thinkpool-pair 0.7.281 → 0.7.283

package/bridge.mjs

@@ -68,7 +68,7 @@ import { hostMemoryAdmission } from './host-memory.mjs'
 const STRUCTURED_MODES = new Set(['default', 'acceptEdits', 'plan', 'review', 'bypassPermissions'])
 import { FLOW_CONDUCTOR_PROMPT, FLOW_LANE_PROMPT, FLOW_CODEX_CONDUCTOR_PROMPT, FLOW_CODEX_LANE_PROMPT, buildConductorEnv, assembleCrossWaveContext, buildLanePrompt } from './flow-conductor.mjs'
 import { legacyBuilderCompletionAllowed, normalizePlanOutput, validatePlanForRuntime, validReviewTargetShape } from './flow-task-graph.mjs'
-import { normalizeFlowRuntime, flowLaneModelFor, flowConductorModelFor, spawnedLaneModelFor, modelCatalogValues, resolveCodexModel, assertRuntimeModelCompatible } from './flow-models.mjs'
+import { normalizeFlowRuntime, flowLaneModelFor, flowConductorModelFor, spawnedLaneModelFor, modelCatalogValues, resolveCodexModel, resolveHermesOpenModel, assertRuntimeModelCompatible } from './flow-models.mjs'
 // S1 (context-offload) — durable digest store. mark_flow_done digests a closed slice in;
 // the dispatch loop reads the bounded cross-wave context back out (via assembleCrossWaveContext,
 // which enforces the CEILING). Consume the store — the internals live in flow-context-store.mjs.
@@ -2079,15 +2079,17 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     const runtime = args?.runtime || entry.runtime || 'claude'
     if (runtime === 'codex' && args?.provider) return { error: 'A Codex terminal uses its Codex/OpenAI login in v1; custom bridge providers are not wired to Codex yet. Omit provider or open a Claude terminal for that provider.' }
     if (runtime === 'hermes' && args?.provider) return { error: 'A Hermes terminal uses its isolated Hermes profile and ACP model catalog; bridge provider IDs do not apply. Omit provider and choose an exact Hermes model ID.' }
-    if (runtime === 'hermes' && (!worker || entry.runtime !== 'hermes')) return { error: 'A Hermes worker can only be opened by a top-level Hermes terminal with a live ACP model catalog.' }
-    const catalog = runtime === 'codex' ? readCodexModels() : runtime === 'hermes' ? (entry.models || []) : []
+    const hermesCatalog = entry.runtime === 'hermes' && entry.models?.length
+      ? entry.models
+      : [...sessions.values()].flatMap((session) => session.runtime === 'hermes' ? (session.models || []) : [])
+    const catalog = runtime === 'codex' ? readCodexModels() : runtime === 'hermes' ? hermesCatalog : []
     if (runtime === 'codex' && args?.model && !modelCatalogValues(catalog).has(args.model)) {
       return { error: `Could not open a Codex terminal on ${JSON.stringify(args.model)} — that model is not in this host's visible Codex catalog.` }
     }
-    if (runtime === 'hermes' && !args?.model) return { error: 'Opening a Hermes worker requires an explicit exact model ID from this session\'s ACP catalog.' }
-    if (runtime === 'hermes' && !modelCatalogValues(catalog).has(args.model)) {
-      return { error: `Could not open a Hermes worker on ${JSON.stringify(args.model)} — that exact model is not in this parent session's ACP catalog.` }
-    }
+    const hermesModel = runtime === 'hermes'
+      ? resolveHermesOpenModel(args?.model, catalog, { strictCatalog: entry.runtime === 'hermes' })
+      : null
+    if (hermesModel && !hermesModel.ok) return { error: hermesModel.error }
     const provider = runtime === 'claude' && args?.provider ? resolveProviderRef(args.provider) : args?.provider
     if (runtime === 'claude' && args?.provider && !provider) {
       const choices = registeredProviderChoices()
@@ -2098,7 +2100,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     }
     return {
       runtime,
-      model: args?.model || (worker && args?.sliceType
+      model: hermesModel?.model || args?.model || (worker && args?.sliceType
         ? spawnedLaneModelFor({ sliceType: args.sliceType, runtime, catalog })
         : undefined),
       // Worker lanes are the autonomous execution unit. They never inherit a
@@ -2359,13 +2361,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // conductor mains, spawned workers, Side lanes, and Flow lanes cannot use it.
       ...(canOpenMainConductor ? [tool(
         'open_main_terminal',
-        'Open a separate independent MAIN terminal to conduct a Cascade. Use this whenever a person explicitly asks to open, launch, start, or spawn a new Cascade/conductor terminal. This is the top-level room lifecycle, NOT Ensemble dispatch: the new terminal has no spawnedBy owner and appears as a main terminal. Never substitute spawn_terminal, which creates worker sub-terminals only. Give the conductor its full initial task; it will use spawn_terminal for its workers.',
+        'Open a separate independent MAIN terminal to conduct a Cascade on any supported runtime: Claude (including a connected Anthropic-compatible BYOK provider), Codex, or Hermes. Use this whenever a person explicitly asks to open, launch, start, or spawn a new Cascade/conductor terminal. This is the top-level room lifecycle, NOT Ensemble dispatch: the new terminal has no spawnedBy owner and appears as a main terminal. Never substitute spawn_terminal, which creates worker sub-terminals only. Give the conductor its full initial task; it will use spawn_terminal for its workers.',
         {
           name: z.string().max(80).optional().describe('short label for the main conductor, e.g. "Cascade · Multi-device chaos"'),
           task: z.string().min(1).describe('complete initial Cascade brief for the conductor'),
-          model: z.string().optional().describe('optional conductor model, e.g. opus / gpt-5.6-sol'),
-          runtime: z.enum(['claude', 'codex']).optional().describe('agent runtime; defaults to inheriting this main terminal'),
-          provider: z.string().optional().describe('optional registered LLM provider id for a Claude conductor'),
+          model: z.string().optional().describe('optional conductor model, e.g. opus / gpt-5.6-sol / nous:z-ai/glm-5.2'),
+          runtime: z.enum(['claude', 'codex', 'hermes']).optional().describe('agent runtime; every top-level terminal can open every supported runtime, defaulting to its own'),
+          provider: z.string().optional().describe(`optional registered Claude-compatible provider name or id; omit for built-in Anthropic${registeredProviderChoices() ? `. Available now: ${registeredProviderChoices()}` : ''}`),
           mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('permission mode; defaults to inheriting this main terminal, except plan falls back to default'),
         },
         async (args) => {
@@ -2416,13 +2418,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
       // not receive this tool, so the hierarchy is capability-enforced.
       ...(canSpawnWorkers ? [tool(
         'spawn_terminal',
-        'Open a visible WORKER SUB-TERMINAL (Claude, Codex, or—only from a Hermes parent—Hermes) in the ThinkPool Ensemble. spawn_terminal is worker-only: it can never create a Cascade conductor or main terminal. For ordinary workers use an appropriate non-Sol tier: gpt-5.6-luna or gpt-5.4-mini for scaffold/search, gpt-5.6-terra for feature/fix, and a balanced tier for adversarial review; never select Sol for routine workers. A Hermes sliceType=review lane is structurally reviewer-scoped before ACP startup: it can inspect files and use the bridge review-check tool, but has no terminal, write, patch, delegate, browser, skill, memory, or session-history schema. Pass sliceType=scaffold for mechanical work, feature/fix for builders, and review for adversarial verification. Give the worker a bounded initial task, collect its result with read_terminal, then ALWAYS close_terminal it.',
+        'Open a visible WORKER SUB-TERMINAL on any supported runtime—Claude (including a connected Anthropic-compatible BYOK provider), Codex, or Hermes—from any top-level terminal. spawn_terminal is worker-only: it can never create a Cascade conductor or main terminal. For ordinary workers use an appropriate non-Sol tier: gpt-5.6-luna or gpt-5.4-mini for scaffold/search, gpt-5.6-terra for feature/fix, and a balanced tier for adversarial review; never select Sol for routine workers. A Hermes sliceType=review lane is structurally reviewer-scoped before ACP startup: it can inspect files and use the bridge review-check tool, but has no terminal, write, patch, delegate, browser, skill, memory, or session-history schema. Pass sliceType=scaffold for mechanical work, feature/fix for builders, and review for adversarial verification. Give the worker a bounded initial task, collect its result with read_terminal, then ALWAYS close_terminal it.',
         {
           name: z.string().max(80).optional().describe('a short label for the new lane so the room (and you) can find it, e.g. "Research: topologies"'),
           task: z.string().optional().describe('an initial task to hand the new lane immediately; omit to open it idle'),
-          model: z.string().optional().describe('model for the chosen runtime; Hermes workers require an exact ACP catalog ID such as nous:anthropic/claude-sonnet-4.6'),
+          model: z.string().optional().describe('model for the chosen runtime; Hermes accepts its profile default or an ACP ID such as nous:z-ai/glm-5.2'),
           sliceType: z.enum(['scaffold', 'feature', 'fix', 'review']).optional().describe('optional cascade slice tier; omitted preserves normal inheritance/default, explicit model wins'),
-          runtime: z.enum(['claude', 'codex', 'hermes']).optional().describe('agent runtime for the new lane; Hermes is allowed only from a top-level Hermes parent with an explicit catalog model'),
+          runtime: z.enum(['claude', 'codex', 'hermes']).optional().describe('agent runtime for the new lane; every top-level terminal can open every supported runtime'),
           provider: z.string().optional().describe(`optional registered Claude-compatible provider name or id; omit for built-in Anthropic${registeredProviderChoices() ? `. Available now: ${registeredProviderChoices()}` : ''}`),
           mode: z.enum(['default', 'acceptEdits', 'bypassPermissions', 'plan']).optional().describe('accepted for compatibility; spawned workers always run autonomously in bypassPermissions'),
         },
@@ -2675,7 +2677,7 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
     cascadeRole: entry.cascadeRole,
     flowRole: entry.flowRole,
     sideParent: entry.sideParent,
-  }), runtime === 'hermes' && canSpawnWorkers ? HERMES_VISIBLE_WORKER_FALLBACK_RULE : ''].filter(Boolean).join('\n\n')
+  }), canSpawnWorkers ? HERMES_VISIBLE_WORKER_FALLBACK_RULE : ''].filter(Boolean).join('\n\n')
   entry.session = startStructuredSession(runtime, {
     // laneModel, NOT the raw `model` param: the SDK's `model` option OVERRIDES the
     // ANTHROPIC_MODEL supplied by resolveProviderEnv() in `env` below, so an inherited

package/cross-terminal.mjs

@@ -431,7 +431,7 @@ export const spawnDecision = ({ hop = 0, spawnTimes = [], now = 0, spawnedLive =
 // host path, or mutable process object is copied into the preview.
 const DISPATCH_ARG_KEYS = Object.freeze(['mode', 'model', 'name', 'provider', 'runtime', 'sliceType', 'task'])
 const DISPATCH_MODES = new Set(['default', 'acceptEdits', 'bypassPermissions', 'plan'])
-const DISPATCH_RUNTIMES = new Set(['claude', 'codex'])
+const DISPATCH_RUNTIMES = new Set(['claude', 'codex', 'hermes'])
 const DISPATCH_SLICES = new Set(['scaffold', 'feature', 'fix', 'review'])
 const secretValue = /((?<![a-z0-9])sk-[a-z0-9_-]{8,}|(?<![a-z0-9])gsk_[a-z0-9_-]{8,}|(?<![a-z0-9])AIza[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,})/ig
 const hostPath = /(?:\/home\/|\/users\/|\/private\/|\/tmp\/|[a-z]:\\|\\\\)/ig
@@ -487,7 +487,9 @@ export function buildDispatchPreview ({ args, initiatorTerminalId, roomCode, bri
   // durable resolution/delivery-attempt events.
   const authority = Object.freeze({ initiatorTerminalId: String(initiatorTerminalId), roomCode: String(roomCode).toUpperCase(), bridgeAuthorityId: String(bridgeAuthorityId), localAuthorityId: String(localAuthorityId) })
   const fingerprint = sha256({ authority, exactArgs, caps })
-  const provider = exactArgs.provider || (exactArgs.runtime === 'codex' ? 'OpenAI / Codex login' : 'Anthropic / host default')
+  const provider = exactArgs.provider || (exactArgs.runtime === 'codex'
+    ? 'OpenAI / Codex login'
+    : exactArgs.runtime === 'hermes' ? 'Hermes ACP profile' : 'Anthropic / host default')
   const model = exactArgs.model || context.resolvedModel || 'runtime default'
   const purpose = safeCopy(exactArgs.name || exactArgs.task?.split(/\r?\n/)[0] || 'Open one worker lane', 120)
   return Object.freeze({

package/flow-models.mjs

@@ -24,6 +24,38 @@ export function modelCatalogValues(catalog = []) {
   )).filter(Boolean))
 }
 
+const exactHermesModelId = (value) => /^[A-Za-z0-9._-]+:[A-Za-z0-9._-]+\/[A-Za-z0-9._:/-]+$/.test(value)
+
+const expandHermesModelAlias = (value) => {
+  if (/^glm[-_.]/i.test(value)) return `nous:z-ai/${value.toLowerCase()}`
+  const shorthand = value.match(/^([^:/]+):([^/]+)$/)
+  if (!shorthand) return value
+  const provider = shorthand[1].toLowerCase() === 'zai' ? 'z-ai' : shorthand[1].toLowerCase()
+  return `nous:${provider}/${shorthand[2]}`
+}
+
+/**
+ * Resolve a Hermes model for any bridge opener. A Hermes parent has a live ACP
+ * catalog and remains strict. Other runtimes may use a full id or unambiguous
+ * shorthand; the child session acknowledges session/set_model before inference.
+ * Omitting a model intentionally selects the isolated Hermes profile default.
+ */
+export function resolveHermesOpenModel(model, catalog = [], { strictCatalog = false } = {}) {
+  const requested = String(model || '').trim()
+  if (!requested) return { ok: true, model: undefined, validatedBy: 'default' }
+  const values = [...modelCatalogValues(catalog)]
+  if (values.includes(requested)) return { ok: true, model: requested, validatedBy: 'catalog' }
+
+  const expanded = expandHermesModelAlias(requested)
+  const normalized = (value) => String(value).toLowerCase().replace(/[^a-z0-9]+/g, '')
+  const requestedKey = normalized(expanded).replace(/^nous/, '')
+  const aliases = values.filter((value) => normalized(value).replace(/^nous/, '') === requestedKey)
+  if (aliases.length === 1) return { ok: true, model: aliases[0], validatedBy: 'catalog' }
+  if (strictCatalog && values.length) return { ok: false, error: `Could not open a Hermes terminal on ${JSON.stringify(requested)} — that model is not in this session's ACP catalog.` }
+  if (!exactHermesModelId(expanded)) return { ok: false, error: `Could not resolve Hermes model ${JSON.stringify(requested)}. Use a full ACP model ID such as "nous:z-ai/glm-5.2".` }
+  return { ok: true, model: expanded, validatedBy: 'child-runtime' }
+}
+
 function firstVisible(candidates, catalog) {
   const visible = modelCatalogValues(catalog)
   for (const candidate of candidates) if (visible.has(candidate)) return candidate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.281",
+  "version": "0.7.283",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 7,
+  "bundleVersion": 8,
   "contracts": [
     {
       "id": "room-coordination",
@@ -41,8 +41,9 @@
     },
     {
       "id": "work-routing",
-      "version": 3,
-      "providerRoutingContract": "A Claude worker may select a connected Anthropic-compatible provider by durable id, unique display name, or unique configured model. Unknown or ambiguous references fail closed and must never fall through to built-in Claude.",
+      "version": 4,
+      "providerRoutingContract": "A Claude lane may select a connected Anthropic-compatible provider by durable id, unique display name, or unique configured model. Unknown or ambiguous references fail closed and must never fall through to built-in Claude.",
+      "openerParityContract": "Every top-level terminal may use spawn_terminal or open_main_terminal to open every supported structured runtime: Claude, Codex, or Hermes. Runtime-specific provider/model validation remains authoritative and occurs before inference.",
       "routes": [
         {
           "id": "work-routing",

package/thinkpool-room-prompt.mjs

@@ -152,8 +152,7 @@ export const CODEX_THINKPOOL_FIRST_TURN_PREAMBLE = [
   ...THINKPOOL_REMOTE_DELIVERY_RULES,
 ].join(' ')
 
-// Hermes mains can dispatch visible ordinary workers, including a Claude-family
-// model served through the parent's Nous Portal catalog when native Claude Code
-// account access is unavailable. This is manual orchestration only: ACP 0.18.2
-// does not expose structural read-only review policy, and Flow remains disabled.
-export const HERMES_VISIBLE_WORKER_FALLBACK_RULE = 'HERMES VISIBLE-WORKER FALLBACK: spawn_terminal may open a visible Hermes worker only from a top-level Hermes terminal and only with an explicit exact model ID advertised in this session\'s ACP catalog. If a native Claude Code worker reports an account/provider authentication or subscription-access failure, treat the entire native Claude provider as unavailable for the rest of the task—do not retry Sonnet, Opus, or Haiku aliases on it. For a manual Claude-family review fallback, use runtime="hermes", the exact Nous Claude model suggested by read_terminal, mode="default", and sliceType="review". This fallback is permission-gated, not structurally read-only: instruct it not to edit, stop/deny any write request, and never call it Flow/reviewer safety. Never use hidden Hermes delegate_task.'
+// Every top-level main can open every supported runtime. Hermes model selection
+// is acknowledged by the child ACP session before inference, so it is safe for a
+// Claude or Codex parent to request a visible Hermes lane.
+export const HERMES_VISIBLE_WORKER_FALLBACK_RULE = 'UNIVERSAL OPENER ROUTING: a top-level terminal of any runtime may use spawn_terminal or open_main_terminal to open Claude (including a connected Anthropic-compatible BYOK provider), Codex, or Hermes. For Hermes, omit model to use the isolated profile default or pass an ACP ID such as model="nous:z-ai/glm-5.2"; common GLM shorthand is normalized and the child acknowledges the selected model before inference. If a native Claude Code worker reports an account/provider authentication or subscription-access failure, treat the entire native Claude provider as unavailable for the rest of the task—do not retry Sonnet, Opus, or Haiku aliases on it. For a manual Claude-family review fallback, use runtime="hermes", the exact Nous Claude model suggested by read_terminal, mode="default", and sliceType="review". This fallback is permission-gated, not structurally read-only: instruct it not to edit, stop/deny any write request, and never call it Flow/reviewer safety. Never use hidden Hermes delegate_task.'