thinkpool-pair 0.7.251 → 0.7.253

package/bridge.mjs

@@ -109,9 +109,9 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDispatchApproval, verifyDurableDispatchAuthority } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
-import { beginDispatchLease, finishDispatchLease, isDispatchLeaseCurrent, supersedeDispatchLease } from './dispatch-lease.mjs'
+import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
@@ -653,31 +653,6 @@ const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {
   realtime: { params: { eventsPerSecond: 60 } },
 })
 
-// Authenticated re-read for previewed Dispatch. Realtime is intentionally not
-// trusted here: any room member can observe the public wake-up frame. RLS plus
-// the bridge's live member token supplies the item/event rows that the pure
-// verifier consumes. Timeout/offline/malformed state all fail closed.
-async function readDurableDispatchAuthority ({ controlItemId, expected, timeoutMs = 5000 } = {}) {
-  if (!codeAuthToken || !/^[0-9a-f-]{36}$/i.test(String(controlItemId || ''))) return { ok: false, code: 'durable_authority_unavailable' }
-  const controller = new AbortController()
-  const timer = setTimeout(() => controller.abort(), timeoutMs)
-  timer.unref?.()
-  const headers = { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` }
-  try {
-    const itemUrl = `${SUPABASE_URL}/rest/v1/code_pair_control_items?id=eq.${encodeURIComponent(controlItemId)}&select=*`
-    const eventsUrl = `${SUPABASE_URL}/rest/v1/code_pair_control_events?item_id=eq.${encodeURIComponent(controlItemId)}&select=*&order=created_at.asc`
-    const [itemRes, eventRes] = await Promise.all([
-      fetch(itemUrl, { headers, signal: controller.signal }),
-      fetch(eventsUrl, { headers, signal: controller.signal }),
-    ])
-    if (!itemRes.ok || !eventRes.ok) return { ok: false, code: 'durable_authority_read_failed' }
-    const [items, events] = await Promise.all([itemRes.json(), eventRes.json()])
-    if (!Array.isArray(items) || items.length !== 1 || !Array.isArray(events)) return { ok: false, code: 'durable_authority_shape' }
-    return verifyDurableDispatchAuthority({ item: items[0], events, expected: { ...expected, controlItemId } })
-  } catch { return { ok: false, code: 'durable_authority_unavailable' } }
-  finally { clearTimeout(timer) }
-}
-
 // Owner's plan (free|plus) — gates the Ensemble dispatch ceiling (Free 3 / Plus 6).
 // Resolved from the owner token (codeAuthToken); RLS lets a user read their OWN
 // profiles row. Cached; defaults to 'free' (the safe lower ceiling) until the fetch
@@ -1761,8 +1736,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // codex → bypassPermissions, so a freshly-opened codex terminal can fetch /
   // advance / ship instead of hitting the no-network wall; claude → default.
   // Only fires when no mode was passed — a person's pick, a resume (persisted
-  // entry.mode), a flow lane, and spawn_terminal (inherits the parent's mode +
-  // its own bypass-escalation gate) all pass an explicit mode and skip this.
+  // entry.mode), a flow lane, and spawn_terminal (always bypassPermissions) all
+  // pass an explicit mode and skip this.
   mode = STRUCTURED_MODES.has(mode) && structuredRuntimeSupportsMode(runtime, mode) ? mode : defaultStructuredMode(runtime)
   assertRuntimeModelCompatible({ runtime, provider, model })
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
@@ -2096,7 +2071,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       model: args?.model || (worker && args?.sliceType
         ? spawnedLaneModelFor({ sliceType: args.sliceType, runtime, catalog })
         : undefined),
-      mode: args?.mode || (entry.mode === 'plan' ? 'default' : entry.mode),
+      // Worker lanes are the autonomous execution unit. They never inherit a
+      // permission-card mode from the conductor and never honor a lower explicit
+      // override: spawn_terminal always opens them in bypassPermissions.
+      mode: worker ? 'bypassPermissions' : (args?.mode || (entry.mode === 'plan' ? 'default' : entry.mode)),
       provider: args?.provider,
     }
   }
@@ -2111,23 +2089,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     plan: ownerPlan,
     disabled: process.env.TP_SPAWN_OFF === '1',
   })
-  // Dispatch uses the same durable pair-control permission transport as every
-  // protected action. The preview is additive evidence on that one request;
-  // this Promise is not another approval store or an autonomous allow path.
-  const requestDispatchApproval = (req) => new Promise((resolve) => {
-    const payload = attachDurablePermissionSource(entry, {
-      term: id, id: req.id, toolName: 'mcp__thinkpool__spawn_terminal',
-      // Exact arguments are already bound into dispatchPreview.fingerprint. Do not
-      // copy raw tool input into the public wake-up frame or the reconnect cache.
-      risk: 'high', answerFormat: 'dispatch',
-      dispatchPreview: req.dispatchPreview,
-    })
-    entry.pending.set(req.id, { resolve, payload, timer: null })
-    announce()
-    bcast('code-perm-req', payload)
-    if (isUserFacingLane(entry)) entry.permNotifier?.arm(req.id, permissionSummary(payload))
-    process.stderr.write(`\n  ${A.yel}● Dispatch preview ready — approve or cancel in the room.${A.rst}\n`)
-  })
   const consumeTerminalOpenBudget = () => {
     const now = Date.now()
     const gate = spawnDecision({
@@ -2362,7 +2323,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           sliceType: z.enum(['scaffold', 'feature', 'fix', 'review']).optional().describe('optional cascade slice tier; omitted preserves normal inheritance/default, explicit model wins'),
           runtime: z.enum(['claude', 'codex', 'hermes']).optional().describe('agent runtime for the new lane; Hermes is allowed only from a top-level Hermes parent with an explicit catalog model'),
           provider: z.string().optional().describe('optional registered LLM provider id to run this lane on (from the account\'s provider registry); omit for the default Claude/Anthropic path'),
-          mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('permission mode for the new lane; defaults to inheriting YOUR current mode. Raising a lane to bypassPermissions from a non-bypass lane asks the room to confirm once.'),
+          mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('accepted for compatibility; spawned workers always run autonomously in bypassPermissions'),
         },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
@@ -2402,33 +2363,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               },
             })
           } catch { return okText('Dispatch preview could not be built safely. No lane was created.') }
-          const permissionId = randomUUID()
-          const dispatchAdmission = beginDispatchLease(entry, permissionId)
-          if (!dispatchAdmission.ok) {
-            return okText('A dispatch choice is already awaiting approval in the room. Do not retry or switch runtimes; wait for that choice to be approved or canceled, or for a new human turn to supersede it.')
-          }
-          const dispatchLease = dispatchAdmission.lease
-          try {
-          let approval = { decision: 'deny' }
-          try { approval = await requestDispatchApproval({ id: permissionId, input: effectiveArgs, dispatchPreview: preview }) } catch { /* fail closed */ }
-          if (approval?.decision !== 'allow') return okText('Dispatch canceled. No lane or worktree was created.')
-          if (!isDispatchLeaseCurrent(entry, dispatchLease)) return okText('That dispatch choice was superseded by a newer turn. No lane or worktree was created.')
           const currentNow = Date.now()
           const current = dispatchContext(currentNow)
-          const durable = await readDurableDispatchAuthority({
-            controlItemId: approval.controlItemId,
-            expected: {
-              roomCode: room,
-              bridgeAuthorityId: BRIDGE_ID,
-              localAuthorityId: id,
-              fingerprint: preview.fingerprint,
-            },
-          })
-          if (!durable.ok) return okText('Dispatch approval could not be verified from the durable room authority. No lane was created.')
-          if (!isDispatchLeaseCurrent(entry, dispatchLease)) return okText('That dispatch choice was superseded by a newer turn. No lane or worktree was created.')
-          const authorization = authorizeDispatchApproval({
+          const authorization = authorizeDirectDispatch({
             preview,
-            approvedFingerprint: durable.fingerprint,
             args: effectiveArgs,
             initiatorTerminalId: id,
             roomCode: room,
@@ -2439,9 +2377,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               providerName: resolved.provider ? (providerNameMap()[resolved.provider] || resolved.provider) : undefined,
               resolvedModel: resolved.model,
             },
-            permissionId,
           })
-          if (!authorization.ok) return okText(authorization.reason || 'Dispatch approval is stale or does not match this request. No lane was created.')
+          if (!authorization.ok) return okText(authorization.reason || 'Dispatch became stale or exceeded a cap. No lane was created.')
           // Record this spawn, pruning timestamps that have already left the window
           // (identical predicate to recentSpawnCount) so the array can't grow unbounded.
           entry.spawnTimes = [...(entry.spawnTimes || []).filter((t) => Number.isFinite(t) && t > currentNow - SPAWN.windowMs), currentNow]
@@ -2450,12 +2387,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           const fromRef = String(id).slice(0, 8)
           // Name BEFORE opening so openStructured's own announce already carries the label.
           if (args?.name) { termNames[newId] = String(args.name).slice(0, 80); saveNames(room, termNames) }
-          // Inherit the spawner's permission mode by default (so a bypass orchestrator's
-          // lanes run autonomously); an explicit `mode` overrides. The PreToolUse gate
-          // already confirmed any bypass-escalation from a non-bypass lane before we got here.
-          // PM-m1 — never INHERIT plan mode into a spawned worker lane: a lane spawned from a
-          // plan-mode lane would stall on ExitPlanMode cards. An explicit args.mode still wins;
-          // otherwise inherit, but fall plan → default (an autonomous worker doesn't plan-gate).
+          // Every worker is autonomous by contract: resolveAgentOpen pins
+          // bypassPermissions regardless of the parent or legacy mode argument.
           const childSpawnDepth = (entry.spawnDepth || 0) + 1
           const childHop = (entry.hop || 0) + 1
           let manualReviewSnapshots = []
@@ -2487,9 +2420,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
             return okText(`Opened agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''} and handed it the task. It runs in its own lane — check back with read_terminal, then close_terminal when done.`)
           }
           return okText(`Opened idle agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''}. Hand it work with post_to_terminal, or a person can type into it.`)
-          } finally {
-            finishDispatchLease(entry, dispatchLease)
-          }
         },
       )] : []),
       // Research lane — run a REAL multi-source search + adversarial verification and
@@ -3833,8 +3763,17 @@ channel
     const nativeImages = s.runtime === 'codex' || s.runtime === 'hermes'
       ? await waitForNativeImages(payload.files, { updir: UPDIR })
       : []
-    s.session.sendTurn(sendText, nativeImages.length ? { images: nativeImages } : undefined)
+    const accepted = s.session.sendTurn(sendText, nativeImages.length ? { images: nativeImages } : undefined)
     echoYou()
+    if (accepted === false) {
+      // A runtime that did not accept a turn must still close the optimistic
+      // user-line lifecycle. Without this boundary the client truthfully shows
+      // what the person sent but falsely leaves Thinking/Stop pinned forever.
+      const evt = { kind: 'error', message: `${structuredRuntimeMetadata(s.runtime)?.label || 'Agent'} did not accept this turn; retry after the lane is available.`, recoverable: true }
+      pushLog(s, evt)
+      bcast('code-event', { term: payload.term, evt })
+    }
+    announce()
     // Pool-order fix (2026-07-02): emit the "dispatched to agent" marker HERE, right after
     // the @pool you-line, so it inherits the NEXT seq (seqable('pool') is true) and orders
     // correctly for EVERY viewer. It used to be pushed web-side with the FIRER's wall-clock

package/claude-session.mjs

@@ -516,16 +516,16 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
     if (toolName === 'mcp__thinkpool__close_terminal') {
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (ThinkPool cross-terminal close — only self-spawned lanes).' } }
     }
-    // ThinkPool terminal creation — open_main_terminal creates an independent main
-    // conductor; spawn_terminal creates a worker the agent owns. Both inherit mode
-    // (`mode` here is THIS lane's current mode) unless an explicit `mode` overrides it.
-    // The only thing worth a human card is an ESCALATION: raising a child to
-    // bypassPermissions from a non-bypass lane (full unattended access the operator
-    // hasn't already opted into). If the spawner is already in bypass, children inherit
-    // bypass with NO prompt (you opted in once); a non-bypass child gates itself per
-    // action anyway, so no spawn prompt there either. Bridge-side spawnDecision still
-    // enforces the one-worker-tier bound / burst window / machineMax / TP_SPAWN_OFF regardless.
-    if (toolName === 'mcp__thinkpool__spawn_terminal' || toolName === 'mcp__thinkpool__open_main_terminal') {
+    // A spawned worker is the autonomous execution unit: always auto-allow the tool.
+    // Bridge-side resolveAgentOpen pins every worker to bypassPermissions regardless
+    // of parent mode or the legacy mode argument. The one-worker-tier / plan width /
+    // machine / burst / TP_SPAWN_OFF caps still fail closed before the lane opens.
+    if (toolName === 'mcp__thinkpool__spawn_terminal') {
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (autonomous ThinkPool worker; bounded by room caps and isolated in its own worktree).' } }
+    }
+    // Independent main terminals keep their requested/inherited permission mode.
+    // Raising a new main terminal to bypass from a non-bypass parent still asks once.
+    if (toolName === 'mcp__thinkpool__open_main_terminal') {
       const childMode = toolInput?.mode || mode   // inherit this lane's mode by default
       const escalating = childMode === 'bypassPermissions' && mode !== 'bypassPermissions'
       if (!escalating) {
@@ -707,7 +707,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       ...THINKPOOL_REMOTE_DELIVERY_RULES,
       'CROSS-TERMINAL AWARENESS: this room may have other terminals open alongside yours — other agents working, or shells the people are driving. You have a READ-ONLY tool, read_terminal: call it with no arguments to list the other open terminals, or with a terminal ref/id/command to read that terminal\'s recent activity. Reach for it when your work depends on what another terminal is doing (e.g. someone says "see what the other terminal hit", or you need to coordinate with a sibling agent before acting). It only ever reads — it never changes another terminal. Identify a terminal by its NAME or its ref/id from the roster, never by an on-screen number like "Terminal 2" — those positional labels renumber when a terminal is closed, so they do not reliably point at a lane.',
       'CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',
-      'TERMINAL CREATION CONTRACT: conductors and workers use different tools. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal(name?, task?, model?) — it creates an independent MAIN terminal with no Ensemble owner. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for bounded WORKER SUB-TERMINALS when your authoritative role permits delegation. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers inherit your permission mode by default; raising one to bypass asks the room once. Collect each worker with read_terminal and close_terminal immediately after using its result. Main conductors are independent terminals and are not owned/closed through Ensemble. Room caps and the kill-switch bind both creation paths.',
+      'TERMINAL CREATION CONTRACT: conductors and workers use different tools. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal(name?, task?, model?) — it creates an independent MAIN terminal with no Ensemble owner. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for bounded WORKER SUB-TERMINALS when your authoritative role permits delegation. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers are always autonomous in bypassPermissions and never ask the room for an approval card; the bridge still enforces room caps, hop limits, the kill-switch, and isolated linked worktrees. Collect each worker with read_terminal and close_terminal immediately after using its result. Main conductors are independent terminals, keep their requested permission mode, and are not owned/closed through Ensemble.',
       'CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner\'s rooms in the same pair, reachable over the per-pair bus (a room on the partner\'s machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room\'s terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger\'s. Reach for them when work spans rooms — "what\'s the other project up to", "pick up where the other session left off", or to check a long-running task elsewhere before you act here.',
       'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. All of this works only under the ThinkPool account bridge; a standalone room sees just its own terminals.',
       'SUBAGENT POLICY: in this room, a main conductor delegates worker slices through visible spawn_terminal Ensemble lanes. A requested separate conductor is created with open_main_terminal, never Ensemble. Worker, leaf, Side, and managed Flow lanes do their assigned work directly. Do NOT reach for built-in Task/Agent subagents: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble.',

package/codex-session.mjs

@@ -68,7 +68,8 @@ export function codexDefaultCollaborationMode(model, effort) {
  * hobbled out-of-the-box. bypass gives a person-opened codex terminal parity
  * with how Claude lanes run. Claude keeps 'default' — its permission modes don't
  * gate network. Explicit modes (a person's pick, resume's persisted entry.mode,
- * a flow lane, spawn_terminal's inherited mode) always override this.
+ * a flow lane) always override this. spawn_terminal separately pins every worker
+ * to bypassPermissions as part of the autonomous-worker contract.
  */
 export function defaultModeForRuntime(runtime) {
   return runtime === 'codex' ? 'bypassPermissions' : 'default'

package/cross-terminal.mjs

@@ -512,6 +512,18 @@ export function buildDispatchPreview ({ args, initiatorTerminalId, roomCode, bri
 export function authorizeDispatchApproval ({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, decision = 'allow', consumed = false, permissionId = null, consumedPermissionId = null, limits = SPAWN } = {}) {
   if (decision !== 'allow') return { ok: false, code: 'dispatch_canceled' }
   if (consumed) return { ok: false, code: permissionId && permissionId === consumedPermissionId ? 'idempotent_replay' : 'approval_replayed' }
+  return authorizeBoundDispatch({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits })
+}
+
+// Spawned workers are autonomous by product contract: Dispatch never pauses on
+// a room approval card, and every worker runs in bypassPermissions. The immutable
+// preview still binds the exact package and caps, which are rechecked immediately
+// before opening the lane.
+export function authorizeDirectDispatch ({ preview, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
+  return authorizeBoundDispatch({ preview, approvedFingerprint: preview?.fingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits })
+}
+
+function authorizeBoundDispatch ({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
   let current
   try { current = buildDispatchPreview({ args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits }) } catch { return { ok: false, code: 'invalid_dispatch' } }
   if (!preview || preview.fingerprint !== approvedFingerprint) return { ok: false, code: 'approval_mismatch' }

package/hermes-session.mjs

@@ -13,6 +13,7 @@ import { classifyRisk } from './claude-session.mjs'
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
 export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits'])
+const HERMES_INITIALIZE_TIMEOUT_MS = 15_000
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
 const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
@@ -69,6 +70,7 @@ export function startHermesSession({
   let resuming = false
   let inventoryProbe = null
   let modelSwitchPending = false
+  let bootCancelled = false
   const policyRole = hermesRole || hermesRoleFor({})
 
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
@@ -177,24 +179,45 @@ export function startHermesSession({
       }
       let retired = false
       retireClient = () => { retired = true }
-      client = clientFactory({
-        command: launchCommand, args: launchArgs, cwd: activeCwd, env: childEnv,
-        onNotification,
-        onRequest,
-        onStderr: (text) => { stderrTail = (stderrTail + text).slice(-2000) },
-        onClose: (error) => {
-          if (ended || crashed || retired) return
-          crashed = true
-          turnActive = false
-          emit({ kind: 'error', message: `Hermes ACP closed unexpectedly: ${error?.message || error}`, recoverable: true })
-        },
-      })
-      client.start()
-      const initialized = await client.request('initialize', {
+      const initializeParams = {
         protocolVersion: HERMES_ACP_PROTOCOL_VERSION,
         clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
         clientInfo: { name: 'thinkpool-pair', title: 'ThinkPool Code', version: '1' },
-      })
+      }
+      let initialized
+      // Cold Hermes imports take 6–9 seconds on the supported host, and the
+      // production ENOSPC incident pushed one child just beyond the old 10s
+      // cliff. Initialization is pre-session and pre-inference, so one fresh
+      // process retry is safe: no prompt or tool can have executed yet.
+      for (let attempt = 0; attempt < 2; attempt++) {
+        retired = false
+        retireClient = () => { retired = true }
+        client = clientFactory({
+          command: launchCommand, args: launchArgs, cwd: activeCwd, env: childEnv,
+          onNotification,
+          onRequest,
+          onStderr: (text) => { stderrTail = (stderrTail + text).slice(-2000) },
+          onClose: (error) => {
+            if (ended || crashed || retired) return
+            crashed = true
+            turnActive = false
+            emit({ kind: 'error', message: `Hermes ACP closed unexpectedly: ${error?.message || error}`, recoverable: true })
+          },
+        })
+        client.start()
+        try {
+          initialized = await client.request('initialize', initializeParams, HERMES_INITIALIZE_TIMEOUT_MS)
+          break
+        } catch (error) {
+          const retryable = !bootCancelled && attempt === 0 && /^initialize timed out\b/i.test(String(error?.message || error))
+          if (!retryable) throw error
+          retireClient()
+          const timedOutClient = client
+          client = null
+          timedOutClient?.end()
+          stderrTail = ''
+        }
+      }
       if (initialized?.protocolVersion !== HERMES_ACP_PROTOCOL_VERSION) {
         throw new Error(`Unsupported Hermes ACP protocol ${initialized?.protocolVersion ?? 'unknown'}; expected ${HERMES_ACP_PROTOCOL_VERSION}`)
       }
@@ -255,16 +278,32 @@ export function startHermesSession({
         await client.request('session/set_mode', { sessionId, modeId: acpMode })
       }
       emit({ kind: 'capabilities', runtime: 'hermes', protocol: 'acp', protocolVersion: initialized?.protocolVersion, capabilities: initialized?.agentCapabilities || {}, models: modelList(state?.models), flow: command === HERMES_COMMAND && clientFactory === createAcpClient })
-    })().catch((error) => {
+    })().catch(async (error) => {
       crashed = true
       client?.end()
-      void mcpHttp?.close().catch(() => {})
-      emit({ kind: 'error', message: `Hermes ACP startup failed: ${error?.message || error}${stderrTail ? `: ${stderrTail.trim().slice(-240)}` : ''}`, recoverable: true })
+      try { await mcpHttp?.close() } catch { /* startup cleanup */ }
+      mcpHttp = null
+      if (!bootCancelled) emit({ kind: 'error', message: `Hermes ACP startup failed: ${error?.message || error}${stderrTail ? `: ${stderrTail.trim().slice(-240)}` : ''}`, recoverable: true })
       throw error
-    }).finally(() => { starting = null })
+    }).finally(() => { starting = null; bootCancelled = false })
     return starting
   }
 
+  function reviveAfterExplicitRetry() {
+    if (!crashed || ended) return
+    retireClient()
+    client?.end()
+    client = null
+    mapper = null
+    crashed = false
+    stderrTail = ''
+  }
+
+  function finishAbortedTurn() {
+    if (mapper) mapper.finishTurn({ stopReason: 'cancelled' })
+    else emit({ kind: 'result', subtype: 'aborted', sessionId, model: activeModel, costUsd: null, usage: null, numTurns: 1, durationMs: undefined, denials: 0, resultText: null })
+  }
+
   async function restartAfterCancelledResponseFailure() {
     const oldClient = client
     retireClient()
@@ -288,12 +327,14 @@ export function startHermesSession({
     return blocks
   }
 
-  async function runPrompt(text, options = {}) {
-    await boot()
-    const steering = turnActive
-    const turnId = steering ? activeTurnId : ++activeTurnId
+  async function runPrompt(text, options = {}, { steering = false, turnId = activeTurnId } = {}) {
+    try { await boot() }
+    catch (error) {
+      if (abortedTurns.has(turnId)) return { stopReason: 'cancelled' }
+      throw error
+    }
+    if (abortedTurns.has(turnId)) return { stopReason: 'cancelled' }
     const body = steering ? `/steer ${String(text)}` : String(text)
-    if (!steering) turnActive = true
     let result
     try {
       result = await client.request('session/prompt', {
@@ -334,17 +375,29 @@ export function startHermesSession({
     get started() { return started },
     get models() { return [] },
     sendTurn(text, options = {}) {
-      if (ended || crashed) return false
+      if (ended) return false
+      // A crash never replays work by itself. A later explicit turn is the
+      // authority to launch a fresh ACP process and resume the same native
+      // session id; this is the recovery path the old permanent latch blocked.
+      reviveAfterExplicitRetry()
       // A busy prompt is a genuine ACP /steer call and may run concurrently.
-      if (turnActive) { void runPrompt(text, options).catch((error) => emit({ kind: 'error', message: `Hermes steering failed: ${error?.message || error}`, recoverable: true })); return true }
-      promptChain = promptChain.then(() => runPrompt(text, options)).catch((error) => {
+      if (turnActive) {
+        const turnId = activeTurnId
+        void runPrompt(text, options, { steering: true, turnId }).catch((error) => emit({ kind: 'error', message: `Hermes steering failed: ${error?.message || error}`, recoverable: true }))
+        return true
+      }
+      const turnId = ++activeTurnId
+      // Claim the turn synchronously, before the cold safety probe/import. The
+      // room can now show Thinking + Stop for the whole accepted lifecycle.
+      turnActive = true
+      promptChain = promptChain.then(() => runPrompt(text, options, { steering: false, turnId })).catch((error) => {
         turnActive = false
         emit({ kind: 'error', message: `Hermes turn failed: ${error?.message || error}`, recoverable: true })
       })
       return true
     },
     abort() {
-      if (!sessionId || !client?.alive || !turnActive) return
+      if (!turnActive) return
       const turnId = activeTurnId
       abortedTurns.add(turnId)
       // Bound retained turn ids while preserving any concurrent /steer request
@@ -352,7 +405,18 @@ export function startHermesSession({
       if (abortedTurns.size > 32) abortedTurns.delete(abortedTurns.values().next().value)
       turnActive = false
       firstTurn = false
-      mapper?.finishTurn({ stopReason: 'cancelled' })
+      if (starting) {
+        bootCancelled = true
+        retireClient()
+        client?.end()
+        finishAbortedTurn()
+        return
+      }
+      if (!sessionId || !client?.alive) {
+        finishAbortedTurn()
+        return
+      }
+      finishAbortedTurn()
       void client.notify('session/cancel', { sessionId }).catch((error) => {
         // Never display a stopped lane while the un-cancelled Hermes process
         // might still be executing. A transport failure tears down the ACP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.251",
+  "version": "0.7.253",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {