thinkpool-pair 0.7.276 → 0.7.278

package/bridge.mjs

@@ -3124,8 +3124,8 @@ function pendingResolution(pending, payload = {}) {
   const decision = payload.decision || 'deny'
   return pending?.payload?.answerFormat === 'dispatch'
     ? { decision, dispatchFingerprint: payload.dispatchFingerprint || null, controlItemId: payload.controlItemId || null }
-    : (pending?.payload?.answerFormat === 'codex' || pending?.payload?.answerFormat === 'hermes')
-    ? { decision, answers: payload.answers || {} }
+    : (pending?.payload?.risk === 'ask' || pending?.payload?.answerFormat === 'codex' || pending?.payload?.answerFormat === 'hermes')
+    ? { decision, answers: payload.answers || {}, responder: payload.responder || null }
     : decision
 }
 
@@ -3946,7 +3946,7 @@ channel
       if (p.timer) clearTimeout(p.timer)
       s.pending.delete(payload.id)
       s.permNotifier?.resolve(payload.id)
-      p.resolve(pendingResolution(p, { ...payload, decision: authority.decision, answers: authority.answers }))
+      p.resolve(pendingResolution(p, { ...payload, decision: authority.decision, answers: authority.answers, responder: authority.responder }))
       announce()
     })
   })

package/claude-session.mjs

@@ -99,18 +99,25 @@ export function autoAllow({ toolName, input, mode = 'default', alwaysAllow = new
 // denies (PreToolUse can't inject a tool_result) and puts the human's pick in
 // the deny reason, which IS what the model receives. Exported so the feedback
 // contract is locked in a unit test (mock requestPermission → this output).
-// `decision` is the requestPermission return: 'answer:<pick>' when the person
-// selected, anything else (including '' / dismissal / a broken path) is treated
-// as "no selection".
+// `decision` is the requestPermission return: either the legacy 'answer:<pick>'
+// string or { decision, responder } from the durable room control. Anything else
+// (including '' / dismissal / a broken path) is treated as "no selection".
 export function askUserQuestionHookOutput(decision) {
-  const ans = (typeof decision === 'string' && decision.startsWith('answer:')) ? decision.slice(7) : ''
+  const rawDecision = decision && typeof decision === 'object' ? decision.decision : decision
+  const ans = (typeof rawDecision === 'string' && rawDecision.startsWith('answer:')) ? rawDecision.slice(7) : ''
+  const responder = decision && typeof decision === 'object' ? decision.responder : null
+  const answeredBy = typeof responder?.name === 'string' && responder.name.trim()
+    ? responder.name.trim()
+    : typeof responder?.id === 'string' && responder.id
+      ? `room member ${responder.id}`
+      : 'The user'
   return {
     continue: true,
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
       permissionDecision: 'deny',
       permissionDecisionReason: ans
-        ? `The user answered in the ThinkPool room — ${ans}. Treat this as their selection and continue; do not call AskUserQuestion again for the same question.`
+        ? `${answeredBy} answered in the ThinkPool room — ${ans}. Treat this as their selection and continue; do not call AskUserQuestion again for the same question.`
         : 'The user dismissed the question in the ThinkPool room without selecting. Ask in plain prose, or proceed with a sensible default.',
     },
   }

package/codex-session.mjs

@@ -267,7 +267,16 @@ export function buildCodexExecArgs({ sessionId, model, effort, sandbox, approval
   // Both fresh `exec` and `exec resume` accept repeatable --image flags. Only
   // bridge-derived absolute paths reach this layer; relative values are ignored
   // so a future caller cannot silently change the child's path interpretation.
-  for (const imagePath of images) if (path.isAbsolute(String(imagePath || ''))) args.push('--image', String(imagePath))
+  let hasNativeImages = false
+  for (const imagePath of images) {
+    if (!path.isAbsolute(String(imagePath || ''))) continue
+    args.push('--image', String(imagePath))
+    hasNativeImages = true
+  }
+  // Codex CLI 0.144.1 defines --image as a variadic option. Without an option
+  // terminator it consumes the positional prompt (and, on resume, the thread
+  // id), then exits because stdin is intentionally /dev/null in the bridge.
+  if (hasNativeImages) args.push('--')
   if (sessionId) args.push(sessionId)
   args.push(String(prompt ?? ''))
   return args

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.276",
+  "version": "0.7.278",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/pair-control-authority.mjs

@@ -34,6 +34,15 @@ export function verifyPairControlDeliveryAuthority ({ item, attempts, payload, r
     event?.actor_id === item.resolved_by && Number(event.item_version) === Number(item.version) &&
     event.correlation_key === payload.attemptKey && event.payload?.data?.transport === 'code-perm') : []
   if (matching.length !== 1) return denied('delivery_attempt_unverified')
+  const durableResponder = resolution.responder
+  const responder = durableResponder && durableResponder.id === item.resolved_by
+    ? {
+        id: item.resolved_by,
+        name: typeof durableResponder.name === 'string' && durableResponder.name.trim()
+          ? durableResponder.name.trim().slice(0, 120)
+          : null,
+      }
+    : { id: item.resolved_by, name: null }
   return Object.freeze({
     ok: true,
     code: 'durable_delivery_authorized',
@@ -41,6 +50,7 @@ export function verifyPairControlDeliveryAuthority ({ item, attempts, payload, r
     // App Server input is recovered from the durable resolution only. The public
     // broadcast intentionally remains a wake-up hint and cannot supply answers.
     answers: resolution.answers && typeof resolution.answers === 'object' ? resolution.answers : {},
+    responder: Object.freeze(responder),
     itemId: item.id,
     version: Number(item.version),
     attemptKey: payload.attemptKey,

package/question-response.mjs

@@ -38,9 +38,15 @@ export function questionAnswerResponse (result, questions = []) {
       if (values.length) answers[String(id)] = { answers: values }
     }
   }
-  if (Object.keys(answers).length) return { answers }
+  const responder = result?.responder && typeof result.responder === 'object'
+    ? {
+        id: typeof result.responder.id === 'string' ? result.responder.id : null,
+        name: typeof result.responder.name === 'string' ? result.responder.name : null,
+      }
+    : null
+  if (Object.keys(answers).length) return { answers, ...(responder ? { responder } : {}) }
   const decision = result && typeof result === 'object' ? result.decision : result
-  return { answers: legacyQuestionAnswers(decision, questions) }
+  return { answers: legacyQuestionAnswers(decision, questions), ...(responder ? { responder } : {}) }
 }
 
 export function hermesUserInputResponse (result, questions = []) {

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 5,
+  "bundleVersion": 6,
   "contracts": [
     {
       "id": "room-coordination",
@@ -65,7 +65,7 @@
     },
     {
       "id": "room-question",
-      "version": 1,
+      "version": 2,
       "routes": [
         {
           "id": "room-question",
@@ -74,6 +74,7 @@
           "prompt": "When a missing choice genuinely blocks useful progress, use request_user_input so the question is answerable in the room; otherwise make a safe in-scope assumption and continue."
         }
       ],
+      "resultContract": "A resolved room question returns the selected answers plus the durable responder identity {id, name}; the id must match the pair-control row's resolved_by authority.",
       "impact": [
         {"path": "bridge/bridge.mjs", "diffPattern": "request_user_input"},
         {"path": "bridge/claude-session.mjs", "diffPattern": "AskUserQuestion|request_user_input"},