thinkpool-pair 0.7.253 → 0.7.255

package/bridge.mjs

@@ -2060,9 +2060,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     if (runtime === 'hermes' && !modelCatalogValues(catalog).has(args.model)) {
       return { error: `Could not open a Hermes worker on ${JSON.stringify(args.model)} — that exact model is not in this parent session's ACP catalog.` }
     }
-    if (runtime === 'hermes' && args?.mode && !['default', 'acceptEdits'].includes(args.mode)) {
-      return { error: `Hermes ACP only exposes default/acceptEdits as user modes; Flow roles use a bridge-owned process-local tool policy.` }
-    }
     if (runtime === 'claude' && !args?.provider && args?.model && /^gpt-/i.test(args.model)) {
       return { error: `Could not open a Claude terminal on Codex model ${JSON.stringify(args.model)}. Choose runtime="codex" or a Claude model.` }
     }
@@ -2144,7 +2141,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // (reset per human turn alongside the in-room budgets) + TP_CROSSROOM_OFF kill-switch.
       tool(
         'list_sessions',
-        'List your OTHER ThinkPool Code sessions (rooms) open on this machine — beyond this one. Returns each room\'s code and name so you can read into one with read_session. This is Thinkpool Ensemble across SESSIONS, not just terminals: it lets you see and pick up work in your other rooms. Read-only.',
+        'List OTHER ThinkPool Code sessions (rooms) reachable from this room: your own rooms on this machine plus your partner\'s shared rooms over the pair bus. Returns each room\'s code, name, and partner host when remote so you can read into one with read_session. This is Thinkpool Ensemble across SESSIONS, not just terminals. Read-only.',
         {},
         async () => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
@@ -2156,7 +2153,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       ),
       tool(
         'read_session',
-        'Read-only view INTO another of your ThinkPool Code sessions on this machine (a room code from list_sessions). Pass `session` (the room code) and optionally `terminal` (a ref/name in that room) to read its recent activity; omit `terminal` to list that room\'s terminals. It never changes the other session — reading only. Use it to check on or pick up work running in a sibling session.',
+        'Read-only view INTO another ThinkPool Code session returned by list_sessions—either your own room on this machine or your partner\'s shared room over the pair bus. Pass `session` (the room code) and optionally `terminal` (a ref/name in that room) to read its recent activity; omit `terminal` to list that room\'s terminals. It never changes the other session.',
         {
           session: z.string().describe('the room code of the other session (from list_sessions)'),
           terminal: z.string().optional().describe('ref, id, or name of a terminal in that room; omit to list that room\'s terminals'),
@@ -3831,6 +3828,9 @@ channel
           return
         }
         s.mode = payload.mode
+        if (payload.mode === 'bypassPermissions') allowPending(s)
+        else if (payload.mode === 'acceptEdits') acceptEditsPending(s)
+        else if (payload.mode === 'plan') drainPending(s)
         s.flush?.()
         announce()
         return

package/cross-terminal.mjs

@@ -606,6 +606,26 @@ export const CROSSROOM = {
   peekPerTurnCap: 5,   // list_sessions + read_session calls allowed per turn (vs PEEK.perTurnCap=10 in-room)
 }
 
+// Canonical ThinkPool peer capability names. Claude/Codex receive the SDK MCP
+// server directly; Hermes reconstructs a process-local schema and therefore
+// needs the same names explicitly. Keep the peer surface here beside its gates
+// so a runtime cannot silently lose cross-room reach when the server grows.
+export const PEER_READ_MCP_TOOLS = Object.freeze([
+  'read_terminal',
+  'list_sessions',
+  'read_session',
+])
+
+export const PEER_POST_MCP_TOOLS = Object.freeze([
+  'post_to_terminal',
+  'post_to_session',
+])
+
+export const PEER_MCP_TOOLS = Object.freeze([
+  ...PEER_READ_MCP_TOOLS,
+  ...PEER_POST_MCP_TOOLS,
+])
+
 // Render the list_sessions roster from the supervisor's room list. `rooms` is
 // [{ code, name }]; `thisRoom` is excluded defensively (the supervisor already
 // drops it). Mirrors formatPeek's no-arg roster shape so the agent reads one voice.

package/hermes-acp-bootstrap.py

@@ -39,7 +39,7 @@ def policy():
     builtin = value.get("builtinTools")
     required_builtin = value.get("requiredBuiltinTools")
     tools = value.get("mcpTools")
-    if role not in {"ordinary", "builder", "conductor", "reviewer", "manual-review"}:
+    if role not in {"ordinary", "plan", "builder", "conductor", "reviewer", "manual-review"}:
         die("unknown role")
     if value.get("mcpServer") != "thinkpool" or not isinstance(builtin, list) or not isinstance(required_builtin, list) or not isinstance(tools, list):
         die("invalid tool policy")
@@ -49,14 +49,14 @@ def policy():
     if forbidden.intersection(builtin) or forbidden.intersection(required_builtin) or forbidden.intersection(tools):
         die("delegation and session search are forbidden")
     required_mcp = {
-        "ordinary": {"read_terminal"}, "builder": {"mark_flow_done"},
+        "ordinary": {"read_terminal"}, "plan": set(), "builder": {"mark_flow_done"},
         "conductor": {"submit_flow_plan"},
         "reviewer": {"submit_flow_review", "run_review_check", "read_review_file"},
         "manual-review": {"run_review_check", "read_review_file"},
     }
     if not required_mcp[role].issubset(tools):
         die("incomplete role MCP policy")
-    restricted = role in {"conductor", "reviewer", "manual-review"}
+    restricted = role in {"plan", "conductor", "reviewer", "manual-review"}
     allowed_builtin = READ_ONLY_TOOLS if restricted else CODING_TOOLS
     required = READ_ONLY_TOOLS if restricted else ESSENTIAL_CODING_TOOLS
     if set(builtin) != allowed_builtin:

package/hermes-policy.mjs

@@ -1,5 +1,7 @@
 // Bridge-owned Hermes ACP schema policy. This is intentionally a small, pure
 // contract: Python receives only this JSON and fails closed for anything else.
+import { PEER_MCP_TOOLS, PEER_READ_MCP_TOOLS } from './cross-terminal.mjs'
+
 export const HERMES_POLICY_VERSION = 1
 
 export const CODING_TOOLS = Object.freeze([
@@ -20,7 +22,8 @@ export const ESSENTIAL_CODING_TOOLS = Object.freeze([
   'terminal', 'process', 'read_file', 'write_file', 'patch', 'search_files',
 ])
 const ROLE_REQUIRED = Object.freeze({
-  ordinary: ['read_terminal', 'spawn_terminal', 'close_terminal'],
+  ordinary: [...PEER_MCP_TOOLS, 'spawn_terminal', 'close_terminal'],
+  plan: [],
   conductor: ['submit_flow_plan'],
   builder: ['mark_flow_done'],
   reviewer: ['submit_flow_review', 'run_review_check', 'read_review_file'],
@@ -42,9 +45,9 @@ export function hermesPolicyForRole(role, { mcpTools } = {}) {
   // Ordinary worker leaves deliberately lack spawn/close. Main-lane proof is
   // enforced by requiredMcpTools at dispatch; keep this schema usable for a
   // non-delegating ordinary child without widening it.
-  const minimum = role === 'ordinary' ? ['read_terminal'] : required
+  const minimum = role === 'ordinary' ? PEER_MCP_TOOLS : required
   for (const tool of minimum) if (!supplied.includes(tool)) throw new Error(`Hermes ${role} policy is missing required ThinkPool tool ${tool}`)
-  const restricted = role === 'conductor' || role === 'reviewer' || role === 'manual-review'
+  const restricted = role === 'plan' || role === 'conductor' || role === 'reviewer' || role === 'manual-review'
   const builtinTools = restricted ? READ_ONLY_TOOLS : CODING_TOOLS
   const requiredBuiltinTools = restricted ? READ_ONLY_TOOLS : ESSENTIAL_CODING_TOOLS
   return Object.freeze({
@@ -60,10 +63,12 @@ export function hermesPolicyForRole(role, { mcpTools } = {}) {
 }
 
 export function hermesRequiredMcpTools(role, { canSpawnWorkers = false } = {}) {
-  if (role === 'ordinary') return ['read_terminal', ...(canSpawnWorkers ? ['spawn_terminal', 'close_terminal'] : [])]
+  if (role === 'ordinary') return [...PEER_MCP_TOOLS, ...(canSpawnWorkers ? ['spawn_terminal', 'close_terminal'] : [])]
   return [...ROLE_REQUIRED[role]]
 }
 
+export const HERMES_PLAN_SAFE_MCP_TOOLS = PEER_READ_MCP_TOOLS
+
 // Keep the bridge's local /tools proof on the same canonical inventory as the
 // process-local Python bootstrap.  `allBuiltinTools` lets that proof reject a
 // known built-in which is not part of this role, rather than merely looking

package/hermes-session.mjs

@@ -6,14 +6,16 @@ import { randomUUID } from 'node:crypto'
 import { AcpClient } from './acp-client.mjs'
 import { HermesEventMapper, hermesToolFor } from './hermes-event-mapper.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
-import { hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
+import { HERMES_PLAN_SAFE_MCP_TOOLS, hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
 import { startCodexMcpHttp } from './codex-mcp-http.mjs'
-import { classifyRisk } from './claude-session.mjs'
+import { autoAllow, classifyRisk } from './claude-session.mjs'
+import { crossPostNeedsCard } from './cross-terminal.mjs'
 
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
-export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits'])
+export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 const HERMES_INITIALIZE_TIMEOUT_MS = 15_000
+const PLAN_SAFE_MCP_TOOLS = new Set([...HERMES_PLAN_SAFE_MCP_TOOLS, 'read_review_file'])
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
 const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
@@ -47,6 +49,7 @@ export function startHermesSession({
   roomContext, terminalRolePrompt, rolePrompt, mcpServers, requiredMcpTools = [], prepareCwd = null,
   command = HERMES_COMMAND, args = ['acp'], clientFactory = createAcpClient,
   mcpHttpFactory = startCodexMcpHttp, lazy = false, hermesRole = null,
+  crossPostGate = null, didSpawnTarget = null, crossRoomPostGate = null,
 } = {}) {
   let activeCwd = cwd
   const requestedModel = model || null
@@ -71,18 +74,67 @@ export function startHermesSession({
   let inventoryProbe = null
   let modelSwitchPending = false
   let bootCancelled = false
+  let suppressNextSessionPublish = false
   const policyRole = hermesRole || hermesRoleFor({})
 
+  const effectivePolicyRole = () => activeMode === 'plan' ? 'plan' : policyRole
+  const effectiveMcpTools = () => activeMode === 'plan'
+    ? requiredMcpTools.filter((name) => PLAN_SAFE_MCP_TOOLS.has(name))
+    : requiredMcpTools
+  const acpModeFor = (value) => value === 'acceptEdits'
+    ? 'accept_edits'
+    : value === 'bypassPermissions'
+      ? 'dont_ask'
+      : 'default'
+
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
+  const thinkpoolPeerTool = (name) => {
+    const lower = String(name || '').toLowerCase()
+    return [...HERMES_PLAN_SAFE_MCP_TOOLS, 'post_to_terminal', 'post_to_session']
+      .find((candidate) => lower === candidate || lower === `mcp__thinkpool__${candidate}` || lower === `mcp_thinkpool_${candidate}`) || null
+  }
+
   async function onRequest(method, params, requestId) {
     if (method !== 'session/request_permission') throw Object.assign(new Error(`Unsupported ACP client method: ${method}`), { code: -32601 })
     const tool = hermesToolFor(params.toolCall || mapper?.tools.get(params.toolCallId) || {})
+    const peerTool = thinkpoolPeerTool(tool.name)
     const card = {
       id: `hermes-perm:${requestId}`,
-      toolName: tool.name,
+      toolName: peerTool ? `mcp__thinkpool__${peerTool}` : tool.name,
       input: tool.input,
-      risk: classifyRisk(tool.name, tool.input),
+      risk: peerTool?.startsWith('post_to_') ? 'high' : classifyRisk(tool.name, tool.input),
+    }
+    // ACP's native modes currently govern edit proposals only. ThinkPool's
+    // permission chip is the cross-runtime authority, so apply the same pure
+    // mode policy Claude uses before raising a durable room card. Structural
+    // role schemas still win: bypass can auto-allow a request, but it cannot
+    // restore a tool that the process-local Hermes policy never exposed.
+    // Match Claude/Codex peer semantics before the generic permission matrix.
+    // Paired-room reads are always read-only, including in Plan. Same-room posts
+    // honor bypass/ownership after their bridge gate. Cross-room posts always
+    // retain sender consent—even in bypass—because the target has a second card.
+    if (HERMES_PLAN_SAFE_MCP_TOOLS.includes(peerTool)) {
+      return { outcome: permissionOutcome('allow', params.options) }
+    }
+    if (peerTool === 'post_to_terminal') {
+      const gate = crossPostGate ? crossPostGate() : { ok: true }
+      if (!gate.ok) return { outcome: { outcome: 'cancelled' } }
+      const spawnedByMe = didSpawnTarget ? !!didSpawnTarget(tool.input?.terminal) : false
+      if (!crossPostNeedsCard({ mode: activeMode, spawnedByMe })) {
+        return { outcome: permissionOutcome('allow', params.options) }
+      }
+    }
+    if (peerTool === 'post_to_session') {
+      const gate = crossRoomPostGate ? crossRoomPostGate() : { ok: true }
+      if (!gate.ok) return { outcome: { outcome: 'cancelled' } }
+      let decision = 'deny'
+      try { decision = await requestPermission?.(card) } catch { /* fail closed */ }
+      return { outcome: permissionOutcome(decision, params.options) }
+    }
+    if (activeMode === 'plan') return { outcome: { outcome: 'cancelled' } }
+    if (autoAllow({ toolName: card.toolName, input: card.input, mode: activeMode })) {
+      return { outcome: permissionOutcome('allow', params.options) }
     }
     let decision = 'deny'
     try { decision = await requestPermission?.(card) } catch { /* fail closed */ }
@@ -103,13 +155,13 @@ export function startHermesSession({
   }
 
   async function probeMcpTools() {
-    const required = [...new Set((Array.isArray(requiredMcpTools) ? requiredMcpTools : [])
+    const required = [...new Set((Array.isArray(effectiveMcpTools()) ? effectiveMcpTools() : [])
       .map((name) => String(name || '').trim()).filter(Boolean))]
     // Direct runtime tests and unscoped upstream callers have no bridge role
     // contract to prove. Every bridge-created Hermes lane supplies its required
     // MCP list; only those lanes enter the exact-inventory transaction.
-    if (!required.length) return { inventory: '', missing: [], forbidden: [] }
-    const exact = hermesExactInventory(policyRole, { mcpTools: required })
+    if (!required.length && effectivePolicyRole() !== 'plan') return { inventory: '', missing: [], forbidden: [] }
+    const exact = hermesExactInventory(effectivePolicyRole(), { mcpTools: required })
     const allowedBuiltins = exact.builtinTools
     const requiredBuiltins = exact.requiredBuiltinTools
     const expectedMcp = exact.mcpTools
@@ -175,7 +227,7 @@ export function startHermesSession({
         // profile wrapper. HERMES_HOME is the probe-verified isolated profile.
         launchCommand = profile.python
         launchArgs = [profile.bootstrap]
-        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(policyRole, { mcpTools: requiredMcpTools }) }
+        childEnv = { ...childEnv, HERMES_HOME: profile.profile, THINKPOOL_HERMES_ACP_POLICY: hermesPolicyEnv(effectivePolicyRole(), { mcpTools: effectiveMcpTools() }) }
       }
       let retired = false
       retireClient = () => { retired = true }
@@ -271,9 +323,18 @@ export function startHermesSession({
       const publishedModels = state?.models
         ? { ...state.models, currentModelId: activeModel }
         : activeModel ? { currentModelId: activeModel, availableModels: [] } : state?.models
-      mapper.startSession({ sessionId, models: publishedModels, modes: state?.modes, commands: [] })
+      if (!suppressNextSessionPublish) {
+        mapper.startSession({ sessionId, models: publishedModels, modes: state?.modes, commands: [] })
+      } else {
+        // A Plan transition recreates only the ACP process so its tool schema
+        // can become structurally read-only. Keep the room transcript/catalog
+        // stable while the fresh mapper resumes the same native session.
+        mapper.sessionId = sessionId
+        mapper.model = activeModel
+        suppressNextSessionPublish = false
+      }
       started = true
-      const acpMode = activeMode === 'acceptEdits' ? 'accept_edits' : 'default'
+      const acpMode = acpModeFor(activeMode)
       if (state?.modes?.availableModes?.some((item) => item.id === acpMode) && state.modes.currentModeId !== acpMode) {
         await client.request('session/set_mode', { sessionId, modeId: acpMode })
       }
@@ -452,7 +513,33 @@ export function startHermesSession({
     },
     setMode(nextMode) {
       if (turnActive || !HERMES_SUPPORTED_MODES.has(nextMode)) return false
-      void boot().then(() => client.request('session/set_mode', { sessionId, modeId: nextMode === 'acceptEdits' ? 'accept_edits' : 'default' })).then(() => {
+      const priorMode = activeMode
+      const changesPolicySchema = (priorMode === 'plan') !== (nextMode === 'plan')
+      if (changesPolicySchema) {
+        // Plan is stronger than an approval preference: it removes terminal,
+        // process, write, patch, browser, and execution schemas. ACP modes alone
+        // cannot do that, so resume the exact native session in a fresh process
+        // under the bridge-owned read-only policy.
+        activeMode = nextMode
+        suppressNextSessionPublish = started
+        if (started) {
+          retireClient()
+          const oldClient = client
+          client = null
+          mapper = null
+          started = false
+          crashed = false
+          stderrTail = ''
+          oldClient?.end()
+        }
+        void boot().then(() => emit({ kind: 'mode', mode: activeMode })).catch((error) => {
+          activeMode = priorMode
+          suppressNextSessionPublish = false
+          emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true })
+        })
+        return true
+      }
+      void boot().then(() => client.request('session/set_mode', { sessionId, modeId: acpModeFor(nextMode) })).then(() => {
         activeMode = nextMode
         emit({ kind: 'mode', mode: activeMode })
       }).catch((error) => emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true }))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.253",
+  "version": "0.7.255",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/runtime-registry.mjs

@@ -14,7 +14,7 @@ const RUNTIMES = Object.freeze({
   hermes: Object.freeze({
     id: 'hermes', command: 'thinkpool', label: 'Hermes Agent', protocol: 'acp',
     structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: false, defaultMode: 'default',
-    modes: Object.freeze(['default', 'acceptEdits']),
+    modes: Object.freeze(['default', 'acceptEdits', 'plan', 'bypassPermissions']),
     beta: true,
   }),
 })