thinkpool-pair 0.7.252 → 0.7.254

package/bridge.mjs

@@ -109,9 +109,9 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDispatchApproval, verifyDurableDispatchAuthority } from './cross-terminal.mjs'
+import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneStatusOf, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
-import { beginDispatchLease, finishDispatchLease, isDispatchLeaseCurrent, supersedeDispatchLease } from './dispatch-lease.mjs'
+import { supersedeDispatchLease } from './dispatch-lease.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, ImageEventQueue, imageQueueConfig, uploadCodeImage as uploadCodeImageRequest, usageReportLine, codexUsageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
@@ -653,31 +653,6 @@ const supabase = createClient(SUPABASE_URL, SUPABASE_ANON, {
   realtime: { params: { eventsPerSecond: 60 } },
 })
 
-// Authenticated re-read for previewed Dispatch. Realtime is intentionally not
-// trusted here: any room member can observe the public wake-up frame. RLS plus
-// the bridge's live member token supplies the item/event rows that the pure
-// verifier consumes. Timeout/offline/malformed state all fail closed.
-async function readDurableDispatchAuthority ({ controlItemId, expected, timeoutMs = 5000 } = {}) {
-  if (!codeAuthToken || !/^[0-9a-f-]{36}$/i.test(String(controlItemId || ''))) return { ok: false, code: 'durable_authority_unavailable' }
-  const controller = new AbortController()
-  const timer = setTimeout(() => controller.abort(), timeoutMs)
-  timer.unref?.()
-  const headers = { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` }
-  try {
-    const itemUrl = `${SUPABASE_URL}/rest/v1/code_pair_control_items?id=eq.${encodeURIComponent(controlItemId)}&select=*`
-    const eventsUrl = `${SUPABASE_URL}/rest/v1/code_pair_control_events?item_id=eq.${encodeURIComponent(controlItemId)}&select=*&order=created_at.asc`
-    const [itemRes, eventRes] = await Promise.all([
-      fetch(itemUrl, { headers, signal: controller.signal }),
-      fetch(eventsUrl, { headers, signal: controller.signal }),
-    ])
-    if (!itemRes.ok || !eventRes.ok) return { ok: false, code: 'durable_authority_read_failed' }
-    const [items, events] = await Promise.all([itemRes.json(), eventRes.json()])
-    if (!Array.isArray(items) || items.length !== 1 || !Array.isArray(events)) return { ok: false, code: 'durable_authority_shape' }
-    return verifyDurableDispatchAuthority({ item: items[0], events, expected: { ...expected, controlItemId } })
-  } catch { return { ok: false, code: 'durable_authority_unavailable' } }
-  finally { clearTimeout(timer) }
-}
-
 // Owner's plan (free|plus) — gates the Ensemble dispatch ceiling (Free 3 / Plus 6).
 // Resolved from the owner token (codeAuthToken); RLS lets a user read their OWN
 // profiles row. Cached; defaults to 'free' (the safe lower ceiling) until the fetch
@@ -1761,8 +1736,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // codex → bypassPermissions, so a freshly-opened codex terminal can fetch /
   // advance / ship instead of hitting the no-network wall; claude → default.
   // Only fires when no mode was passed — a person's pick, a resume (persisted
-  // entry.mode), a flow lane, and spawn_terminal (inherits the parent's mode +
-  // its own bypass-escalation gate) all pass an explicit mode and skip this.
+  // entry.mode), a flow lane, and spawn_terminal (always bypassPermissions) all
+  // pass an explicit mode and skip this.
   mode = STRUCTURED_MODES.has(mode) && structuredRuntimeSupportsMode(runtime, mode) ? mode : defaultStructuredMode(runtime)
   assertRuntimeModelCompatible({ runtime, provider, model })
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
@@ -2085,9 +2060,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     if (runtime === 'hermes' && !modelCatalogValues(catalog).has(args.model)) {
       return { error: `Could not open a Hermes worker on ${JSON.stringify(args.model)} — that exact model is not in this parent session's ACP catalog.` }
     }
-    if (runtime === 'hermes' && args?.mode && !['default', 'acceptEdits'].includes(args.mode)) {
-      return { error: `Hermes ACP only exposes default/acceptEdits as user modes; Flow roles use a bridge-owned process-local tool policy.` }
-    }
     if (runtime === 'claude' && !args?.provider && args?.model && /^gpt-/i.test(args.model)) {
       return { error: `Could not open a Claude terminal on Codex model ${JSON.stringify(args.model)}. Choose runtime="codex" or a Claude model.` }
     }
@@ -2096,7 +2068,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       model: args?.model || (worker && args?.sliceType
         ? spawnedLaneModelFor({ sliceType: args.sliceType, runtime, catalog })
         : undefined),
-      mode: args?.mode || (entry.mode === 'plan' ? 'default' : entry.mode),
+      // Worker lanes are the autonomous execution unit. They never inherit a
+      // permission-card mode from the conductor and never honor a lower explicit
+      // override: spawn_terminal always opens them in bypassPermissions.
+      mode: worker ? 'bypassPermissions' : (args?.mode || (entry.mode === 'plan' ? 'default' : entry.mode)),
       provider: args?.provider,
     }
   }
@@ -2111,23 +2086,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     plan: ownerPlan,
     disabled: process.env.TP_SPAWN_OFF === '1',
   })
-  // Dispatch uses the same durable pair-control permission transport as every
-  // protected action. The preview is additive evidence on that one request;
-  // this Promise is not another approval store or an autonomous allow path.
-  const requestDispatchApproval = (req) => new Promise((resolve) => {
-    const payload = attachDurablePermissionSource(entry, {
-      term: id, id: req.id, toolName: 'mcp__thinkpool__spawn_terminal',
-      // Exact arguments are already bound into dispatchPreview.fingerprint. Do not
-      // copy raw tool input into the public wake-up frame or the reconnect cache.
-      risk: 'high', answerFormat: 'dispatch',
-      dispatchPreview: req.dispatchPreview,
-    })
-    entry.pending.set(req.id, { resolve, payload, timer: null })
-    announce()
-    bcast('code-perm-req', payload)
-    if (isUserFacingLane(entry)) entry.permNotifier?.arm(req.id, permissionSummary(payload))
-    process.stderr.write(`\n  ${A.yel}● Dispatch preview ready — approve or cancel in the room.${A.rst}\n`)
-  })
   const consumeTerminalOpenBudget = () => {
     const now = Date.now()
     const gate = spawnDecision({
@@ -2362,7 +2320,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           sliceType: z.enum(['scaffold', 'feature', 'fix', 'review']).optional().describe('optional cascade slice tier; omitted preserves normal inheritance/default, explicit model wins'),
           runtime: z.enum(['claude', 'codex', 'hermes']).optional().describe('agent runtime for the new lane; Hermes is allowed only from a top-level Hermes parent with an explicit catalog model'),
           provider: z.string().optional().describe('optional registered LLM provider id to run this lane on (from the account\'s provider registry); omit for the default Claude/Anthropic path'),
-          mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('permission mode for the new lane; defaults to inheriting YOUR current mode. Raising a lane to bypassPermissions from a non-bypass lane asks the room to confirm once.'),
+          mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('accepted for compatibility; spawned workers always run autonomously in bypassPermissions'),
         },
         async (args) => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
@@ -2402,33 +2360,10 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               },
             })
           } catch { return okText('Dispatch preview could not be built safely. No lane was created.') }
-          const permissionId = randomUUID()
-          const dispatchAdmission = beginDispatchLease(entry, permissionId)
-          if (!dispatchAdmission.ok) {
-            return okText('A dispatch choice is already awaiting approval in the room. Do not retry or switch runtimes; wait for that choice to be approved or canceled, or for a new human turn to supersede it.')
-          }
-          const dispatchLease = dispatchAdmission.lease
-          try {
-          let approval = { decision: 'deny' }
-          try { approval = await requestDispatchApproval({ id: permissionId, input: effectiveArgs, dispatchPreview: preview }) } catch { /* fail closed */ }
-          if (approval?.decision !== 'allow') return okText('Dispatch canceled. No lane or worktree was created.')
-          if (!isDispatchLeaseCurrent(entry, dispatchLease)) return okText('That dispatch choice was superseded by a newer turn. No lane or worktree was created.')
           const currentNow = Date.now()
           const current = dispatchContext(currentNow)
-          const durable = await readDurableDispatchAuthority({
-            controlItemId: approval.controlItemId,
-            expected: {
-              roomCode: room,
-              bridgeAuthorityId: BRIDGE_ID,
-              localAuthorityId: id,
-              fingerprint: preview.fingerprint,
-            },
-          })
-          if (!durable.ok) return okText('Dispatch approval could not be verified from the durable room authority. No lane was created.')
-          if (!isDispatchLeaseCurrent(entry, dispatchLease)) return okText('That dispatch choice was superseded by a newer turn. No lane or worktree was created.')
-          const authorization = authorizeDispatchApproval({
+          const authorization = authorizeDirectDispatch({
             preview,
-            approvedFingerprint: durable.fingerprint,
             args: effectiveArgs,
             initiatorTerminalId: id,
             roomCode: room,
@@ -2439,9 +2374,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
               providerName: resolved.provider ? (providerNameMap()[resolved.provider] || resolved.provider) : undefined,
               resolvedModel: resolved.model,
             },
-            permissionId,
           })
-          if (!authorization.ok) return okText(authorization.reason || 'Dispatch approval is stale or does not match this request. No lane was created.')
+          if (!authorization.ok) return okText(authorization.reason || 'Dispatch became stale or exceeded a cap. No lane was created.')
           // Record this spawn, pruning timestamps that have already left the window
           // (identical predicate to recentSpawnCount) so the array can't grow unbounded.
           entry.spawnTimes = [...(entry.spawnTimes || []).filter((t) => Number.isFinite(t) && t > currentNow - SPAWN.windowMs), currentNow]
@@ -2450,12 +2384,8 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           const fromRef = String(id).slice(0, 8)
           // Name BEFORE opening so openStructured's own announce already carries the label.
           if (args?.name) { termNames[newId] = String(args.name).slice(0, 80); saveNames(room, termNames) }
-          // Inherit the spawner's permission mode by default (so a bypass orchestrator's
-          // lanes run autonomously); an explicit `mode` overrides. The PreToolUse gate
-          // already confirmed any bypass-escalation from a non-bypass lane before we got here.
-          // PM-m1 — never INHERIT plan mode into a spawned worker lane: a lane spawned from a
-          // plan-mode lane would stall on ExitPlanMode cards. An explicit args.mode still wins;
-          // otherwise inherit, but fall plan → default (an autonomous worker doesn't plan-gate).
+          // Every worker is autonomous by contract: resolveAgentOpen pins
+          // bypassPermissions regardless of the parent or legacy mode argument.
           const childSpawnDepth = (entry.spawnDepth || 0) + 1
           const childHop = (entry.hop || 0) + 1
           let manualReviewSnapshots = []
@@ -2487,9 +2417,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
             return okText(`Opened agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''} and handed it the task. It runs in its own lane — check back with read_terminal, then close_terminal when done.`)
           }
           return okText(`Opened idle agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''}. Hand it work with post_to_terminal, or a person can type into it.`)
-          } finally {
-            finishDispatchLease(entry, dispatchLease)
-          }
         },
       )] : []),
       // Research lane — run a REAL multi-source search + adversarial verification and
@@ -3901,6 +3828,9 @@ channel
           return
         }
         s.mode = payload.mode
+        if (payload.mode === 'bypassPermissions') allowPending(s)
+        else if (payload.mode === 'acceptEdits') acceptEditsPending(s)
+        else if (payload.mode === 'plan') drainPending(s)
         s.flush?.()
         announce()
         return

package/claude-session.mjs

@@ -516,16 +516,16 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
     if (toolName === 'mcp__thinkpool__close_terminal') {
       return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (ThinkPool cross-terminal close — only self-spawned lanes).' } }
     }
-    // ThinkPool terminal creation — open_main_terminal creates an independent main
-    // conductor; spawn_terminal creates a worker the agent owns. Both inherit mode
-    // (`mode` here is THIS lane's current mode) unless an explicit `mode` overrides it.
-    // The only thing worth a human card is an ESCALATION: raising a child to
-    // bypassPermissions from a non-bypass lane (full unattended access the operator
-    // hasn't already opted into). If the spawner is already in bypass, children inherit
-    // bypass with NO prompt (you opted in once); a non-bypass child gates itself per
-    // action anyway, so no spawn prompt there either. Bridge-side spawnDecision still
-    // enforces the one-worker-tier bound / burst window / machineMax / TP_SPAWN_OFF regardless.
-    if (toolName === 'mcp__thinkpool__spawn_terminal' || toolName === 'mcp__thinkpool__open_main_terminal') {
+    // A spawned worker is the autonomous execution unit: always auto-allow the tool.
+    // Bridge-side resolveAgentOpen pins every worker to bypassPermissions regardless
+    // of parent mode or the legacy mode argument. The one-worker-tier / plan width /
+    // machine / burst / TP_SPAWN_OFF caps still fail closed before the lane opens.
+    if (toolName === 'mcp__thinkpool__spawn_terminal') {
+      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (autonomous ThinkPool worker; bounded by room caps and isolated in its own worktree).' } }
+    }
+    // Independent main terminals keep their requested/inherited permission mode.
+    // Raising a new main terminal to bypass from a non-bypass parent still asks once.
+    if (toolName === 'mcp__thinkpool__open_main_terminal') {
       const childMode = toolInput?.mode || mode   // inherit this lane's mode by default
       const escalating = childMode === 'bypassPermissions' && mode !== 'bypassPermissions'
       if (!escalating) {
@@ -707,7 +707,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       ...THINKPOOL_REMOTE_DELIVERY_RULES,
       'CROSS-TERMINAL AWARENESS: this room may have other terminals open alongside yours — other agents working, or shells the people are driving. You have a READ-ONLY tool, read_terminal: call it with no arguments to list the other open terminals, or with a terminal ref/id/command to read that terminal\'s recent activity. Reach for it when your work depends on what another terminal is doing (e.g. someone says "see what the other terminal hit", or you need to coordinate with a sibling agent before acting). It only ever reads — it never changes another terminal. Identify a terminal by its NAME or its ref/id from the roster, never by an on-screen number like "Terminal 2" — those positional labels renumber when a terminal is closed, so they do not reliably point at a lane.',
       'CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',
-      'TERMINAL CREATION CONTRACT: conductors and workers use different tools. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal(name?, task?, model?) — it creates an independent MAIN terminal with no Ensemble owner. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for bounded WORKER SUB-TERMINALS when your authoritative role permits delegation. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers inherit your permission mode by default; raising one to bypass asks the room once. Collect each worker with read_terminal and close_terminal immediately after using its result. Main conductors are independent terminals and are not owned/closed through Ensemble. Room caps and the kill-switch bind both creation paths.',
+      'TERMINAL CREATION CONTRACT: conductors and workers use different tools. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal(name?, task?, model?) — it creates an independent MAIN terminal with no Ensemble owner. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for bounded WORKER SUB-TERMINALS when your authoritative role permits delegation. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers are always autonomous in bypassPermissions and never ask the room for an approval card; the bridge still enforces room caps, hop limits, the kill-switch, and isolated linked worktrees. Collect each worker with read_terminal and close_terminal immediately after using its result. Main conductors are independent terminals, keep their requested permission mode, and are not owned/closed through Ensemble.',
       'CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner\'s rooms in the same pair, reachable over the per-pair bus (a room on the partner\'s machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room\'s terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger\'s. Reach for them when work spans rooms — "what\'s the other project up to", "pick up where the other session left off", or to check a long-running task elsewhere before you act here.',
       'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. All of this works only under the ThinkPool account bridge; a standalone room sees just its own terminals.',
       'SUBAGENT POLICY: in this room, a main conductor delegates worker slices through visible spawn_terminal Ensemble lanes. A requested separate conductor is created with open_main_terminal, never Ensemble. Worker, leaf, Side, and managed Flow lanes do their assigned work directly. Do NOT reach for built-in Task/Agent subagents: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble.',

package/codex-session.mjs

@@ -68,7 +68,8 @@ export function codexDefaultCollaborationMode(model, effort) {
  * hobbled out-of-the-box. bypass gives a person-opened codex terminal parity
  * with how Claude lanes run. Claude keeps 'default' — its permission modes don't
  * gate network. Explicit modes (a person's pick, resume's persisted entry.mode,
- * a flow lane, spawn_terminal's inherited mode) always override this.
+ * a flow lane) always override this. spawn_terminal separately pins every worker
+ * to bypassPermissions as part of the autonomous-worker contract.
  */
 export function defaultModeForRuntime(runtime) {
   return runtime === 'codex' ? 'bypassPermissions' : 'default'

package/cross-terminal.mjs

@@ -512,6 +512,18 @@ export function buildDispatchPreview ({ args, initiatorTerminalId, roomCode, bri
 export function authorizeDispatchApproval ({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, decision = 'allow', consumed = false, permissionId = null, consumedPermissionId = null, limits = SPAWN } = {}) {
   if (decision !== 'allow') return { ok: false, code: 'dispatch_canceled' }
   if (consumed) return { ok: false, code: permissionId && permissionId === consumedPermissionId ? 'idempotent_replay' : 'approval_replayed' }
+  return authorizeBoundDispatch({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits })
+}
+
+// Spawned workers are autonomous by product contract: Dispatch never pauses on
+// a room approval card, and every worker runs in bypassPermissions. The immutable
+// preview still binds the exact package and caps, which are rechecked immediately
+// before opening the lane.
+export function authorizeDirectDispatch ({ preview, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
+  return authorizeBoundDispatch({ preview, approvedFingerprint: preview?.fingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits })
+}
+
+function authorizeBoundDispatch ({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
   let current
   try { current = buildDispatchPreview({ args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits }) } catch { return { ok: false, code: 'invalid_dispatch' } }
   if (!preview || preview.fingerprint !== approvedFingerprint) return { ok: false, code: 'approval_mismatch' }

package/hermes-acp-bootstrap.py

@@ -39,7 +39,7 @@ def policy():
     builtin = value.get("builtinTools")
     required_builtin = value.get("requiredBuiltinTools")
     tools = value.get("mcpTools")
-    if role not in {"ordinary", "builder", "conductor", "reviewer", "manual-review"}:
+    if role not in {"ordinary", "plan", "builder", "conductor", "reviewer", "manual-review"}:
         die("unknown role")
     if value.get("mcpServer") != "thinkpool" or not isinstance(builtin, list) or not isinstance(required_builtin, list) or not isinstance(tools, list):
         die("invalid tool policy")
@@ -49,14 +49,14 @@ def policy():
     if forbidden.intersection(builtin) or forbidden.intersection(required_builtin) or forbidden.intersection(tools):
         die("delegation and session search are forbidden")
     required_mcp = {
-        "ordinary": {"read_terminal"}, "builder": {"mark_flow_done"},
+        "ordinary": {"read_terminal"}, "plan": set(), "builder": {"mark_flow_done"},
         "conductor": {"submit_flow_plan"},
         "reviewer": {"submit_flow_review", "run_review_check", "read_review_file"},
         "manual-review": {"run_review_check", "read_review_file"},
     }
     if not required_mcp[role].issubset(tools):
         die("incomplete role MCP policy")
-    restricted = role in {"conductor", "reviewer", "manual-review"}
+    restricted = role in {"plan", "conductor", "reviewer", "manual-review"}
     allowed_builtin = READ_ONLY_TOOLS if restricted else CODING_TOOLS
     required = READ_ONLY_TOOLS if restricted else ESSENTIAL_CODING_TOOLS
     if set(builtin) != allowed_builtin:

package/hermes-policy.mjs

@@ -21,6 +21,7 @@ export const ESSENTIAL_CODING_TOOLS = Object.freeze([
 ])
 const ROLE_REQUIRED = Object.freeze({
   ordinary: ['read_terminal', 'spawn_terminal', 'close_terminal'],
+  plan: [],
   conductor: ['submit_flow_plan'],
   builder: ['mark_flow_done'],
   reviewer: ['submit_flow_review', 'run_review_check', 'read_review_file'],
@@ -44,7 +45,7 @@ export function hermesPolicyForRole(role, { mcpTools } = {}) {
   // non-delegating ordinary child without widening it.
   const minimum = role === 'ordinary' ? ['read_terminal'] : required
   for (const tool of minimum) if (!supplied.includes(tool)) throw new Error(`Hermes ${role} policy is missing required ThinkPool tool ${tool}`)
-  const restricted = role === 'conductor' || role === 'reviewer' || role === 'manual-review'
+  const restricted = role === 'plan' || role === 'conductor' || role === 'reviewer' || role === 'manual-review'
   const builtinTools = restricted ? READ_ONLY_TOOLS : CODING_TOOLS
   const requiredBuiltinTools = restricted ? READ_ONLY_TOOLS : ESSENTIAL_CODING_TOOLS
   return Object.freeze({

package/hermes-session.mjs

@@ -8,12 +8,13 @@ import { HermesEventMapper, hermesToolFor } from './hermes-event-mapper.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
 import { hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
 import { startCodexMcpHttp } from './codex-mcp-http.mjs'
-import { classifyRisk } from './claude-session.mjs'
+import { autoAllow, classifyRisk } from './claude-session.mjs'
 
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
-export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits'])
+export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 const HERMES_INITIALIZE_TIMEOUT_MS = 15_000
+const PLAN_SAFE_MCP_TOOLS = new Set(['read_terminal', 'read_review_file'])
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
 const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
@@ -71,8 +72,19 @@ export function startHermesSession({
   let inventoryProbe = null
   let modelSwitchPending = false
   let bootCancelled = false
+  let suppressNextSessionPublish = false
   const policyRole = hermesRole || hermesRoleFor({})
 
+  const effectivePolicyRole = () => activeMode === 'plan' ? 'plan' : policyRole
+  const effectiveMcpTools = () => activeMode === 'plan'
+    ? requiredMcpTools.filter((name) => PLAN_SAFE_MCP_TOOLS.has(name))
+    : requiredMcpTools
+  const acpModeFor = (value) => value === 'acceptEdits'
+    ? 'accept_edits'
+    : value === 'bypassPermissions'
+      ? 'dont_ask'
+      : 'default'
+
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
   async function onRequest(method, params, requestId) {
@@ -84,6 +96,15 @@ export function startHermesSession({
       input: tool.input,
       risk: classifyRisk(tool.name, tool.input),
     }
+    // ACP's native modes currently govern edit proposals only. ThinkPool's
+    // permission chip is the cross-runtime authority, so apply the same pure
+    // mode policy Claude uses before raising a durable room card. Structural
+    // role schemas still win: bypass can auto-allow a request, but it cannot
+    // restore a tool that the process-local Hermes policy never exposed.
+    if (activeMode === 'plan') return { outcome: { outcome: 'cancelled' } }
+    if (autoAllow({ toolName: card.toolName, input: card.input, mode: activeMode })) {
+      return { outcome: permissionOutcome('allow', params.options) }
+    }
     let decision = 'deny'
     try { decision = await requestPermission?.(card) } catch { /* fail closed */ }
     return { outcome: permissionOutcome(decision, params.options) }
@@ -103,13 +124,13 @@ export function startHermesSession({
   }
 
   async function probeMcpTools() {
-    const required = [...new Set((Array.isArray(requiredMcpTools) ? requiredMcpTools : [])
+    const required = [...new Set((Array.isArray(effectiveMcpTools()) ? effectiveMcpTools() : [])
       .map((name) => String(name || '').trim()).filter(Boolean))]
     // Direct runtime tests and unscoped upstream callers have no bridge role
     // contract to prove. Every bridge-created Hermes lane supplies its required
     // MCP list; only those lanes enter the exact-inventory transaction.
-    if (!required.length) return { inventory: '', missing: [], forbidden: [] }
-    const exact = hermesExactInventory(policyRole, { mcpTools: required })
+    if (!required.length && effectivePolicyRole() !== 'plan') return { inventory: '', missing: [], forbidden: [] }
+    const exact = hermesExactInventory(effectivePolicyRole(), { mcpTools: required })
     const allowedBuiltins = exact.builtinTools
     const requiredBuiltins = exact.requiredBuiltinTools
     const expectedMcp = exact.mcpTools
@@ -175,7 +196,7 @@ export function startHermesSession({
         // profile wrapper. HERMES_HOME is the probe-verified isolated profile.
         launchCommand = profile.python
         launchArgs = [profile.bootstrap]
-        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(policyRole, { mcpTools: requiredMcpTools }) }
+        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(effectivePolicyRole(), { mcpTools: effectiveMcpTools() }) }
       }
       let retired = false
       retireClient = () => { retired = true }
@@ -271,9 +292,18 @@ export function startHermesSession({
       const publishedModels = state?.models
         ? { ...state.models, currentModelId: activeModel }
         : activeModel ? { currentModelId: activeModel, availableModels: [] } : state?.models
-      mapper.startSession({ sessionId, models: publishedModels, modes: state?.modes, commands: [] })
+      if (!suppressNextSessionPublish) {
+        mapper.startSession({ sessionId, models: publishedModels, modes: state?.modes, commands: [] })
+      } else {
+        // A Plan transition recreates only the ACP process so its tool schema
+        // can become structurally read-only. Keep the room transcript/catalog
+        // stable while the fresh mapper resumes the same native session.
+        mapper.sessionId = sessionId
+        mapper.model = activeModel
+        suppressNextSessionPublish = false
+      }
       started = true
-      const acpMode = activeMode === 'acceptEdits' ? 'accept_edits' : 'default'
+      const acpMode = acpModeFor(activeMode)
       if (state?.modes?.availableModes?.some((item) => item.id === acpMode) && state.modes.currentModeId !== acpMode) {
         await client.request('session/set_mode', { sessionId, modeId: acpMode })
       }
@@ -452,7 +482,33 @@ export function startHermesSession({
     },
     setMode(nextMode) {
       if (turnActive || !HERMES_SUPPORTED_MODES.has(nextMode)) return false
-      void boot().then(() => client.request('session/set_mode', { sessionId, modeId: nextMode === 'acceptEdits' ? 'accept_edits' : 'default' })).then(() => {
+      const priorMode = activeMode
+      const changesPolicySchema = (priorMode === 'plan') !== (nextMode === 'plan')
+      if (changesPolicySchema) {
+        // Plan is stronger than an approval preference: it removes terminal,
+        // process, write, patch, browser, and execution schemas. ACP modes alone
+        // cannot do that, so resume the exact native session in a fresh process
+        // under the bridge-owned read-only policy.
+        activeMode = nextMode
+        suppressNextSessionPublish = started
+        if (started) {
+          retireClient()
+          const oldClient = client
+          client = null
+          mapper = null
+          started = false
+          crashed = false
+          stderrTail = ''
+          oldClient?.end()
+        }
+        void boot().then(() => emit({ kind: 'mode', mode: activeMode })).catch((error) => {
+          activeMode = priorMode
+          suppressNextSessionPublish = false
+          emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true })
+        })
+        return true
+      }
+      void boot().then(() => client.request('session/set_mode', { sessionId, modeId: acpModeFor(nextMode) })).then(() => {
         activeMode = nextMode
         emit({ kind: 'mode', mode: activeMode })
       }).catch((error) => emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true }))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.252",
+  "version": "0.7.254",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/runtime-registry.mjs

@@ -14,7 +14,7 @@ const RUNTIMES = Object.freeze({
   hermes: Object.freeze({
     id: 'hermes', command: 'thinkpool', label: 'Hermes Agent', protocol: 'acp',
     structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: false, defaultMode: 'default',
-    modes: Object.freeze(['default', 'acceptEdits']),
+    modes: Object.freeze(['default', 'acceptEdits', 'plan', 'bypassPermissions']),
     beta: true,
   }),
 })