thinkpool-pair 0.7.340 → 0.7.342

package/account.mjs

@@ -21,6 +21,7 @@ import { supervisorServes, supervisorRoomsToStop } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 import { installedAgentCommands } from './agent-detect.mjs'
+import { agentVisibilityStates, setAgentPickerVisibility } from './agent-visibility.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
 import { createPairBusBroker, mergePairRoomRoster, pairBusStatusFromRealtime, PAIR_BUS_STATUS } from './pair-bus.mjs'
 import { clearSupervisorReady, supervisorPresenceEchoed, writeSupervisorReady } from './supervisor-ready.mjs'
@@ -639,7 +640,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // to spawn against — re-read each announce so an add/remove reflects immediately.
   // Both are additive; older clients ignore them (feature: multi-provider BYOK, slice 1).
   const PROVIDER_PUBKEY = publicKeyB64()
-  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: installedAgentCommands().map((cmd) => ({ cmd })), accountAuthState, ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, bridgeId: BRIDGE_ID, version: VERSION, rooms: [...children.keys()], readyRooms: [...readyRooms], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: runsAsService(), providerPubKey: PROVIDER_PUBKEY, providers: announceProviders(), agents: agentVisibilityStates(installedAgentCommands()), accountAuthState, ts: Date.now() })
 
   // Persist account-auth truth separately from process presence. Presence will vanish
   // when the old JWT expires; the claim row keeps the reconnect instruction visible on
@@ -688,6 +689,21 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     const nonce = payload?.nonce
     provReply('providers-list-res', { nonce, ok: true, providers: listProviders() })
   })
+  // agent-visibility-set {cmd, enabled, nonce} changes only the web picker.
+  // The runtime stays installed and explicit runtime requests keep working.
+  acctControl.on('broadcast', { event: 'agent-visibility-set' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const installed = installedAgentCommands()
+    const r = setAgentPickerVisibility(payload?.cmd, payload?.enabled === true, { installed })
+    if (r.ok) {
+      pushPresence()
+      for (const child of children.values()) {
+        try { child.send({ t: 'agent-visibility-changed' }) } catch { /* child may be exiting */ }
+      }
+      process.stderr.write(`\n  ◆ terminal picker agents updated — ${r.agents.filter((agent) => agent.enabled).map((agent) => agent.cmd).join(', ')} visible.\n`)
+    }
+    provReply('agent-visibility-res', { nonce, ok: r.ok, error: r.ok ? undefined : r.error, agents: r.ok ? r.agents : undefined })
+  })
 
   // ENABLE presence delivery + the self-echo's ground truth. supabase-js only asks
   // the server for presence state when a presence callback is bound at join time —

package/agent-visibility.mjs

@@ -0,0 +1,67 @@
+// Host-local picker visibility for installed coding agents.
+//
+// Installation remains detection truth: hiding a runtime does not uninstall it
+// or prevent an explicit bridge command from opening it. This preference only
+// controls which installed runtimes the web offers in human-facing terminal
+// pickers. The file is shared by the account supervisor and its room children,
+// so one dashboard toggle applies to every room served by this bridge.
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+export const PICKER_AGENT_COMMANDS = ['claude', 'codex', 'thinkpool']
+
+const root = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
+const defaultFile = () => path.join(root(), 'agent-visibility.json')
+const normalize = (command) => String(command || '').toLowerCase() === 'hermes'
+  ? 'thinkpool'
+  : String(command || '').toLowerCase()
+
+export function loadHiddenAgentCommands({ file = defaultFile(), fsImpl = fs } = {}) {
+  try {
+    const saved = JSON.parse(fsImpl.readFileSync(file, 'utf8'))
+    return new Set((Array.isArray(saved?.hidden) ? saved.hidden : [])
+      .map(normalize)
+      .filter((command) => PICKER_AGENT_COMMANDS.includes(command)))
+  } catch {
+    return new Set()
+  }
+}
+
+export function agentVisibilityStates(commands, { hidden = loadHiddenAgentCommands() } = {}) {
+  const found = new Set((Array.isArray(commands) ? commands : []).map(normalize))
+  const states = PICKER_AGENT_COMMANDS
+    .filter((command) => found.has(command))
+    .map((cmd) => ({ cmd, enabled: !hidden.has(cmd) }))
+  // A corrupt or hand-edited preference must not leave the "+" action with no
+  // valid runtime. The first installed product runtime is the safe recovery.
+  if (states.length > 0 && !states.some((agent) => agent.enabled)) states[0].enabled = true
+  return states
+}
+
+export function setAgentPickerVisibility(command, enabled, {
+  installed = [],
+  file = defaultFile(),
+  fsImpl = fs,
+} = {}) {
+  const cmd = normalize(command)
+  if (!PICKER_AGENT_COMMANDS.includes(cmd)) return { ok: false, error: 'unknown agent runtime' }
+  const states = agentVisibilityStates(installed, { hidden: loadHiddenAgentCommands({ file, fsImpl }) })
+  if (!states.some((agent) => agent.cmd === cmd)) return { ok: false, error: 'agent runtime is not installed' }
+  if (!enabled && states.filter((agent) => agent.enabled).length <= 1) {
+    return { ok: false, error: 'keep at least one agent in the terminal picker' }
+  }
+
+  const hidden = new Set(states.filter((agent) => !agent.enabled).map((agent) => agent.cmd))
+  if (enabled) hidden.delete(cmd)
+  else hidden.add(cmd)
+
+  try {
+    fsImpl.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 })
+    fsImpl.writeFileSync(file, JSON.stringify({ hidden: [...hidden] }, null, 2), { mode: 0o600 })
+    try { fsImpl.chmodSync(file, 0o600) } catch { /* best-effort hardening */ }
+  } catch {
+    return { ok: false, error: 'could not save agent visibility' }
+  }
+  return { ok: true, agents: agentVisibilityStates(installed, { hidden }) }
+}

package/bridge.mjs

@@ -64,6 +64,7 @@ import { hermesRequiredMcpTools, hermesRoleFor } from './hermes-policy.mjs'
 import { canonicalRoomFilePath, waitForNativeImages } from './codex-images.mjs'
 import { createManagedLaneWorktree, removeManagedLaneWorktree } from './lane-worktree.mjs'
 import { commandOnPath } from './agent-detect.mjs'
+import { agentVisibilityStates } from './agent-visibility.mjs'
 import { requiresSdkAdmission, sdkSmokePassed } from './sdk-admission.mjs'
 import { hermesUserInputResponse } from './question-response.mjs'
 import { hostMemoryAdmission } from './host-memory.mjs'
@@ -1295,6 +1296,7 @@ const announce = () => {
   // (name-only, NEVER key/baseUrl) so a cross-device viewer can badge a lane opened
   // on a custom provider without the owner's account-channel registry.
   const provNames = providerNameMap()
+  const pickerState = new Map(agentVisibilityStates(installedAgents.map((agent) => agent.cmd)).map((agent) => [agent.cmd, agent.enabled]))
   const rev = ++announceRev
   return bcastAwait('bridge', {
     v: 2, name, bridge_id: BRIDGE_ID, started_at: BRIDGE_STARTED_AT, rev, repo: repoLabel, branch: readBranch(),
@@ -1353,7 +1355,7 @@ const announce = () => {
     agents: installedAgents.map(a => {
       let canResume = false
       if (a.resume) { try { canResume = a.resume.probe() } catch { /* stays false */ } }
-      return { label: a.label, cmd: a.cmd, canResume }
+      return { label: a.label, cmd: a.cmd, canResume, enabled: pickerState.get(a.cmd) !== false }
     }),
     // cols/rows: the PTY's one true size — web viewers render this grid and
     // scale it to their own page instead of voting to reflow it.
@@ -5376,6 +5378,7 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   process.on('message', (m) => {
     if (!m) return
     if (m.t === 'update-available') surfaceUpdate(m.version)
+    else if (m.t === 'agent-visibility-changed') void announce()
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
     else if (m.t === 'token') {

package/command-catalog.mjs

@@ -14,7 +14,6 @@ const command = (name, description, route, inputHint, runtimes = ['claude', 'cod
 
 export const CODE_ROOM_COMMANDS = Object.freeze([
   command('/side', 'investigate beside this terminal', 'side', 'task'),
-  command('/flow', 'open an explicit visible Cascade', 'flow', 'task [--mode guide|steer|autopilot]'),
   command('/help', 'list commands available in this lane', 'control'),
   command('/status', 'runtime, model, permissions, and busy state', 'control'),
   command('/usage', 'session usage and provider limits', 'control'),
@@ -28,10 +27,21 @@ export const CODE_ROOM_COMMANDS = Object.freeze([
   command('/queue', 'run a prompt after the active turn', 'queue', 'prompt'),
   command('/steer', 'guide the active turn', 'steer', 'prompt', ['codex', 'hermes']),
   command('/credits', 'provider credit balance', 'credits', null, ['codex', 'hermes']),
-  command('/reasoning', 'Hermes reasoning effort', 'runtime', 'low | medium | high | xhigh | max | none | reset', ['hermes']),
   command('/review', 'review uncommitted changes', 'runtime', null, ['codex']),
 ])
 
+// Native catalogs are runtime evidence, never portable session metadata.
+// Claude's adapter default-denies raw SDK commands and passes only proven room
+// controls plus installed Skills. Hermes' isolated ACP bootstrap owns its safe
+// native catalog. Codex App Server publishes no native slash catalog, so a
+// restored/foreign list must not manufacture one. Compatibility aliases stay
+// callable at their runtime boundary without remaining discoverable.
+const NATIVE_COMMAND_POLICY = Object.freeze({
+  claude: Object.freeze({ accept: true, hidden: Object.freeze(new Set(['/flow'])) }),
+  codex: Object.freeze({ accept: false, hidden: Object.freeze(new Set(['/flow'])) }),
+  hermes: Object.freeze({ accept: true, hidden: Object.freeze(new Set(['/flow', '/reasoning'])) }),
+})
+
 const cleanRuntime = (runtime) => runtime === 'thinkpool' ? 'hermes' : runtime
 const cleanName = (value) => {
   const raw = typeof value === 'string' ? value : value?.name
@@ -54,6 +64,7 @@ const normalizeNative = (value) => {
 // retained only after the runtime-specific adapter has already allowlisted them.
 export function commandCatalogForRuntime(runtime, nativeCommands = []) {
   const id = cleanRuntime(runtime)
+  const nativePolicy = NATIVE_COMMAND_POLICY[id] || NATIVE_COMMAND_POLICY.codex
   const byName = new Map()
   for (const item of CODE_ROOM_COMMANDS) {
     if (!item.runtimes.includes(id)) continue
@@ -66,7 +77,7 @@ export function commandCatalogForRuntime(runtime, nativeCommands = []) {
   }
   for (const raw of (Array.isArray(nativeCommands) ? nativeCommands : [])) {
     const item = normalizeNative(raw)
-    if (!item) continue
+    if (!item || !nativePolicy.accept || nativePolicy.hidden.has(item.name)) continue
     const shared = byName.get(item.name)
     const hermesNativeControl = id === 'hermes' && ['/help', '/status', '/context', '/credits'].includes(item.name)
     byName.set(item.name, shared

package/hermes-acp-bootstrap.py

@@ -168,10 +168,10 @@ acp_adapter.server.HermesACPAgent._build_model_state = nous_only_model_state
 # account tokens, or lifecycle/admin controls enter the room surface.
 _TP_REASONING_CONFIG_ID = "thinkpool_reasoning_effort"
 _TP_REASONING_LEVELS = frozenset({"none", "low", "medium", "high", "xhigh", "max"})
+_TP_HIDDEN_COMMANDS = frozenset({"reasoning"})
 _TP_COMMANDS = (
     {"name": "credits", "description": "Show safe Nous credit balance and top-up handoff"},
     {"name": "status", "description": "Show session, model, context, version, and reasoning status"},
-    {"name": "reasoning", "description": "Set session-only reasoning effort", "input_hint": "low, medium, high, xhigh, max, none, or reset"},
 )
 
 _native_compact = getattr(acp_adapter.server.HermesACPAgent, "_cmd_compact", None)
@@ -283,8 +283,12 @@ _available_commands = getattr(acp_adapter.server.HermesACPAgent, "_available_com
 @classmethod
 def thinkpool_available_commands(cls):
     # Keep the upstream catalog canonical, then append exactly our process-local
-    # commands. This drives ACP updates and /help from one registry.
-    base = list(_available_commands.__func__(cls)) if _available_commands else []
+    # commands. Compatibility aliases remain executable without appearing in
+    # ACP updates or /help; the room-level /effort control is canonical.
+    base = [
+        item for item in (list(_available_commands.__func__(cls)) if _available_commands else [])
+        if str(getattr(item, "name", item.get("name", "") if isinstance(item, dict) else "") or "").lstrip("/").lower() not in _TP_HIDDEN_COMMANDS
+    ]
     try:
         from acp.schema import AvailableCommand, UnstructuredCommandInput
         known = {getattr(item, "name", "") for item in base}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.340",
+  "version": "0.7.342",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "sdk-admission.mjs",
     "launcher.mjs",
     "privacy-report.mjs",
+    "agent-visibility.mjs",
     "byok-detect.mjs",
     "context-windows.mjs",
     "claude-session.mjs",

package/privacy-report.mjs

@@ -42,6 +42,7 @@ export function buildPrivacyReport({
     ['Saved login', 'auth.json', exists(path.join(configDir, 'auth.json')), 'refresh token and account identity'],
     ['Provider registry', 'providers.json', exists(path.join(configDir, 'providers.json')), 'provider endpoint, model, and API key'],
     ['Bridge keypair', 'bridge-key.json', exists(path.join(configDir, 'bridge-key.json')), 'private key used to open browser-sealed provider keys'],
+    ['Agent picker visibility', 'agent-visibility.json', exists(path.join(configDir, 'agent-visibility.json')), 'which installed runtimes are hidden from terminal pickers'],
     ['Room directories', 'dirs.json / served.json', exists(path.join(configDir, 'dirs.json')) || exists(path.join(configDir, 'served.json')), 'room-to-project directory mappings'],
     ['Bridge logs', 'update.log and service logs', exists(path.join(configDir, 'update.log')), 'update and background-service diagnostics'],
   ]
@@ -105,4 +106,3 @@ export function runPrivacyReport(options) {
   process.stdout.write(formatPrivacyReport(report))
   return report
 }
-