thinkpool-pair 0.7.254 → 0.7.255

package/bridge.mjs

@@ -2141,7 +2141,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // (reset per human turn alongside the in-room budgets) + TP_CROSSROOM_OFF kill-switch.
       tool(
         'list_sessions',
-        'List your OTHER ThinkPool Code sessions (rooms) open on this machine — beyond this one. Returns each room\'s code and name so you can read into one with read_session. This is Thinkpool Ensemble across SESSIONS, not just terminals: it lets you see and pick up work in your other rooms. Read-only.',
+        'List OTHER ThinkPool Code sessions (rooms) reachable from this room: your own rooms on this machine plus your partner\'s shared rooms over the pair bus. Returns each room\'s code, name, and partner host when remote so you can read into one with read_session. This is Thinkpool Ensemble across SESSIONS, not just terminals. Read-only.',
         {},
         async () => {
           const okText = (t) => ({ content: [{ type: 'text', text: t }] })
@@ -2153,7 +2153,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       ),
       tool(
         'read_session',
-        'Read-only view INTO another of your ThinkPool Code sessions on this machine (a room code from list_sessions). Pass `session` (the room code) and optionally `terminal` (a ref/name in that room) to read its recent activity; omit `terminal` to list that room\'s terminals. It never changes the other session — reading only. Use it to check on or pick up work running in a sibling session.',
+        'Read-only view INTO another ThinkPool Code session returned by list_sessions—either your own room on this machine or your partner\'s shared room over the pair bus. Pass `session` (the room code) and optionally `terminal` (a ref/name in that room) to read its recent activity; omit `terminal` to list that room\'s terminals. It never changes the other session.',
         {
           session: z.string().describe('the room code of the other session (from list_sessions)'),
           terminal: z.string().optional().describe('ref, id, or name of a terminal in that room; omit to list that room\'s terminals'),

package/cross-terminal.mjs

@@ -606,6 +606,26 @@ export const CROSSROOM = {
   peekPerTurnCap: 5,   // list_sessions + read_session calls allowed per turn (vs PEEK.perTurnCap=10 in-room)
 }
 
+// Canonical ThinkPool peer capability names. Claude/Codex receive the SDK MCP
+// server directly; Hermes reconstructs a process-local schema and therefore
+// needs the same names explicitly. Keep the peer surface here beside its gates
+// so a runtime cannot silently lose cross-room reach when the server grows.
+export const PEER_READ_MCP_TOOLS = Object.freeze([
+  'read_terminal',
+  'list_sessions',
+  'read_session',
+])
+
+export const PEER_POST_MCP_TOOLS = Object.freeze([
+  'post_to_terminal',
+  'post_to_session',
+])
+
+export const PEER_MCP_TOOLS = Object.freeze([
+  ...PEER_READ_MCP_TOOLS,
+  ...PEER_POST_MCP_TOOLS,
+])
+
 // Render the list_sessions roster from the supervisor's room list. `rooms` is
 // [{ code, name }]; `thisRoom` is excluded defensively (the supervisor already
 // drops it). Mirrors formatPeek's no-arg roster shape so the agent reads one voice.

package/hermes-policy.mjs

@@ -1,5 +1,7 @@
 // Bridge-owned Hermes ACP schema policy. This is intentionally a small, pure
 // contract: Python receives only this JSON and fails closed for anything else.
+import { PEER_MCP_TOOLS, PEER_READ_MCP_TOOLS } from './cross-terminal.mjs'
+
 export const HERMES_POLICY_VERSION = 1
 
 export const CODING_TOOLS = Object.freeze([
@@ -20,7 +22,7 @@ export const ESSENTIAL_CODING_TOOLS = Object.freeze([
   'terminal', 'process', 'read_file', 'write_file', 'patch', 'search_files',
 ])
 const ROLE_REQUIRED = Object.freeze({
-  ordinary: ['read_terminal', 'spawn_terminal', 'close_terminal'],
+  ordinary: [...PEER_MCP_TOOLS, 'spawn_terminal', 'close_terminal'],
   plan: [],
   conductor: ['submit_flow_plan'],
   builder: ['mark_flow_done'],
@@ -43,7 +45,7 @@ export function hermesPolicyForRole(role, { mcpTools } = {}) {
   // Ordinary worker leaves deliberately lack spawn/close. Main-lane proof is
   // enforced by requiredMcpTools at dispatch; keep this schema usable for a
   // non-delegating ordinary child without widening it.
-  const minimum = role === 'ordinary' ? ['read_terminal'] : required
+  const minimum = role === 'ordinary' ? PEER_MCP_TOOLS : required
   for (const tool of minimum) if (!supplied.includes(tool)) throw new Error(`Hermes ${role} policy is missing required ThinkPool tool ${tool}`)
   const restricted = role === 'plan' || role === 'conductor' || role === 'reviewer' || role === 'manual-review'
   const builtinTools = restricted ? READ_ONLY_TOOLS : CODING_TOOLS
@@ -61,10 +63,12 @@ export function hermesPolicyForRole(role, { mcpTools } = {}) {
 }
 
 export function hermesRequiredMcpTools(role, { canSpawnWorkers = false } = {}) {
-  if (role === 'ordinary') return ['read_terminal', ...(canSpawnWorkers ? ['spawn_terminal', 'close_terminal'] : [])]
+  if (role === 'ordinary') return [...PEER_MCP_TOOLS, ...(canSpawnWorkers ? ['spawn_terminal', 'close_terminal'] : [])]
   return [...ROLE_REQUIRED[role]]
 }
 
+export const HERMES_PLAN_SAFE_MCP_TOOLS = PEER_READ_MCP_TOOLS
+
 // Keep the bridge's local /tools proof on the same canonical inventory as the
 // process-local Python bootstrap.  `allBuiltinTools` lets that proof reject a
 // known built-in which is not part of this role, rather than merely looking

package/hermes-session.mjs

@@ -6,15 +6,16 @@ import { randomUUID } from 'node:crypto'
 import { AcpClient } from './acp-client.mjs'
 import { HermesEventMapper, hermesToolFor } from './hermes-event-mapper.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
-import { hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
+import { HERMES_PLAN_SAFE_MCP_TOOLS, hermesExactInventory, hermesPolicyEnv, hermesRoleFor } from './hermes-policy.mjs'
 import { startCodexMcpHttp } from './codex-mcp-http.mjs'
 import { autoAllow, classifyRisk } from './claude-session.mjs'
+import { crossPostNeedsCard } from './cross-terminal.mjs'
 
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
 export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
 const HERMES_INITIALIZE_TIMEOUT_MS = 15_000
-const PLAN_SAFE_MCP_TOOLS = new Set(['read_terminal', 'read_review_file'])
+const PLAN_SAFE_MCP_TOOLS = new Set([...HERMES_PLAN_SAFE_MCP_TOOLS, 'read_review_file'])
 
 const HERMES_SECRET_ENV_KEY = /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|ACCESS_KEY|CREDENTIAL)/i
 const HERMES_REPLAY_UPDATES = new Set(['agent_message_chunk', 'agent_thought_chunk', 'tool_call', 'tool_call_update', 'plan'])
@@ -48,6 +49,7 @@ export function startHermesSession({
   roomContext, terminalRolePrompt, rolePrompt, mcpServers, requiredMcpTools = [], prepareCwd = null,
   command = HERMES_COMMAND, args = ['acp'], clientFactory = createAcpClient,
   mcpHttpFactory = startCodexMcpHttp, lazy = false, hermesRole = null,
+  crossPostGate = null, didSpawnTarget = null, crossRoomPostGate = null,
 } = {}) {
   let activeCwd = cwd
   const requestedModel = model || null
@@ -87,20 +89,49 @@ export function startHermesSession({
 
   const emit = (event) => { try { onEvent?.(event) } catch { /* consumer isolation */ } }
 
+  const thinkpoolPeerTool = (name) => {
+    const lower = String(name || '').toLowerCase()
+    return [...HERMES_PLAN_SAFE_MCP_TOOLS, 'post_to_terminal', 'post_to_session']
+      .find((candidate) => lower === candidate || lower === `mcp__thinkpool__${candidate}` || lower === `mcp_thinkpool_${candidate}`) || null
+  }
+
   async function onRequest(method, params, requestId) {
     if (method !== 'session/request_permission') throw Object.assign(new Error(`Unsupported ACP client method: ${method}`), { code: -32601 })
     const tool = hermesToolFor(params.toolCall || mapper?.tools.get(params.toolCallId) || {})
+    const peerTool = thinkpoolPeerTool(tool.name)
     const card = {
       id: `hermes-perm:${requestId}`,
-      toolName: tool.name,
+      toolName: peerTool ? `mcp__thinkpool__${peerTool}` : tool.name,
       input: tool.input,
-      risk: classifyRisk(tool.name, tool.input),
+      risk: peerTool?.startsWith('post_to_') ? 'high' : classifyRisk(tool.name, tool.input),
     }
     // ACP's native modes currently govern edit proposals only. ThinkPool's
     // permission chip is the cross-runtime authority, so apply the same pure
     // mode policy Claude uses before raising a durable room card. Structural
     // role schemas still win: bypass can auto-allow a request, but it cannot
     // restore a tool that the process-local Hermes policy never exposed.
+    // Match Claude/Codex peer semantics before the generic permission matrix.
+    // Paired-room reads are always read-only, including in Plan. Same-room posts
+    // honor bypass/ownership after their bridge gate. Cross-room posts always
+    // retain sender consent—even in bypass—because the target has a second card.
+    if (HERMES_PLAN_SAFE_MCP_TOOLS.includes(peerTool)) {
+      return { outcome: permissionOutcome('allow', params.options) }
+    }
+    if (peerTool === 'post_to_terminal') {
+      const gate = crossPostGate ? crossPostGate() : { ok: true }
+      if (!gate.ok) return { outcome: { outcome: 'cancelled' } }
+      const spawnedByMe = didSpawnTarget ? !!didSpawnTarget(tool.input?.terminal) : false
+      if (!crossPostNeedsCard({ mode: activeMode, spawnedByMe })) {
+        return { outcome: permissionOutcome('allow', params.options) }
+      }
+    }
+    if (peerTool === 'post_to_session') {
+      const gate = crossRoomPostGate ? crossRoomPostGate() : { ok: true }
+      if (!gate.ok) return { outcome: { outcome: 'cancelled' } }
+      let decision = 'deny'
+      try { decision = await requestPermission?.(card) } catch { /* fail closed */ }
+      return { outcome: permissionOutcome(decision, params.options) }
+    }
     if (activeMode === 'plan') return { outcome: { outcome: 'cancelled' } }
     if (autoAllow({ toolName: card.toolName, input: card.input, mode: activeMode })) {
       return { outcome: permissionOutcome('allow', params.options) }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.254",
+  "version": "0.7.255",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {