and structurally blocking in the dedicated Hermes profile' }
     return { available: true, version, acpProtocol: 1, delegationBlocked: true }
   } catch (error) {
     return { available: false, version: null, reason: clean(error?.stderr || error?.message || error) }

package/hermes-session.mjs

@@ -14,6 +14,7 @@ export const HERMES_ACP_PROTOCOL_VERSION = 1
 export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits'])
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
+const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
 export const hermesChildEnv = (env = {}) => Object.fromEntries(
   Object.entries(env).filter(([key]) => !HERMES_SECRET_ENV_KEY.test(key)),
 )
@@ -61,6 +62,11 @@ export function startHermesSession({
   let firstTurn = true
   let stderrTail = ''
   let promptChain = Promise.resolve()
+  let activeTurnId = 0
+  const abortedTurns = new Set()
+  let retireClient = () => {}
+  let resuming = false
+  let modelSwitchPending = false
 
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
@@ -79,7 +85,10 @@ export function startHermesSession({
   }
 
   function onNotification(method, params) {
-    if (method === 'session/update') mapper?.push(params)
+    if (method !== 'session/update') return
+    const update = params?.update || params
+    if (resuming && HERMES_REPLAY_UPDATES.has(update?.sessionUpdate)) return
+    mapper?.push(params)
   }
 
   async function boot() {
@@ -101,13 +110,15 @@ export function startHermesSession({
         const profile = probeHermesRuntime({ command, env: childEnv })
         if (!profile.available) throw new Error(`Hermes profile safety check failed: ${profile.reason || 'runtime unavailable'}`)
       }
+      let retired = false
+      retireClient = () => { retired = true }
       client = clientFactory({
         command, args, cwd: activeCwd, env: childEnv,
         onNotification,
         onRequest,
         onStderr: (text) => { stderrTail = (stderrTail + text).slice(-2000) },
         onClose: (error) => {
-          if (ended || crashed) return
+          if (ended || crashed || retired) return
           crashed = true
           turnActive = false
           emit({ kind: 'error', message: `Hermes ACP closed unexpectedly: ${error?.message || error}`, recoverable: true })
@@ -129,10 +140,14 @@ export function startHermesSession({
         if (!initialized?.agentCapabilities?.sessionCapabilities?.resume) {
           throw new Error(`Hermes session ${sessionId} cannot be resumed by this ACP release; no fresh session was substituted`)
         }
-        try { state = await client.request('session/resume', { ...params, sessionId }, 30_000) }
+        try {
+          resuming = true
+          state = await client.request('session/resume', { ...params, sessionId }, 30_000)
+        }
         catch (error) {
           throw new Error(`Hermes session ${sessionId} is not available; no fresh session was substituted (${error?.message || error})`)
         }
+        finally { resuming = false }
       } else state = await client.request('session/new', params, 30_000)
       if (!sessionId) sessionId = state?.sessionId || null
       if (!sessionId) throw new Error('Hermes ACP did not return a session id')
@@ -158,6 +173,15 @@ export function startHermesSession({
     return starting
   }
 
+  async function restartAfterCancelledResponseFailure() {
+    const oldClient = client
+    retireClient()
+    client = null
+    mapper = null
+    oldClient?.end()
+    await boot()
+  }
+
   function promptBlocks(text, options = {}) {
     const rawText = String(text)
     // Hermes handles /steer, /queue, /compact and /reset only when the slash is
@@ -175,14 +199,33 @@ export function startHermesSession({
   async function runPrompt(text, options = {}) {
     await boot()
     const steering = turnActive
+    const turnId = steering ? activeTurnId : ++activeTurnId
     const body = steering ? `/steer ${String(text)}` : String(text)
     if (!steering) turnActive = true
-    const result = await client.request('session/prompt', {
-      sessionId,
-      prompt: promptBlocks(body, options),
-      messageId: randomUUID(),
-    }, 0)
+    let result
+    try {
+      result = await client.request('session/prompt', {
+        sessionId,
+        prompt: promptBlocks(body, options),
+        messageId: randomUUID(),
+      }, 0)
+    } catch (error) {
+      // Hermes 0.18.2 successfully interrupts the model/tool, then its ACP
+      // prompt handler can reject with Internal error while constructing the
+      // cancelled response. The bridge already owns the canonical aborted
+      // boundary below, so a late response failure for that exact turn is not a
+      // second turn failure. Process-close errors still surface through onClose.
+      if (abortedTurns.has(turnId)) {
+        // Hermes 0.18.2 throws before clearing its transient is_running flag.
+        // Resume the same persisted session in a fresh per-lane ACP process so
+        // the next queued prompt cannot disappear into that stale runtime queue.
+        if (!ended) await restartAfterCancelledResponseFailure()
+        return { stopReason: 'cancelled' }
+      }
+      throw error
+    }
     if (!steering) {
+      if (abortedTurns.has(turnId)) return result
       turnActive = false
       firstTurn = false
       mapper.finishTurn({ stopReason: result?.stopReason, usage: result?.usage })
@@ -209,8 +252,23 @@ export function startHermesSession({
       return true
     },
     abort() {
-      if (!sessionId || !client?.alive) return
-      void client.notify('session/cancel', { sessionId }).catch(() => { /* process already closed */ })
+      if (!sessionId || !client?.alive || !turnActive) return
+      const turnId = activeTurnId
+      abortedTurns.add(turnId)
+      // Bound retained turn ids while preserving any concurrent /steer request
+      // that may settle after the primary prompt response.
+      if (abortedTurns.size > 32) abortedTurns.delete(abortedTurns.values().next().value)
+      turnActive = false
+      firstTurn = false
+      mapper?.finishTurn({ stopReason: 'cancelled' })
+      void client.notify('session/cancel', { sessionId }).catch((error) => {
+        // Never display a stopped lane while the un-cancelled Hermes process
+        // might still be executing. A transport failure tears down the ACP
+        // process and makes the lane honestly non-resumable until restart.
+        crashed = true
+        client?.end()
+        emit({ kind: 'error', message: `Hermes cancellation delivery failed; ACP process stopped: ${error?.message || error}`, recoverable: true })
+      })
     },
     end() {
       ended = true
@@ -220,12 +278,16 @@ export function startHermesSession({
       void mcpHttp?.close().catch(() => {})
     },
     setModel(nextModel) {
-      if (!nextModel || turnActive) return false
-      void boot().then(() => client.request('session/set_model', { sessionId, modelId: String(nextModel) })).then(() => {
-        activeModel = String(nextModel)
+      if (!nextModel || turnActive || modelSwitchPending) return false
+      const requested = String(nextModel)
+      modelSwitchPending = true
+      void boot().then(() => client.request('session/set_model', { sessionId, modelId: requested })).then(() => {
+        if (ended) return
+        activeModel = requested
         if (mapper) mapper.model = activeModel
-        emit({ kind: 'note', text: `model → ${activeModel}` })
-      }).catch((error) => emit({ kind: 'error', message: `Hermes model switch failed: ${error?.message || error}`, recoverable: true }))
+        emit({ kind: 'model-switch', status: 'success', model: activeModel, requested })
+      }).catch((error) => { if (!ended) emit({ kind: 'model-switch', status: 'failed', model: activeModel, requested, message: `Hermes model switch failed: ${error?.message || error}` }) })
+        .finally(() => { modelSwitchPending = false })
       return true
     },
     setMode(nextMode) {

package/hermes-setup.mjs

@@ -39,11 +39,16 @@ function snapshotFile(filePath, fsImpl) {
   return {
     content: fsImpl.readFileSync(filePath),
     mode: fsImpl.statSync(filePath).mode & 0o777,
+    atimeMs: fsImpl.statSync(filePath).atimeMs,
+    mtimeMs: fsImpl.statSync(filePath).mtimeMs,
   }
 }
 
 function restoreFile(filePath, snapshot, fsImpl) {
-  if (snapshot) atomicWrite(filePath, snapshot.content, { fsImpl, mode: snapshot.mode })
+  if (snapshot) {
+    atomicWrite(filePath, snapshot.content, { fsImpl, mode: snapshot.mode })
+    fsImpl.utimesSync?.(filePath, snapshot.atimeMs / 1000, snapshot.mtimeMs / 1000)
+  }
   else fsImpl.rmSync(filePath, { force: true })
 }
 
@@ -116,13 +121,19 @@ export function setupHermesRuntime({
   ]
 
   const guardPath = hermesGuardPath({ homeDir, env, platform })
+  const allowlistPath = path.join(profilePath, 'shell-hooks-allowlist.json')
   const guardSnapshot = snapshotFile(guardPath, fsImpl)
   const configSnapshot = snapshotFile(configPath, fsImpl)
+  const allowlistSnapshot = snapshotFile(allowlistPath, fsImpl)
   try {
     atomicWrite(guardPath, guardSource, { fsImpl, mode: 0o700 })
     atomicWrite(configPath, YAML.stringify(config, { lineWidth: 0 }), { fsImpl, mode: 0o600 })
 
     const consentEnv = { ...env, HERMES_ACCEPT_HOOKS: '1' }
+    // Hermes does not refresh an existing approval when the same command's
+    // script mtime changes. Revoke only ThinkPool's exact guard command, then
+    // let the synthetic test consent to that exact command again.
+    run([...profileArgs, 'hooks', 'revoke', commandText(guardPath)], { env: consentEnv })
     const testOutput = run([...profileArgs, 'hooks', 'test', 'pre_tool_call', '--for-tool', 'delegate_task'], { env: consentEnv })
     if (!/(?:action|decision)["']?\s*[:=]\s*["']block/i.test(testOutput)
       || !/ThinkPool blocks hidden Hermes delegation/i.test(testOutput)) {
@@ -137,6 +148,7 @@ export function setupHermesRuntime({
     try {
       restoreFile(configPath, configSnapshot, fsImpl)
       restoreFile(guardPath, guardSnapshot, fsImpl)
+      restoreFile(allowlistPath, allowlistSnapshot, fsImpl)
     } catch (rollbackError) {
       error.message = `${error.message}; rollback also failed: ${clean(rollbackError.message)}`
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.235",
+  "version": "0.7.237",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/runtime-registry.mjs

@@ -3,17 +3,17 @@ import path from 'node:path'
 const RUNTIMES = Object.freeze({
   claude: Object.freeze({
     id: 'claude', command: 'claude', label: 'Claude Code', protocol: 'agent-sdk',
-    structured: true, flow: true, canSteer: false, images: true, nativeModelCatalog: false, defaultMode: 'default',
+    structured: true, flow: true, canSteer: false, images: true, nativeModelCatalog: false, effortControl: true, defaultMode: 'default',
     modes: Object.freeze(['default', 'acceptEdits', 'plan', 'bypassPermissions']),
   }),
   codex: Object.freeze({
     id: 'codex', command: 'codex', label: 'Codex', protocol: 'codex-app-server',
-    structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, defaultMode: 'bypassPermissions',
+    structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, effortControl: true, defaultMode: 'bypassPermissions',
     modes: Object.freeze(['default', 'acceptEdits', 'plan', 'bypassPermissions', 'review']),
   }),
   hermes: Object.freeze({
     id: 'hermes', command: 'thinkpool', label: 'Hermes Agent', protocol: 'acp',
-    structured: true, flow: false, canSteer: true, images: true, nativeModelCatalog: true, defaultMode: 'default',
+    structured: true, flow: false, canSteer: true, images: true, nativeModelCatalog: true, effortControl: false, defaultMode: 'default',
     modes: Object.freeze(['default', 'acceptEdits']),
     beta: true,
   }),