thinkpool-pair 0.7.253 → 0.7.254

package/bridge.mjs

@@ -2060,9 +2060,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     if (runtime === 'hermes' && !modelCatalogValues(catalog).has(args.model)) {
       return { error: `Could not open a Hermes worker on ${JSON.stringify(args.model)} — that exact model is not in this parent session's ACP catalog.` }
     }
-    if (runtime === 'hermes' && args?.mode && !['default', 'acceptEdits'].includes(args.mode)) {
-      return { error: `Hermes ACP only exposes default/acceptEdits as user modes; Flow roles use a bridge-owned process-local tool policy.` }
-    }
     if (runtime === 'claude' && !args?.provider && args?.model && /^gpt-/i.test(args.model)) {
       return { error: `Could not open a Claude terminal on Codex model ${JSON.stringify(args.model)}. Choose runtime="codex" or a Claude model.` }
     }
@@ -3831,6 +3828,9 @@ channel
           return
         }
         s.mode = payload.mode
+        if (payload.mode === 'bypassPermissions') allowPending(s)
+        else if (payload.mode === 'acceptEdits') acceptEditsPending(s)
+        else if (payload.mode === 'plan') drainPending(s)
         s.flush?.()
         announce()
         return

package/hermes-acp-bootstrap.py

@@ -39,7 +39,7 @@ def policy():
     builtin = value.get("builtinTools")
     required_builtin = value.get("requiredBuiltinTools")
     tools = value.get("mcpTools")
-    if role not in {"ordinary", "builder", "conductor", "reviewer", "manual-review"}:
+    if role not in {"ordinary", "plan", "builder", "conductor", "reviewer", "manual-review"}:
         die("unknown role")
     if value.get("mcpServer") != "thinkpool" or not isinstance(builtin, list) or not isinstance(required_builtin, list) or not isinstance(tools, list):
         die("invalid tool policy")
@@ -49,14 +49,14 @@ def policy():
     if forbidden.intersection(builtin) or forbidden.intersection(required_builtin) or forbidden.intersection(tools):
         die("delegation and session search are forbidden")
     required_mcp = {
-        "ordinary": {"read_terminal"}, "builder": {"mark_flow_done"},
+        "ordinary": {"read_terminal"}, "plan": set(), "builder": {"mark_flow_done"},
         "conductor": {"submit_flow_plan"},
         "reviewer": {"submit_flow_review", "run_review_check", "read_review_file"},
         "manual-review": {"run_review_check", "read_review_file"},
     }
     if not required_mcp[role].issubset(tools):
         die("incomplete role MCP policy")
-    restricted = role in {"conductor", "reviewer", "manual-review"}
+    restricted = role in {"plan", "conductor", "reviewer", "manual-review"}
     allowed_builtin = READ_ONLY_TOOLS if restricted else CODING_TOOLS
     required = READ_ONLY_TOOLS if restricted else ESSENTIAL_CODING_TOOLS
     if set(builtin) != allowed_builtin:

package/hermes-policy.mjs

@@ -21,6 +21,7 @@ export const ESSENTIAL_CODING_TOOLS = Object.freeze([
 ])
 const ROLE_REQUIRED = Object.freeze({
   ordinary: ['read_terminal', 'spawn_terminal', 'close_terminal'],
+  plan: [],
   conductor: ['submit_flow_plan'],
   builder: ['mark_flow_done'],
   reviewer: ['submit_flow_review', 'run_review_check', 'read_review_file'],
@@ -44,7 +45,7 @@ export function hermesPolicyForRole(role, { mcpTools } = {}) {
   // non-delegating ordinary child without widening it.
   const minimum = role === 'ordinary' ? ['read_terminal'] : required
   for (const tool of minimum) if (!supplied.includes(tool)) throw new Error(`Hermes ${role} policy is missing required ThinkPool tool ${tool}`)
-  const restricted = role === 'conductor' || role === 'reviewer' || role === 'manual-review'
+  const restricted = role === 'plan' || role === 'conductor' || role === 'reviewer' || role === 'manual-review'
   const builtinTools = restricted ? READ_ONLY_TOOLS : CODING_TOOLS
   const requiredBuiltinTools = restricted ? READ_ONLY_TOOLS : ESSENTIAL_CODING_TOOLS
   return Object.freeze({

package/hermes-session.mjs

@@ -8,12 +8,13 @@ import { HermesEventMapper, hermesToolFor } from './hermes-event-mapper.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
 import { hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
 import { startCodexMcpHttp } from './codex-mcp-http.mjs'
-import { classifyRisk } from './claude-session.mjs'
+import { autoAllow, classifyRisk } from './claude-session.mjs'
 
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
-export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits'])
+export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 const HERMES_INITIALIZE_TIMEOUT_MS = 15_000
+const PLAN_SAFE_MCP_TOOLS = new Set(['read_terminal', 'read_review_file'])
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
 const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
@@ -71,8 +72,19 @@ export function startHermesSession({
   let inventoryProbe = null
   let modelSwitchPending = false
   let bootCancelled = false
+  let suppressNextSessionPublish = false
   const policyRole = hermesRole || hermesRoleFor({})
 
+  const effectivePolicyRole = () => activeMode === 'plan' ? 'plan' : policyRole
+  const effectiveMcpTools = () => activeMode === 'plan'
+    ? requiredMcpTools.filter((name) => PLAN_SAFE_MCP_TOOLS.has(name))
+    : requiredMcpTools
+  const acpModeFor = (value) => value === 'acceptEdits'
+    ? 'accept_edits'
+    : value === 'bypassPermissions'
+      ? 'dont_ask'
+      : 'default'
+
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
   async function onRequest(method, params, requestId) {
@@ -84,6 +96,15 @@ export function startHermesSession({
       input: tool.input,
       risk: classifyRisk(tool.name, tool.input),
     }
+    // ACP's native modes currently govern edit proposals only. ThinkPool's
+    // permission chip is the cross-runtime authority, so apply the same pure
+    // mode policy Claude uses before raising a durable room card. Structural
+    // role schemas still win: bypass can auto-allow a request, but it cannot
+    // restore a tool that the process-local Hermes policy never exposed.
+    if (activeMode === 'plan') return { outcome: { outcome: 'cancelled' } }
+    if (autoAllow({ toolName: card.toolName, input: card.input, mode: activeMode })) {
+      return { outcome: permissionOutcome('allow', params.options) }
+    }
     let decision = 'deny'
     try { decision = await requestPermission?.(card) } catch { /* fail closed */ }
     return { outcome: permissionOutcome(decision, params.options) }
@@ -103,13 +124,13 @@ export function startHermesSession({
   }
 
   async function probeMcpTools() {
-    const required = [...new Set((Array.isArray(requiredMcpTools) ? requiredMcpTools : [])
+    const required = [...new Set((Array.isArray(effectiveMcpTools()) ? effectiveMcpTools() : [])
       .map((name) => String(name || '').trim()).filter(Boolean))]
     // Direct runtime tests and unscoped upstream callers have no bridge role
     // contract to prove. Every bridge-created Hermes lane supplies its required
     // MCP list; only those lanes enter the exact-inventory transaction.
-    if (!required.length) return { inventory: '', missing: [], forbidden: [] }
-    const exact = hermesExactInventory(policyRole, { mcpTools: required })
+    if (!required.length && effectivePolicyRole() !== 'plan') return { inventory: '', missing: [], forbidden: [] }
+    const exact = hermesExactInventory(effectivePolicyRole(), { mcpTools: required })
     const allowedBuiltins = exact.builtinTools
     const requiredBuiltins = exact.requiredBuiltinTools
     const expectedMcp = exact.mcpTools
@@ -175,7 +196,7 @@ export function startHermesSession({
         // profile wrapper. HERMES_HOME is the probe-verified isolated profile.
         launchCommand = profile.python
         launchArgs = [profile.bootstrap]
-        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(policyRole, { mcpTools: requiredMcpTools }) }
+        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(effectivePolicyRole(), { mcpTools: effectiveMcpTools() }) }
       }
       let retired = false
       retireClient = () => { retired = true }
@@ -271,9 +292,18 @@ export function startHermesSession({
       const publishedModels = state?.models
         ? { ...state.models, currentModelId: activeModel }
         : activeModel ? { currentModelId: activeModel, availableModels: [] } : state?.models
-      mapper.startSession({ sessionId, models: publishedModels, modes: state?.modes, commands: [] })
+      if (!suppressNextSessionPublish) {
+        mapper.startSession({ sessionId, models: publishedModels, modes: state?.modes, commands: [] })
+      } else {
+        // A Plan transition recreates only the ACP process so its tool schema
+        // can become structurally read-only. Keep the room transcript/catalog
+        // stable while the fresh mapper resumes the same native session.
+        mapper.sessionId = sessionId
+        mapper.model = activeModel
+        suppressNextSessionPublish = false
+      }
       started = true
-      const acpMode = activeMode === 'acceptEdits' ? 'accept_edits' : 'default'
+      const acpMode = acpModeFor(activeMode)
       if (state?.modes?.availableModes?.some((item) => item.id === acpMode) && state.modes.currentModeId !== acpMode) {
         await client.request('session/set_mode', { sessionId, modeId: acpMode })
       }
@@ -452,7 +482,33 @@ export function startHermesSession({
     },
     setMode(nextMode) {
       if (turnActive || !HERMES_SUPPORTED_MODES.has(nextMode)) return false
-      void boot().then(() => client.request('session/set_mode', { sessionId, modeId: nextMode === 'acceptEdits' ? 'accept_edits' : 'default' })).then(() => {
+      const priorMode = activeMode
+      const changesPolicySchema = (priorMode === 'plan') !== (nextMode === 'plan')
+      if (changesPolicySchema) {
+        // Plan is stronger than an approval preference: it removes terminal,
+        // process, write, patch, browser, and execution schemas. ACP modes alone
+        // cannot do that, so resume the exact native session in a fresh process
+        // under the bridge-owned read-only policy.
+        activeMode = nextMode
+        suppressNextSessionPublish = started
+        if (started) {
+          retireClient()
+          const oldClient = client
+          client = null
+          mapper = null
+          started = false
+          crashed = false
+          stderrTail = ''
+          oldClient?.end()
+        }
+        void boot().then(() => emit({ kind: 'mode', mode: activeMode })).catch((error) => {
+          activeMode = priorMode
+          suppressNextSessionPublish = false
+          emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true })
+        })
+        return true
+      }
+      void boot().then(() => client.request('session/set_mode', { sessionId, modeId: acpModeFor(nextMode) })).then(() => {
         activeMode = nextMode
         emit({ kind: 'mode', mode: activeMode })
       }).catch((error) => emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true }))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.253",
+  "version": "0.7.254",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/runtime-registry.mjs

@@ -14,7 +14,7 @@ const RUNTIMES = Object.freeze({
   hermes: Object.freeze({
     id: 'hermes', command: 'thinkpool', label: 'Hermes Agent', protocol: 'acp',
     structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: false, defaultMode: 'default',
-    modes: Object.freeze(['default', 'acceptEdits']),
+    modes: Object.freeze(['default', 'acceptEdits', 'plan', 'bypassPermissions']),
     beta: true,
   }),
 })