thinkpool-pair 0.7.266 → 0.7.268

package/bridge.mjs

@@ -53,7 +53,8 @@ import { z } from 'zod'
 import { readCodexDefaultModel, readCodexModels, codexConfigForMode, codexThreadCanResume } from './codex-session.mjs'
 import { withMcpSessionFactory } from './codex-mcp-http.mjs'
 import { startStructuredSession } from './runtime-session.mjs'
-import { defaultStructuredMode, shouldDeferStructuredRuntime, structuredRuntimeForCommand, structuredRuntimeMetadata, structuredRuntimeSupportsMode } from './runtime-registry.mjs'
+import { defaultStructuredMode, normalizeStructuredEffort, shouldDeferStructuredRuntime, structuredRuntimeForCommand, structuredRuntimeMetadata, structuredRuntimeSupportsMode } from './runtime-registry.mjs'
+import { reconcileCommandCatalog } from './command-catalog.mjs'
 import { probeHermesRuntime } from './hermes-probe.mjs'
 import { hermesRequiredMcpTools, hermesRoleFor } from './hermes-policy.mjs'
 import { canonicalRoomFilePath, waitForNativeImages } from './codex-images.mjs'
@@ -695,7 +696,10 @@ async function refreshOwnerPlan() {
 // unit-tested reap-terminal.mjs. Fire-and-forget from endStructured — the module never
 // throws (best-effort), so an unawaited promise can't reject.
 function reapTerminalRow(id) {
-  return _reapTerminalRow({ id, token: codeAuthToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown })
+  return _reapTerminalRow({
+    id, token: codeAuthToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown,
+    onFailure: ({ error, status }) => process.stderr.write(`\n  ⚠ terminal row reap failed (${String(id).slice(0, 8)}${status ? `, HTTP ${status}` : ''}): ${error || 'unknown error'}\n`),
+  })
 }
 // Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
 // serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
@@ -1770,7 +1774,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
   // spawnedBy: set when this lane was Dispatched (spawn_terminal). Restored from the
   // session store so the Ensemble flag survives a bridge restart (else a respin
   // stripped it and the lane reverted to a plain tab — the t6 "no chip" bug).
-  effort = new Set(['low', 'medium', 'high', 'xhigh', 'max']).has(effort) ? effort : 'high'
+  effort = normalizeStructuredEffort(runtime, effort)
   // Structural role is durable and independent of the per-turn hop breaker. A
   // human can speak into a spawned lane (resetting hop to 0) without magically
   // turning that lane into a top-level terminal. Legacy records predate
@@ -2756,6 +2760,17 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         announce()
         return
       }
+      // ACP replays its command catalog after resume/model reconstruction. A
+      // byte-identical catalog is chrome, not a new transcript fact.  Do not
+      // return here: this same system event is the lifecycle latch for warm,
+      // carried-recap, and interrupted-turn recovery.
+      const duplicateCommandCatalog = evt.kind === 'system'
+        ? reconcileCommandCatalog({
+          current: entry.commands,
+          incoming: evt.commands,
+          onChanged: (commands) => { entry.commands = commands; announce(); persist() },
+        })
+        : false
       // Self-heal a stale resume — the saved SDK session expired. Reopen fresh,
       // keeping the transcript (scrollback survives; live context is gone).
       if (resume && evt.kind === 'error') {
@@ -2860,6 +2875,11 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // openStructured). Chrome events bypass pushLog/persist in emitTail below, so
       // usage needs an explicit persist() here to survive a bridge restart.
       if (evt.kind === 'usage') { entry.lastUsage = evt; persist() }
+      if (evt.kind === 'effort') {
+        entry.effort = evt.effort ?? null
+        persist()
+        announce()
+      }
       // FL-B2 — fold this flow lane's completed-turn output tokens into its budget so the
       // autopilot cap can halt the next wave before overrun (output_tokens = the billed
       // reasoning+output spend the indicator already tracks; conservative enough for a guard).
@@ -2882,7 +2902,6 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // The init system event carries the session's slash command list. Stash it
       // on the entry so the ANNOUNCE can hand it to clients that connect/reload
       // AFTER init (the one-time code-event would miss them), then re-announce.
-      if (evt.kind === 'system' && Array.isArray(evt.commands) && evt.commands.length && !entry.commands) { entry.commands = evt.commands; announce(); persist() }
       // Auto-resume trigger (Max, 2026-07-02): the init `system` event means the SDK session
       // is LIVE (input stream now consumed). A restored mid-turn plain terminal flagged for
       // resume gets its single "continue" HERE — not on a blind timer that raced the ~40s
@@ -2934,7 +2953,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // card) and is intentionally NOT chrome, so it persists + replays.
       // 'suggestion' is Claude Code's predicted-next-prompt ghost text — ephemeral
       // composer UI, broadcast to both clients but never logged/persisted/replayed.
-      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled' || evt.kind === 'suggestion' || evt.kind === 'assistant_stream' || evt.kind === 'model-switch'
+      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'effort' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled' || evt.kind === 'suggestion' || evt.kind === 'assistant_stream' || evt.kind === 'model-switch'
       // The compact turn settled with `entry.compacting` STILL TRUE — which, because the
       // `compaction` branch above clears the flag the moment the milestone lands, means
       // exactly one thing: NO compaction happened. Three ways to get here, all of which
@@ -3029,6 +3048,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // print locally, persist. Shared so a deferred image event re-enters it once
       // its base64 has been lifted to a Storage path (see deferImageEvent).
       const emitTail = (e) => {
+        if (duplicateCommandCatalog) return
         if (!chrome) pushLog(entry, e)
         bcast('code-event', { term: id, evt: e })
         printLocal(e)

package/command-catalog.mjs

@@ -0,0 +1,10 @@
+// Command catalogs are session chrome, but their ACP system event is also the
+// lifecycle-ready signal.  Keep those two concerns separate so a reconstructed
+// identical catalog cannot swallow warm/recap/auto-resume work.
+export function reconcileCommandCatalog({ current, incoming, onChanged, onLifecycle } = {}) {
+  const hasIncoming = Array.isArray(incoming) && incoming.length > 0
+  const duplicate = hasIncoming && JSON.stringify(current || []) === JSON.stringify(incoming)
+  if (hasIncoming && !duplicate) onChanged?.(incoming)
+  onLifecycle?.({ duplicate, hasIncoming })
+  return duplicate
+}

package/hermes-acp-bootstrap.py

@@ -6,7 +6,9 @@ Hermes' installed venv interpreter and passes a validated role policy in env.
 """
 import json
 import os
+import re
 import sys
+from urllib.parse import urlsplit, urlunsplit
 
 POLICY_ENV = "THINKPOOL_HERMES_ACP_POLICY"
 
@@ -146,6 +148,202 @@ acp_adapter.session._expand_acp_enabled_toolsets = constrained_expand
 
 import acp_adapter.server
 
+# ThinkPool-only commands live in this process patch rather than in Hermes'
+# profile.  They are intentionally narrow: no identity, shared configuration,
+# account tokens, or lifecycle/admin controls enter the room surface.
+_TP_REASONING_CONFIG_ID = "thinkpool_reasoning_effort"
+_TP_REASONING_LEVELS = frozenset({"none", "low", "medium", "high", "xhigh", "max"})
+_TP_COMMANDS = (
+    {"name": "credits", "description": "Show safe Nous credit balance and top-up handoff"},
+    {"name": "status", "description": "Show session, model, context, version, and reasoning status"},
+    {"name": "reasoning", "description": "Set session-only reasoning effort", "input_hint": "low, medium, high, xhigh, max, none, or reset"},
+)
+
+_native_compact = getattr(acp_adapter.server.HermesACPAgent, "_cmd_compact", None)
+def thinkpool_compact(self, args, state):
+    """Run a genuine manual compact and never label an unchanged list success."""
+    if not state.history:
+        return "Nothing to compress — conversation is empty."
+    try:
+        agent = state.agent
+        if not getattr(agent, "compression_enabled", True):
+            return "Context compression is disabled for this agent."
+        if not hasattr(agent, "_compress_context"):
+            return "Context compression not available for this agent."
+        from agent.model_metadata import estimate_request_tokens_rough
+        original_history = state.history
+        original_count = len(original_history)
+        system_prompt = getattr(agent, "_cached_system_prompt", "") or ""
+        tools = getattr(agent, "tools", None) or None
+        original_tokens = estimate_request_tokens_rough(original_history, system_prompt=system_prompt, tools=tools)
+        original_session_db = getattr(agent, "_session_db", None)
+        try:
+            # ACP sessions keep one native identity. Manual compact must bypass
+            # an automatic-summary cooldown, matching Hermes' own documented
+            # `/compress` contract, while disabling session rotation here.
+            agent._session_db = None
+            compressed, _ = agent._compress_context(
+                original_history, system_prompt, approx_tokens=original_tokens,
+                task_id=state.session_id, force=True,
+            )
+        finally:
+            agent._session_db = original_session_db
+        if compressed is original_history:
+            return "Compression made no progress — context unchanged."
+        new_system_prompt = getattr(agent, "_cached_system_prompt", "") or system_prompt
+        new_tools = getattr(agent, "tools", None) or tools
+        new_tokens = estimate_request_tokens_rough(compressed, system_prompt=new_system_prompt, tools=new_tools)
+        # A shorter message list can still be a larger model request when the
+        # generated summary exceeds the discarded turns. That is not useful
+        # compaction. Restore the exact pre-attempt prompt/history and do not
+        # persist a boundary unless estimated request pressure actually falls.
+        if new_tokens >= original_tokens:
+            agent._cached_system_prompt = system_prompt
+            return (
+                "Compression made no progress — context unchanged "
+                f"(~{original_tokens:,} -> ~{new_tokens:,} estimated tokens)."
+            )
+        state.history = compressed
+        self.session_manager.save_session(state.session_id)
+        return (
+            f"Context compressed: {original_count} -> {len(compressed)} messages\n"
+            f"~{original_tokens:,} -> ~{new_tokens:,} tokens"
+        )
+    except Exception as error:
+        return f"Compression failed: {error}"
+if _native_compact: acp_adapter.server.HermesACPAgent._cmd_compact = thinkpool_compact
+
+def _reasoning_config(value):
+    value = str(value or "").strip().lower()
+    if value == "reset": return None
+    if value not in _TP_REASONING_LEVELS: raise ValueError("Usage: /reasoning [low|medium|high|xhigh|max|none|reset]")
+    return {"enabled": value != "none", **({"effort": value} if value != "none" else {})}
+
+def _apply_reasoning(state):
+    config = getattr(state, "reasoning_config", None)
+    # AIAgent consumes reasoning_config; setting it on the fresh process-local
+    # agent is the important part.  The state copy is carried across set_model.
+    state.agent.reasoning_config = dict(config) if isinstance(config, dict) else None
+    state.agent._reasoning_config = dict(config) if isinstance(config, dict) else None
+
+def _safe_topup_url(value):
+    try:
+        parsed = urlsplit(str(value or ""))
+        host = (parsed.hostname or "").lower()
+        if (parsed.scheme != "https" or host != "portal.nousresearch.com"
+                or parsed.username is not None or parsed.password is not None
+                or parsed.port not in {None, 443}):
+            return None
+        # Never relay account-derived paths, userinfo, query, fragment, or a
+        # provider-selected subdomain. Org-pinned paths identify the account;
+        # the generic billing page is the only safe room handoff.
+        return urlunsplit(("https", "portal.nousresearch.com", "/billing", "", ""))
+    except Exception:
+        return None
+
+def _credits_command():
+    try:
+        from agent.account_usage import build_credits_view
+        view = build_credits_view(markdown=True)
+    except Exception:
+        return "Credits are unavailable right now; no balance was inferred."
+    if view is None or not getattr(view, "logged_in", False):
+        return "Credits are unavailable because this Hermes account is not signed in."
+    lines = ["Nous credits"]
+    # Never echo provider-rendered lines whole. Reconstruct only the exact
+    # numeric balance shapes produced by Hermes' current account core; an
+    # otherwise-valid prefix with an identity/credential suffix must fail the
+    # full match rather than smuggling that suffix into the room transcript.
+    balance = re.compile(r"^(Subscription credits|Top-up credits|Total usable|Rollover):\s*\$([0-9][0-9,]*(?:\.[0-9]{2})?)$")
+    for line in list(getattr(view, "balance_lines", []) or []):
+        rendered = str(line).strip()
+        match = balance.fullmatch(rendered)
+        if match: lines.append(f"{match.group(1)}: ${match.group(2)}")
+    topup = _safe_topup_url(getattr(view, "topup_url", None))
+    if topup: lines.extend(["", "Top up: " + topup])
+    if len(lines) == 1: lines.append("Balance details are unavailable; no value was inferred.")
+    return "\n".join(lines)
+
+_available_commands = getattr(acp_adapter.server.HermesACPAgent, "_available_commands", None)
+@classmethod
+def thinkpool_available_commands(cls):
+    # Keep the upstream catalog canonical, then append exactly our process-local
+    # commands. This drives ACP updates and /help from one registry.
+    base = list(_available_commands.__func__(cls)) if _available_commands else []
+    try:
+        from acp.schema import AvailableCommand, UnstructuredCommandInput
+        known = {getattr(item, "name", "") for item in base}
+        for spec in _TP_COMMANDS:
+            if spec["name"] not in known:
+                hint = spec.get("input_hint")
+                base.append(AvailableCommand(name=spec["name"], description=spec["description"], input=UnstructuredCommandInput(hint=hint) if hint else None))
+    except Exception:
+        # In fixture/minimal ACP environments a dict still proves the registry
+        # behavior without making bootstrap startup fail.
+        base.extend(spec for spec in _TP_COMMANDS if spec["name"] not in {getattr(item, "name", item.get("name", "") if isinstance(item, dict) else "") for item in base})
+    return base
+if _available_commands: acp_adapter.server.HermesACPAgent._available_commands = thinkpool_available_commands
+
+_slash = getattr(acp_adapter.server.HermesACPAgent, "_handle_slash_command", None)
+def thinkpool_slash(self, text, state):
+    parts = str(text or "").split(maxsplit=1)
+    command = parts[0].lstrip("/").lower() if parts else ""
+    args = parts[1].strip() if len(parts) > 1 else ""
+    if command == "credits": return _credits_command()
+    if command == "reasoning":
+        if not args:
+            cfg = getattr(state, "reasoning_config", None)
+            level = "reset/default" if not cfg else ("none" if cfg.get("enabled") is False else cfg.get("effort", "medium"))
+            return "Session reasoning: " + level
+        try: state.reasoning_config = _reasoning_config(args)
+        except ValueError as error: return str(error)
+        _apply_reasoning(state)
+        self.session_manager.save_session(state.session_id)
+        return "Session reasoning " + ("reset to model default" if args.lower() == "reset" else "set to " + args.lower())
+    if command == "status":
+        context = self._cmd_context("", state)
+        model = self._cmd_model("", state)
+        version = self._cmd_version("", state)
+        cfg = getattr(state, "reasoning_config", None)
+        effort = "default" if not cfg else ("none" if cfg.get("enabled") is False else cfg.get("effort", "medium"))
+        return "\n".join([model, "Session: " + str(state.session_id), "Reasoning: " + effort, version, context])
+    return _slash(self, text, state) if _slash else None
+if _slash: acp_adapter.server.HermesACPAgent._handle_slash_command = thinkpool_slash
+
+_help = getattr(acp_adapter.server.HermesACPAgent, "_cmd_help", None)
+def thinkpool_help(self, args, state):
+    try:
+        lines = ["Available commands:", ""]
+        for item in self._available_commands():
+            name = getattr(item, "name", "")
+            description = getattr(item, "description", "")
+            if isinstance(item, dict): name, description = item.get("name", ""), item.get("description", "")
+            lines.append(f"  /{name:10s}  {description}")
+        return "\n".join(lines)
+    except Exception:
+        return _help(self, args, state) if _help else "Available commands unavailable."
+if _help: acp_adapter.server.HermesACPAgent._cmd_help = thinkpool_help
+
+_set_config = getattr(acp_adapter.server.HermesACPAgent, "set_config_option", None)
+async def thinkpool_set_config(self, config_id, session_id, value, **kwargs):
+    if str(config_id) != _TP_REASONING_CONFIG_ID:
+        return await _set_config(self, config_id, session_id, value, **kwargs) if _set_config else None
+    state = self.session_manager.get_session(session_id)
+    if state is None: return None
+    try: state.reasoning_config = _reasoning_config(value)
+    except ValueError: return None
+    _apply_reasoning(state)
+    self.session_manager.save_session(session_id)
+    try:
+        from acp.schema import SetSessionConfigOptionResponse
+        return SetSessionConfigOptionResponse(config_options=[])
+    except Exception:
+        # Minimal fixture/older ACP environments still need a JSON-serializable
+        # response; a bare object wedges the JSON-RPC encoder after the config
+        # was already applied and makes the bridge time out dishonestly.
+        return {"configOptions": []}
+acp_adapter.server.HermesACPAgent.set_config_option = thinkpool_set_config
+
 # Hermes 0.18.2 emits the real result through ``tool.completed`` immediately,
 # but its ACP callback ignores that event and waits for the next model-step
 # summary.  Parallel Read/search calls are not always present in that summary,
@@ -205,6 +403,7 @@ async def constrained_register(self, state, mcp_servers):
         # a subsequent set_model reconstruction can re-register the same MCP.
         state._thinkpool_mcp_servers = tuple(mcp_servers)
     await _register(self, state, mcp_servers)
+    _apply_reasoning(state)
     assert_exact_inventory(state.agent)
 acp_adapter.server.HermesACPAgent._register_session_mcp_servers = constrained_register
 
@@ -226,6 +425,7 @@ async def constrained_set_model(self, model_id, session_id, **kwargs):
         if MCP_TOOLS and not servers:
             raise RuntimeError("ThinkPool MCP registration is unavailable after model switch")
         await constrained_register(self, state, list(servers))
+        _apply_reasoning(state)
         assert_exact_inventory(state.agent)
         self.session_manager.save_session(session_id)
         return result

package/hermes-event-mapper.mjs

@@ -112,7 +112,18 @@ export class HermesEventMapper {
         return
       }
       case 'available_commands_update':
-        this._emit({ kind: 'system', sessionId: this.sessionId, model: this.model, commands: (update.availableCommands || []).map((command) => `/${command.name}`) })
+        // ACP commands carry useful UI metadata.  Keep strings accepted for
+        // older runtimes, but never flatten a native catalog on the way out.
+        this._emit({ kind: 'system', sessionId: this.sessionId, model: this.model, commands: (update.availableCommands || []).map((command) => {
+          if (typeof command === 'string') return command.startsWith('/') ? command : `/${command}`
+          const name = String(command?.name || '').replace(/^\/+/, '')
+          const hint = command?.input?.hint || command?.inputHint || command?.input_hint || ''
+          return {
+            name: `/${name}`,
+            description: String(command?.description || ''),
+            ...(hint ? { inputHint: String(hint) } : {}),
+          }
+        }).filter((command) => typeof command === 'string' ? command !== '/' : command.name !== '/') })
         return
       case 'current_mode_update':
         this._emit({ kind: 'mode', mode: update.currentModeId })
@@ -160,4 +171,17 @@ export class HermesEventMapper {
     this.thought = ''
     this.textCid = null
   }
+
+  compactOutcome() {
+    // /compact is handled locally by Hermes and its response is the only
+    // authoritative success signal.  Do not infer a reset from a successful
+    // ACP envelope: no-op and failure also return end_turn.
+    const text = String(this.text || '')
+    const hit = text.match(/Context compressed:\s*(\d+)\s*->\s*(\d+)\s*messages[\s\S]*?~?([\d,]+)\s*->\s*~?([\d,]+)\s*tokens/i)
+    if (!hit) return null
+    return {
+      preMessages: Number(hit[1]), postMessages: Number(hit[2]),
+      preTokens: Number(hit[3].replace(/,/g, '')), postTokens: Number(hit[4].replace(/,/g, '')),
+    }
+  }
 }

package/hermes-session.mjs

@@ -15,6 +15,8 @@ import { buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoo
 export const HERMES_COMMAND = 'thinkpool'
 export const HERMES_ACP_PROTOCOL_VERSION = 1
 export const HERMES_SUPPORTED_MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
+export const HERMES_EFFORT_LEVELS = new Set(['none', 'low', 'medium', 'high', 'xhigh', 'max'])
+export const HERMES_EFFORT_CONFIG_ID = 'thinkpool_reasoning_effort'
 const HERMES_INITIALIZE_TIMEOUT_MS = 15_000
 const PLAN_SAFE_MCP_TOOLS = new Set([...HERMES_PLAN_SAFE_MCP_TOOLS, 'read_review_file'])
 
@@ -64,7 +66,7 @@ export function startHermesSession({
   roomContext, terminalRolePrompt, rolePrompt, mcpServers, requiredMcpTools = [], prepareCwd = null,
   command = HERMES_COMMAND, args = ['acp'], clientFactory = createAcpClient,
   mcpHttpFactory = startCodexMcpHttp, lazy = false, hermesRole = null,
-  crossPostGate = null, didSpawnTarget = null, crossRoomPostGate = null,
+  crossPostGate = null, didSpawnTarget = null, crossRoomPostGate = null, effort = 'high',
 } = {}) {
   let activeCwd = cwd
   const requestedModel = model || null
@@ -93,6 +95,10 @@ export function startHermesSession({
   let modelSwitchPending = false
   let bootCancelled = false
   let suppressNextSessionPublish = false
+  let activeEffort = effort === null ? null : (HERMES_EFFORT_LEVELS.has(effort) ? effort : 'high')
+  const queuedTurns = []
+  let drainingQueuedTurns = false
+  let queueDrainPending = false
   const policyRole = hermesRole || hermesRoleFor({})
 
   const effectivePolicyRole = () => activeMode === 'plan' ? 'plan' : policyRole
@@ -170,8 +176,12 @@ export function startHermesSession({
     if (inventoryProbe) {
       if (update?.sessionUpdate === 'agent_message_chunk' && update?.content?.type === 'text') {
         inventoryProbe.push(String(update.content.text || ''))
+        return
       }
-      return
+      // `/tools` is a local readiness transaction, but Hermes can publish its
+      // command catalog (and other session chrome) concurrently with that
+      // response. Suppress only the probe's assistant text; dropping every
+      // notification here made the real native catalog disappear permanently.
     }
     if (resuming && HERMES_REPLAY_UPDATES.has(update?.sessionUpdate)) return
     mapper?.push(params)
@@ -343,6 +353,10 @@ export function startHermesSession({
         await client.request('session/set_model', { sessionId, modelId: activeModel })
         await assertMcpReadiness()
       }
+      // The bootstrap owns this config id and applies it to the process-local
+      // agent.  Send it on new, resume and reconstructed sessions; it never
+      // touches Hermes' shared profile/config.yaml.
+      if (activeEffort) await client.request('session/set_config_option', { sessionId, configId: HERMES_EFFORT_CONFIG_ID, value: activeEffort })
       const publishedModels = state?.models
         ? { ...state.models, currentModelId: activeModel }
         : activeModel ? { currentModelId: activeModel, availableModels: [] } : state?.models
@@ -452,11 +466,45 @@ export function startHermesSession({
       if (abortedTurns.has(turnId)) return result
       turnActive = false
       firstTurn = false
+      const compact = /^\s*\/compact\b/i.test(String(text || '')) ? mapper.compactOutcome() : null
+      if (compact) emit({ kind: 'compaction', trigger: 'manual', ...compact })
+      const reasoning = String(text || '').match(/^\s*\/reasoning\s+(low|medium|high|xhigh|max|none|reset)\s*$/i)
+      if (reasoning) {
+        const requested = reasoning[1].toLowerCase()
+        const confirmed = requested === 'reset'
+          ? /Session reasoning reset to model default/i.test(mapper.text)
+          : new RegExp(`Session reasoning set to ${requested}`, 'i').test(mapper.text)
+        if (confirmed) {
+          activeEffort = requested === 'reset' ? null : requested
+          emit({ kind: 'effort', effort: activeEffort })
+        }
+      }
+      // Reserve the idle-looking result boundary for the existing FIFO before
+      // publishing it. An onEvent consumer can synchronously submit a new turn
+      // from the result callback; without this latch that turn starts ahead of
+      // already-queued work and violates /queue order.
+      queueDrainPending = queuedTurns.length > 0 && !ended && !abortedTurns.has(turnId)
       mapper.finishTurn({ stopReason: result?.stopReason, usage: result?.usage })
+      if (queueDrainPending) void drainQueuedTurns()
     }
     return result
   }
 
+  async function drainQueuedTurns() {
+    if (drainingQueuedTurns || ended || turnActive) return
+    drainingQueuedTurns = true
+    try {
+      while (queuedTurns.length && !ended && !turnActive) {
+        queueDrainPending = false
+        const next = queuedTurns.shift()
+        const turnId = ++activeTurnId
+        turnActive = true
+        try { await runPrompt(next.text, next.options, { steering: false, turnId, promptIndex: next.promptIndex, forceFull: next.forceFull }) }
+        catch (error) { turnActive = false; emit({ kind: 'error', message: `Hermes queued turn failed: ${error?.message || error}`, recoverable: true }) }
+      }
+    } finally { drainingQueuedTurns = false; queueDrainPending = false }
+  }
+
   if (!lazy) queueMicrotask(() => { void boot().catch(() => {}) })
 
   return {
@@ -465,6 +513,7 @@ export function startHermesSession({
     get canSteer() { return !!client?.alive },
     get started() { return started },
     get models() { return [] },
+    get effort() { return activeEffort },
     sendTurn(text, options = {}) {
       if (ended) return false
       const promptIndex = userPromptNo++
@@ -474,8 +523,22 @@ export function startHermesSession({
       // authority to launch a fresh ACP process and resume the same native
       // session id; this is the recovery path the old permanent latch blocked.
       reviveAfterExplicitRetry()
+      const queued = String(text || '').match(/^\s*\/queue\s+([\s\S]+)$/i)
+      // A result callback may arrive after turnActive fell but before the FIFO
+      // drain claimed the next queued item. Keep any new human turn behind the
+      // already-visible queue instead of letting that micro-window reorder it.
+      if (queueDrainPending) {
+        queuedTurns.push({ text: queued ? queued[1] : String(text || ''), options, promptIndex, forceFull: thisTurnForceFull })
+        emit({ kind: 'queue-add', queued: true, depth: queuedTurns.length })
+        return true
+      }
       // A busy prompt is a genuine ACP /steer call and may run concurrently.
       if (turnActive) {
+        if (queued) {
+          queuedTurns.push({ text: queued[1], options, promptIndex, forceFull: thisTurnForceFull })
+          emit({ kind: 'queue-add', queued: true, depth: queuedTurns.length })
+          return true
+        }
         const turnId = activeTurnId
         void runPrompt(text, options, { steering: true, turnId, promptIndex, forceFull: thisTurnForceFull }).catch((error) => emit({ kind: 'error', message: `Hermes steering failed: ${error?.message || error}`, recoverable: true }))
         return true
@@ -492,6 +555,8 @@ export function startHermesSession({
     },
     abort() {
       if (!turnActive) return
+      queuedTurns.length = 0
+      queueDrainPending = false
       const turnId = activeTurnId
       abortedTurns.add(turnId)
       // Bound retained turn ids while preserving any concurrent /steer request
@@ -523,6 +588,8 @@ export function startHermesSession({
     end() {
       ended = true
       turnActive = false
+      queuedTurns.length = 0
+      queueDrainPending = false
       if (sessionId && client?.alive) void client.request('session/close', { sessionId }, 1500).catch(() => {}).finally(() => client?.end())
       else client?.end()
       void mcpHttp?.close().catch(() => {})
@@ -578,7 +645,15 @@ export function startHermesSession({
       }).catch((error) => emit({ kind: 'error', message: `Hermes mode switch failed: ${error?.message || error}`, recoverable: true }))
       return true
     },
-    setEffort() { return false },
+    setEffort(nextEffort) {
+      if (turnActive || !HERMES_EFFORT_LEVELS.has(nextEffort)) return false
+      const requested = String(nextEffort)
+      void boot().then(() => client.request('session/set_config_option', { sessionId, configId: HERMES_EFFORT_CONFIG_ID, value: requested })).then(() => {
+        activeEffort = requested
+        emit({ kind: 'effort', effort: activeEffort })
+      }).catch((error) => emit({ kind: 'error', message: `Hermes reasoning change failed: ${error?.message || error}`, recoverable: true }))
+      return true
+    },
     clearContext() {
       if (turnActive) return false
       return this.sendTurn('/reset')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.266",
+  "version": "0.7.268",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -35,6 +35,7 @@
     "hermes-isolation.mjs",
     "hermes-delegation-guard.mjs",
     "runtime-registry.mjs",
+    "command-catalog.mjs",
     "runtime-session.mjs",
     "turn-stall.mjs",
     "update-gate.mjs",

package/reap-terminal.mjs

@@ -24,10 +24,14 @@
 // the feature, not the leak.
 
 /**
- * @returns {Promise<{reaped: boolean, reason: 'ok'|'shutdown'|'anon'|'no-id'|'error', error?: string}>}
+ * @returns {Promise<{reaped: boolean, reason: 'ok'|'shutdown'|'anon'|'no-id'|'error', error?: string, status?: number}>}
  *   Never throws — best-effort; the client reap (#205) is the fallback.
  */
-export async function reapTerminalRow ({ id, token, supabaseUrl, anonKey, shuttingDown = false, fetchImpl = fetch }) {
+export async function reapTerminalRow ({ id, token, supabaseUrl, anonKey, shuttingDown = false, fetchImpl = fetch, onFailure } = {}) {
+  const fail = (outcome) => {
+    try { onFailure?.(outcome) } catch { /* observability must not break a close */ }
+    return outcome
+  }
   if (shuttingDown) return { reaped: false, reason: 'shutdown' }
   if (!token)       return { reaped: false, reason: 'anon' }
   if (!id)          return { reaped: false, reason: 'no-id' }
@@ -36,12 +40,22 @@ export async function reapTerminalRow ({ id, token, supabaseUrl, anonKey, shutti
     // terminal id IS the code_terminals PK (client/bridge-minted uuid). RLS scopes the
     // delete to this bridge's sessions, so id alone is sufficient + idempotent (a fast
     // client tab may have reaped first — 204 / 0 rows is fine).
-    await fetchImpl(`${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}`, {
+    const response = await fetchImpl(`${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}`, {
       method: 'DELETE',
       headers: { apikey: anonKey, Authorization: `Bearer ${token}` },
     })
+    // fetch resolves for HTTP failures. A 401/500 did not reap the row and must
+    // stay visible to the fire-and-forget caller as a failed best-effort cleanup.
+    if (!response?.ok) {
+      return fail({
+        reaped: false,
+        reason: 'error',
+        error: `HTTP ${response?.status ?? 'unknown'}${response?.statusText ? ` ${response.statusText}` : ''}`,
+        status: response?.status,
+      })
+    }
     return { reaped: true, reason: 'ok' }
   } catch (e) {
-    return { reaped: false, reason: 'error', error: e?.message }
+    return fail({ reaped: false, reason: 'error', error: e?.message })
   }
 }

package/runtime-registry.mjs

@@ -13,7 +13,7 @@ const RUNTIMES = Object.freeze({
   }),
   hermes: Object.freeze({
     id: 'hermes', command: 'thinkpool', label: 'Hermes Agent', protocol: 'acp',
-    structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: false, defaultMode: 'default',
+    structured: true, flow: true, canSteer: true, images: true, nativeModelCatalog: true, catalogRequiresSession: true, effortControl: true, defaultMode: 'default',
     modes: Object.freeze(['default', 'acceptEdits', 'plan', 'bypassPermissions']),
     beta: true,
   }),
@@ -28,6 +28,12 @@ export const structuredRuntimeForCommand = (command) => {
 export const defaultStructuredMode = (runtime) => structuredRuntimeMetadata(runtime)?.defaultMode || 'default'
 export const structuredRuntimeSupportsMode = (runtime, mode) => structuredRuntimeMetadata(runtime)?.modes?.includes(mode) === true
 export const structuredRuntimeSupportsFlow = (runtime) => structuredRuntimeMetadata(runtime)?.flow === true
+const STRUCTURED_EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max'])
+export const normalizeStructuredEffort = (runtime, effort) => {
+  if (effort === null) return null
+  if (runtime === 'hermes' && effort === 'none') return 'none'
+  return STRUCTURED_EFFORTS.has(effort) ? effort : 'high'
+}
 export const shouldDeferStructuredRuntime = ({ runtime, defer, cwd, flowSessionId, flowTaskKey, models } = {}) => {
   const metadata = structuredRuntimeMetadata(runtime)
   // Some ACP agents publish their model catalog only from session/new or