thinkpool-pair 0.7.364 → 0.7.366

package/cross-terminal.mjs

@@ -1,789 +1 @@
-/* ThinkPool Code — B2 cross-terminal peek (read-only sibling access).
-   Pure formatting for the in-process `read_terminal` MCP tool that bridge.mjs
-   wires into every structured Claude session. Lets an agent PULL a sibling
-   terminal's recent output on demand (vs B1's always-on @pool digest) so it can
-   reason across lanes when its own work depends on another terminal.
-
-   Bridge-local on purpose — it cannot import the frontend's code-constants, so
-   the structured-event compaction here mirrors that file's digestLine shape.
-   Spec: docs/specs/2026-06-28-cross-terminal-awareness.md */
-
-import { createHash } from 'node:crypto'
-import { BLOCKED_REASON, projectLaneLifecycle } from './lane-lifecycle.mjs'
-
-// Bounds — the pull tool is self-limiting (the agent only calls it when it needs
-// to), but a runaway loop must still be capped (the cost-guard / C10 class).
-export const PEEK = {
-  // Keep the implicit pull concise for consumer turns. Agents can request more
-  // explicitly when a diagnosis genuinely needs deeper sibling history.
-  defaultLines: 20,
-  maxLines: 200,
-  perTurnCap: 10,     // targeted transcript reads allowed per accepted room turn
-  rosterPerTurnCap: 1, // no-argument roster reads use a separate allowance; ROOM NOW is default
-  lineCap: 200,       // per-line truncation
-  rosterPreview: 100, // last-line preview length in the roster listing
-}
-
-// ROOM NOW already gives every agent a compact live roster. Keep the one optional
-// full-roster lookup separate from transcript reads so a redundant discovery call
-// cannot consume the budget needed to collect workers and run the final review.
-// Unknown terminal refs are rejected before this helper is called and spend neither
-// allowance. The bridge stores the returned counters on the current lane.
-export const readTerminalBudgetDecision = ({ targeted = false, targetedCount = 0, rosterCount = 0 } = {}, limits = PEEK) => {
-  const nextTargeted = Math.max(0, Number(targetedCount) || 0)
-  const nextRoster = Math.max(0, Number(rosterCount) || 0)
-  if (targeted) {
-    if (nextTargeted >= limits.perTurnCap) return {
-      ok: false,
-      targetedCount: nextTargeted,
-      rosterCount: nextRoster,
-      reason: `Cross-terminal transcript read limit reached for this turn (${limits.perTurnCap}). Stop polling and continue with the worker results already collected; a fresh accepted room turn resets the allowance.`,
-    }
-    return { ok: true, targetedCount: nextTargeted + 1, rosterCount: nextRoster }
-  }
-  if (nextRoster >= limits.rosterPerTurnCap) return {
-    ok: false,
-    targetedCount: nextTargeted,
-    rosterCount: nextRoster,
-    reason: `The full terminal roster was already read this turn (${limits.rosterPerTurnCap}/${limits.rosterPerTurnCap}). Use the current ROOM NOW snapshot or read one relevant terminal by ref or name.`,
-  }
-  return { ok: true, targetedCount: nextTargeted, rosterCount: nextRoster + 1 }
-}
-
-// Provider/model reconstruction can deliver a fresh accepted agent turn without
-// another browser `code-turn` frame (context-carry and interrupted-resume paths).
-// Key read allowances to the bridge-owned turn revision as a second reset seam,
-// so a reconstructed runtime never inherits ten reads spent by the old model.
-// This intentionally resets only read allowances; hop/post/spawn loop breakers
-// remain tied to real person ingress and cannot be escaped by reconstruction.
-export const readTerminalTurnBudgetDecision = ({
-  targeted = false,
-  targetedCount = 0,
-  rosterCount = 0,
-  budgetTurnRev = null,
-  currentTurnRev = 0,
-} = {}, limits = PEEK) => {
-  const current = Math.max(0, Number(currentTurnRev) || 0)
-  const previous = budgetTurnRev == null
-    ? null
-    : Number.isFinite(Number(budgetTurnRev)) ? Number(budgetTurnRev) : null
-  const sameTurn = previous === current
-  return {
-    ...readTerminalBudgetDecision({
-      targeted,
-      targetedCount: sameTurn ? targetedCount : 0,
-      rosterCount: sameTurn ? rosterCount : 0,
-    }, limits),
-    budgetTurnRev: current,
-  }
-}
-
-// One shared lane-status classifier for every roster consumer: the bridge wire,
-// read_terminal, and ROOM NOW. Timestamps stay absolute on the wire so clients can
-// keep the displayed age current without a broadcast every second.
-export const LANE_STATUS = {
-  stuckAfterMs: 90_000,       // matches the structured-turn stall watchdog
-  repeatedFailureCount: 2,
-  failureWindow: 12,
-}
-
-const failureEvent = (e) => !!e && (
-  e.kind === 'error'
-  || (e.kind === 'tool_result' && e.isError)
-  || (e.kind === 'result' && e.subtype && e.subtype !== 'success')
-)
-
-const recentFailureCount = (log, limits = LANE_STATUS) => {
-  let failures = 0, seen = 0
-  for (let i = (Array.isArray(log) ? log.length : 0) - 1; i >= 0 && seen < limits.failureWindow; i--) {
-    const e = log[i]
-    if (!e || typeof e !== 'object') continue
-    seen++
-    // A clean completion or a fresh human task closes the prior failure streak.
-    if ((e.kind === 'result' && (!e.subtype || e.subtype === 'success')) || e.kind === 'you') break
-    if (failureEvent(e)) failures++
-  }
-  return failures
-}
-
-// Structured runtimes expose a mutable `turnActive` getter, but the bridge owns
-// the roster edges. A terminal result can reach the bridge before a runtime has
-// finished clearing that getter; reading it back here used to re-open a finished
-// lane until the next WHO/refocus announcement. Once the bridge has observed an
-// edge, its latch is authoritative until beginStructuredTurn/syncStructuredTurn
-// records the next one. `busy` remains the explicit override for wire fixtures
-// and raw terminals.
-export const laneBusyOf = (entry = {}) => typeof entry?.busy === 'boolean'
-  ? entry.busy
-  : (typeof entry?._busyAnn === 'boolean' ? entry._busyAnn : (entry?.session?.turnActive ?? false))
-
-export const settleLaneBusy = (entry) => {
-  if (!entry || entry._busyAnn === false) return false
-  entry._busyAnn = false
-  return true
-}
-
-// Structured controls such as native Codex compaction can borrow the runtime's
-// turnActive flag without emitting an ordinary result event. Close that borrowed
-// roster edge with the same durable revision proof as a normal terminal boundary.
-export const settleLaneControl = (entry, now = Date.now()) => {
-  if (!entry || entry._busyAnn !== true) return false
-  if (!settleLaneBusy(entry)) return false
-  entry._settledTurnRev = Number(entry._turnRev) || null
-  entry._turnSettledAt = Number(now) || Date.now()
-  entry._turnStart = null
-  return true
-}
-
-export const laneStatusOf = (entry = {}, now = Date.now(), limits = LANE_STATUS) => {
-  const baseLog = Array.isArray(entry?.log) ? entry.log : []
-  const log = baseLog.slice(-limits.failureWindow)
-  if (entry?.lastEvent && entry.lastEvent !== baseLog[baseLog.length - 1]
-    && (!entry.lastEvent.cid || entry.lastEvent.cid !== baseLog[baseLog.length - 1]?.cid)) log.push(entry.lastEvent)
-  let lastLogAt = null
-  for (let i = log.length - 1; i >= 0; i--) {
-    if (Number.isFinite(log[i]?.ts)) { lastLogAt = log[i].ts; break }
-  }
-  const lastActionAt = Number.isFinite(entry?.lastActionAt) ? entry.lastActionAt : (lastLogAt ?? null)
-  const lastActionAgeMs = lastActionAt == null ? null : Math.max(0, now - lastActionAt)
-  const busy = laneBusyOf(entry)
-  const pendingCount = entry?.pending instanceof Map
-    ? entry.pending.size
-    : Math.max(0, Number(entry?.pendingCount) || 0)
-  const pendingReason = entry?.pending instanceof Map && [...entry.pending.values()]
-    .some((pending) => pending?.payload?.risk === 'ask')
-    ? BLOCKED_REASON.NEEDS_INPUT
-    : BLOCKED_REASON.NEEDS_DECISION
-  const failures = recentFailureCount(log, limits)
-
-  let statusFlag = null, statusReason = null
-  if (pendingCount > 0) {
-    statusFlag = 'BLOCKED'; statusReason = 'waiting for input'
-  } else if (entry?.stalled || (busy && !entry?.compacting && lastActionAgeMs != null && lastActionAgeMs >= limits.stuckAfterMs)) {
-    statusFlag = 'STUCK'; statusReason = 'no events while busy'
-  } else if (failures >= limits.repeatedFailureCount) {
-    statusFlag = 'BLOCKED'; statusReason = 'repeated errors'
-  }
-
-  const lifecycle = projectLaneLifecycle({
-    events: log,
-    busy: !!busy,
-    pendingCount,
-    pendingReason,
-    stalled: statusFlag === 'STUCK',
-    failed: failures >= limits.repeatedFailureCount && !busy,
-    rawStatus: statusFlag || (busy ? 'busy' : 'idle'),
-  })
-  return { busy: !!busy, lastActionAt, lastActionAgeMs, statusFlag, statusReason, lifecycle }
-}
-
-export const formatLaneAge = (ageMs) => {
-  if (!Number.isFinite(ageMs)) return 'no activity'
-  const s = Math.max(0, Math.floor(ageMs / 1000))
-  if (s < 60) return `${s}s ago`
-  const m = Math.floor(s / 60)
-  if (m < 60) return `${m}m ago`
-  const h = Math.floor(m / 60)
-  if (h < 24) return `${h}h ago`
-  return `${Math.floor(h / 24)}d ago`
-}
-
-const laneStatusText = (x) => `${x.lifecycle?.state || 'Blocked'}${x.lifecycle?.reason ? ` (${x.lifecycle.reason})` : ''} · ${formatLaneAge(x.lastActionAgeMs)}`
-
-const clip = (s, cap) => {
-  const t = String(s == null ? '' : s).replace(/\s+/g, ' ').trim()
-  return t.length > cap ? t.slice(0, cap - 1) + '…' : t
-}
-
-// Compact ONE structured log event into a single line, or '' to skip it.
-// Mirrors src/pages/code/code-constants.js digestLine — keep them in step.
-export const digestLogEvent = (e, cap = PEEK.lineCap) => {
-  if (!e || typeof e !== 'object') return ''
-  switch (e.kind) {
-    case 'you': return clip(`${e.by || 'someone'}: ${e.text || ''}`, cap)
-    case 'assistant': {
-      const parts = []
-      for (const b of (Array.isArray(e.blocks) ? e.blocks : [])) {
-        if (b?.type === 'text' && String(b.text || '').trim()) parts.push(String(b.text).trim())
-        else if (b?.type === 'tool_use' && b.name) parts.push(`→ ${b.name}`)
-      }
-      return parts.length ? clip(`assistant: ${parts.join(' ')}`, cap) : ''
-    }
-    case 'tool_result': return e.isError ? clip('⎿ error', cap) : ''
-    case 'result': return (e.subtype && e.subtype !== 'success') ? clip(`turn ended — ${e.subtype}`, cap) : ''
-    case 'error': return clip(`error: ${e.message || ''}`, cap)
-    default: return ''   // chat/whisper/pool/note/control/compaction/system → not lane work
-  }
-}
-
-// Strip ANSI / control bytes from a PTY scrollback buffer, return last N real lines.
-export const cleanPtyTail = (buf, n) => {
-  /* eslint-disable no-control-regex -- stripping terminal escape/control bytes is the whole point */
-  const txt = String(buf || '')
-    .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')   // OSC sequences
-    .replace(/\x1b[@-_][0-?]*[ -/]*[@-~]/g, '')          // CSI / escape sequences
-    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')    // remaining control chars
-  /* eslint-enable no-control-regex */
-  const lines = txt.split(/\r?\n/).map(l => l.replace(/\s+$/, '')).filter(l => l.trim())
-  return lines.slice(-Math.max(1, n))
-}
-
-// Build the tool's text reply. `selfId` is excluded. `sessions` (structured) and
-// `terms` (PTY) are the bridge's module-scope Maps (id → entry). With no
-// `terminal`, returns the roster; with one, returns that lane's recent output.
-// ── shared sibling resolution (used by formatPeek + the cross-post handler) ──
-export const siblingRef = (id) => String(id).slice(0, 8)
-
-// Every terminal in the room except `selfId`, normalized. Structured sessions →
-// kind 'agent' (carry `log`); PTY terminals → kind 'shell' (carry `buf`). `names`
-// is the bridge's id→label map (termNames) — the HUMAN names people actually use
-// ("Pivot", "Grug"); without it the roster is just hashes and an agent can't map
-// "what is Pivot doing" to a lane.
-export const siblingsOf = ({ selfId, sessions, terms, names = {}, now = Date.now() } = {}) => {
-  const nm = (id) => (names && names[id]) || ''
-  const sib = []
-  for (const [id, s] of (sessions || new Map())) {
-    if (id === selfId) continue
-    sib.push({ id, ref: siblingRef(id), name: nm(id), kind: 'agent', cmd: s?.cmd || 'claude', log: Array.isArray(s?.log) ? s.log : [], ...laneStatusOf(s, now) })
-  }
-  for (const [id, t] of (terms || new Map())) {
-    if (id === selfId) continue
-    sib.push({ id, ref: siblingRef(id), name: nm(id), kind: 'shell', cmd: t?.cmd || 'shell', buf: t?.buf || '', ...laneStatusOf(t, now) })
-  }
-  return sib
-}
-
-// True for a POSITIONAL on-screen label ("Terminal 2", "t3", bare "2"). These
-// renumber when a sibling closes (Terminal 3 → Terminal 2 after a delete), so the
-// bridge — which only ever knows stable UUIDs — must NEVER resolve them, or a
-// delete could silently re-point a cross-post at the wrong lane. We refuse them
-// explicitly (safe miss) instead. The stable handles are the UUID/ref and the
-// custom name (both bound to the UUID, immune to renumbering).
-export const isOrdinalRef = (q) => /^(terminal\s*)?\d+$/i.test(q) || /^t\d+$/i.test(q)
-
-// Resolve an agent-supplied reference to one sibling, or null. Match priority:
-// exact id → exact name → exact short-ref → id-prefix (≥4 chars) → name substring
-// → command substring. Name matching is what makes "Pivot" / "Grug" resolvable.
-//
-// The ordinal guard runs AFTER the exact matches, not before (2026-07-10). A ref is
-// 8 hex characters, and ~2.3% of them contain no letters at all — "33729214" is a
-// perfectly good ref that `isOrdinalRef` reads as the ordinal "33,729,214". Refusing
-// it early made those lanes unresolvable by the very handle read_terminal prints:
-// unreadable, un-postable, and — the reason this surfaced — UNCLOSABLE, holding a
-// slot against the machine cap until the bridge restarted. Two of ~30 lanes in one
-// day, which is exactly the rate the arithmetic predicts.
-//
-// Checking identity first is safe: an ordinal like "3" or "terminal 2" can never
-// exactly equal an 8-char ref, a UUID, or a lane's name, so the guard still refuses
-// every reference it was written to refuse. It only stops shadowing real handles.
-export const resolveSibling = (siblings, terminal) => {
-  const q = String(terminal || '').toLowerCase().trim()
-  if (!q) return null
-  const list = Array.isArray(siblings) ? siblings : []
-  const exact = list.find(x => String(x.id).toLowerCase() === q)
-    || list.find(x => String(x.name || '').toLowerCase() === q)
-    || list.find(x => String(x.ref).toLowerCase() === q)
-  if (exact) return exact
-  if (isOrdinalRef(q)) return null
-  return list.find(x => q.length >= 4 && String(x.id).toLowerCase().startsWith(q))
-    || list.find(x => x.name && String(x.name).toLowerCase().includes(q))
-    || list.find(x => String(x.cmd).toLowerCase().includes(q))
-    || null
-}
-
-const label = (x) => `${x.ref}${x.name ? ` · "${x.name}"` : ''}`
-
-export const formatPeek = ({ selfId, sessions, terms, names = {}, terminal, lines, now = Date.now() } = {}) => {
-  const n = Math.min(PEEK.maxLines, Math.max(1, Number(lines) || PEEK.defaultLines))
-  const sib = siblingsOf({ selfId, sessions, terms, names, now })
-  if (!sib.length) return 'No other terminals are open in this room right now.'
-
-  if (!terminal) {
-    const rows = sib.map(x => {
-      let preview
-      if (x.kind === 'agent') { const ls = x.log.map(e => digestLogEvent(e, PEEK.rosterPreview)).filter(Boolean); preview = ls[ls.length - 1] || '(no activity yet)' }
-      else { preview = cleanPtyTail(x.buf, 1)[0] || '(no output yet)' }
-      return `- ${label(x)} · ${x.kind} · ${x.cmd} · ${laneStatusText(x)} — ${clip(preview, PEEK.rosterPreview)}`
-    })
-    return `Other terminals in this room (call read_terminal with a ref or name to read one):\n${rows.join('\n')}`
-  }
-
-  const hit = resolveSibling(sib, terminal)
-  if (!hit) {
-    const extra = isOrdinalRef(String(terminal || '').toLowerCase().trim())
-      ? ` On-screen numbers like "Terminal N" shift when a terminal closes, so they can't identify a lane — use a terminal's name or ref instead.`
-      : ''
-    return `No terminal matches "${terminal}". Call read_terminal with no argument to list the open terminals (refer to one by its name or ref).${extra}`
-  }
-
-  let body
-  if (hit.kind === 'agent') {
-    body = hit.log.map(e => digestLogEvent(e, PEEK.lineCap)).filter(Boolean).slice(-n).join('\n') || '(no activity yet)'
-  } else {
-    body = cleanPtyTail(hit.buf, n).join('\n') || '(no output yet)'
-  }
-  return `Terminal ${label(hit)} (${hit.kind} · ${hit.cmd}) · ${laneStatusText(hit)} — last ${n} lines:\n${body}`
-}
-
-// A native Claude Code account failure is provider-wide, not model-specific. Retrying
-// Sonnet → Opus → Haiku on the same built-in Anthropic path only repeats the same
-// failure and burns orchestration time. Keep this classifier deliberately narrow:
-// transient model/rate/overload errors must not disable the whole provider.
-export const nativeClaudeProviderAccessFailed = (events) => {
-  let text = ''
-  try { text = typeof events === 'string' ? events : JSON.stringify(events || '') }
-  catch { text = String(events || '') }
-  return /organization has disabled (?:claude(?: subscription access)?|subscription access)|(?:claude )?subscription access (?:has been |is )?disabled|invalid anthropic (?:api )?key|invalid x-api-key|not logged in to claude|(?:run|use) \/login[^\n]{0,80}claude|no valid anthropic (?:api )?key/i.test(text)
-}
-
-const HERMES_CLAUDE_REVIEW_PREFERENCE = Object.freeze([
-  'nous:anthropic/claude-sonnet-4.6',
-  'nous:anthropic/claude-sonnet-4.5',
-  'nous:anthropic/claude-sonnet-4',
-])
-
-export const preferredHermesClaudeReviewModel = (models = []) => {
-  const values = new Set((Array.isArray(models) ? models : []).map((model) => (
-    typeof model === 'string' ? model : model?.value || model?.slug
-  )).filter(Boolean))
-  for (const model of HERMES_CLAUDE_REVIEW_PREFERENCE) if (values.has(model)) return model
-  for (const model of values) if (/^nous:anthropic\/claude-sonnet-/i.test(model)) return model
-  for (const model of values) if (/^nous:anthropic\/claude-haiku-/i.test(model)) return model
-  for (const model of values) if (/^nous:anthropic\/claude-opus-/i.test(model)) return model
-  return null
-}
-
-// Returned alongside read_terminal output so the orchestrator gets a structural
-// provider verdict at the exact moment it observes the failed worker. A Hermes
-// fallback is a visible ordinary worker, never hidden delegate_task and never Flow.
-// Hermes ACP 0.18.2 cannot enforce read-only review, so the note states the honest
-// permission-gated boundary instead of pretending mode="default" is structural plan.
-export const nativeClaudeFallbackHint = ({ parentRuntime, parentModels, targetRuntime, targetLog } = {}) => {
-  if (targetRuntime !== 'claude' || !nativeClaudeProviderAccessFailed(targetLog)) return ''
-  const stop = 'ThinkPool provider status: native Claude access failed at the account/provider level. Do not retry Sonnet, Opus, Haiku, or another model alias on the same native Claude provider during this task.'
-  const fallback = parentRuntime === 'hermes' ? preferredHermesClaudeReviewModel(parentModels) : null
-  if (!fallback) return `\n\n${stop} Use a different available runtime/provider once, or report the blocker.`
-  return `\n\n${stop} For a visible manual review fallback, spawn exactly one worker with runtime="hermes", model=${JSON.stringify(fallback)}, mode="default", and sliceType="review". This Hermes lane is permission-gated, not structurally read-only: instruct it not to edit, deny/stop any write request, and do not treat its review as a Flow safety proof. Never use Hermes delegate_task.`
-}
-
-// ── Live per-turn room snapshot ("ROOM NOW") ─────────────────────────────────
-// The compact tail claude-session appends to EVERY user turn's <system-reminder>
-// (via the bridge's roomContext callback), so a lane sees the room's CURRENT
-// state — sibling lanes + the host's active git worktrees — adjacent to where its
-// attention actually is, instead of only knowing the peek tools exist. Same data
-// as the formatPeek roster, tighter: capped lanes, shorter previews. Returns null
-// when there is nothing to show (the reminder then carries no tail at all).
-// Spec ask (2026-07-02): "terminals need to be completely aware of the session."
-export const ROOMNOW = { laneCap: 8, previewLen: 70, wtCap: 10 }
-export const formatRoomNow = ({ selfId, sessions, terms, names = {}, worktrees = [], now = Date.now() } = {}, limits = ROOMNOW) => {
-  const sib = siblingsOf({ selfId, sessions, terms, names, now })
-  const out = []
-  if (sib.length) {
-    const shown = sib.slice(0, limits.laneCap)
-    const rows = shown.map(x => {
-      let preview
-      if (x.kind === 'agent') { const ls = x.log.map(e => digestLogEvent(e, limits.previewLen)).filter(Boolean); preview = ls[ls.length - 1] || '(no activity yet)' }
-      else preview = cleanPtyTail(x.buf, 1)[0] || '(no output yet)'
-      return `- ${label(x)} · ${x.kind} · ${laneStatusText(x)} — ${clip(preview, limits.previewLen)}`
-    })
-    if (sib.length > shown.length) rows.push(`- … +${sib.length - shown.length} more (read_terminal lists all)`)
-    out.push(`Other lanes in this room right now (this is the roster; use targeted read_terminal only for needed detail):\n${rows.join('\n')}`)
-  }
-  const wtAll = Array.isArray(worktrees) ? worktrees : []
-  const wt = wtAll.slice(0, limits.wtCap)
-  if (wt.length) {
-    const rows = wt.map(w => `- ${clip(w, limits.previewLen + 30)}`)
-    if (wtAll.length > wt.length) rows.push(`- … +${wtAll.length - wt.length} more (\`git worktree list\` shows all)`)
-    out.push(`Active git worktrees on this host (code edits go in your OWN worktree — never one another lane is on):\n${rows.join('\n')}`)
-  }
-  if (!out.length) return null
-  return `ROOM NOW (live snapshot, this turn):\n${out.join('\n')}`
-}
-
-// ── Tier C: cross-terminal POST (directed, gated cross-lane action) ──────────
-// Pure gate for whether a session may post into a sibling lane on THIS call:
-// kill-switch, loop-breaker (hop), per-turn cap. The routing itself (sendTurn
-// into the target) lives in bridge.mjs — it needs the live session. Spec INV-4:
-// no text reaches a sibling without an approved code-perm; agent-originated turns
-// are hop-capped so two agents can't ping-pong forever.
-export const CROSSPOST = {
-  maxHop: 1,      // human turn = hop 0; an injected turn = hop 1, which CANNOT post onward
-  perTurnCap: 3,  // post_to_terminal calls allowed per turn
-}
-
-export const crossPostDecision = ({ hop = 0, postCount = 0, disabled = false } = {}, limits = CROSSPOST) => {
-  const o = { ...CROSSPOST, ...(limits || {}) }
-  if (disabled) return { ok: false, reason: 'Cross-terminal posting is disabled in this room.' }
-  if (hop >= o.maxHop) return { ok: false, reason: 'Cross-terminal hop limit reached — an agent reached via cross-post cannot itself post onward; a person must direct the next cross-terminal action.' }
-  if (postCount >= o.perTurnCap) return { ok: false, reason: `Cross-terminal post limit reached for this turn (${o.perTurnCap}).` }
-  return { ok: true }
-}
-
-// ── Tier C consent SCOPE — does this post_to_terminal need a human card? ──────
-// Runs AFTER crossPostDecision's kill-switch/hop/cap precheck passes, and decides
-// only whether a person must TAP a card before the (already-permitted) post is
-// delivered. Two — and only two — cases auto-allow (no card):
-//   (1) bypassPermissions mode — bypass means bypass, cross-lane posts included.
-//       Without this, a conductor's post into its OWN lane queued behind a human
-//       tap even in a bypass session (the 3-stacked-Dispatch-cards bug, 2026-07-03).
-//   (2) the SENDER SPAWNED the target lane (parent→child orchestration) — a
-//       conductor posting into a lane it Dispatched with spawn_terminal is not a
-//       stranger writing into someone else's work, so no per-post tap is needed.
-// The CARD REMAINS for every other post: a non-owner posting into a lane it did
-// not spawn, in any non-bypass mode. That is the load-bearing invariant — a lane
-// can never be posted into by a non-owner without a human tap, except in bypass.
-// Cross-ROOM post_to_session is a SEPARATE path (dual-consent) and is untouched.
-// Spec: docs/specs/2026-07-03-xpost-consent-scope.md
-export const crossPostNeedsCard = ({ mode = 'default', spawnedByMe = false } = {}) =>
-  !(mode === 'bypassPermissions' || spawnedByMe === true)
-
-// ── Tier C+: cross-terminal SPAWN (open a FRESH lane the agent owns) ──────────
-// Pure gate for whether a session may open a new terminal on THIS call. The
-// motivating bug: an agent dumped a fan-out into SIBLINGS that were already
-// working (a bridge release lane, a Q&A lane) because it had no way to make its
-// OWN lanes. spawn_terminal gives it fresh lanes; this gate keeps that from
-// becoming a fork bomb. Bounds, in order:
-//   • kill-switch (TP_SPAWN_OFF)
-//   • hop — a lane REACHED via cross-post/spawn (hop ≥ 1) cannot spawn onward.
-//     Cascade conductors now use the independent main-terminal lifecycle; every
-//     Ensemble-spawned lane is a worker (the loop breaker mirrors CROSSPOST).
-//   • machineMax — overall hard cap on LIVE lanes (sessions+terms): the runaway /
-//     don't-melt-the-laptop backstop, plan-INDEPENDENT.
-//   • dispatch ceiling — a SEPARATE, plan-tiered budget counting ONLY spawned lanes
-//     (Free 3 / Plus 6). Counts spawned lanes ONLY, so they never block the human's
-//     own terminals, and the human's terminals never eat the dispatch budget. Under
-//     BYOK-only the tokens are the user's, so this is feature-shaping + machine
-//     safety, NOT a ThinkPool-COGS control.
-//   • burst window — a SLIDING-window runaway breaker: ≤ perWindowCap spawns per
-//     rolling windowMs. Replaces the old per-HUMAN-turn cap, which starved an
-//     UNATTENDED conductor: agent turns woken by Monitor/task notifications never
-//     traverse the 'code-turn' handler that reset the per-turn counter, so a cascade
-//     that spent its 4 spawns could NEVER spawn again until a person typed. The
-//     window replenishes on wall-clock alone — no turn boundary required — while a
-//     real human turn still clears it instantly (the reset point is unchanged).
-// The caller measures: spawnedLive (live sessions with spawnedBy set), totalLive
-// (sessions.size + terms.size), resolves `plan` from the room owner, and passes the
-// lane's recent spawn timestamps (`spawnTimes`) plus the current clock (`now`) — so
-// this stays a PURE function (no Date.now inside; the clock is injected, like
-// spawnCount was before).
-export const SPAWN = {
-  maxHop: 1,               // main terminal/conductor = hop 0 and may dispatch workers;
-                           // Ensemble worker = hop 1 and can never spawn onward. Conductors
-                           // are created via open_main_terminal, not spawn_terminal.
-  perWindowCap: 6,         // spawn_terminal calls allowed per rolling window (burst breaker);
-                           // 6 matches plusMaxSpawned so one wave can open a full crew (was 4)
-  windowMs: 10 * 60 * 1000, // sliding window over which perWindowCap applies (10 min)
-  freeMaxSpawned: 3,       // Free plan dispatch ceiling (concurrent spawned lanes)
-  plusMaxSpawned: 6,       // Plus plan dispatch ceiling
-  machineMax: 12,          // hard cap on TOTAL live lanes (the laptop/runaway backstop). 10 → 12
-                           // 2026-07-10: finished-but-open lanes were starving slots. NOT higher:
-                           // at ~10 live lanes CPU contention corrupted Lighthouse runs that day —
-                           // this cap protects the host and measurement quality, not just runaway.
-}
-
-// Plan → dispatch ceiling. Anything not 'plus' is treated as Free (the safe default).
-export const maxSpawnedFor = (plan, limits = SPAWN) => {
-  const o = { ...SPAWN, ...(limits || {}) }
-  return plan === 'plus' ? o.plusMaxSpawned : o.freeMaxSpawned
-}
-
-// Count spawn timestamps still inside the sliding window ending at `now`. Timestamps
-// strictly older than `now - windowMs` have replenished (fallen out of the window).
-// Non-finite entries are ignored defensively. Exported so the bridge can prune its
-// stored spawnTimes with the identical predicate (no unbounded growth).
-export const recentSpawnCount = (spawnTimes, now, windowMs = SPAWN.windowMs) =>
-  (Array.isArray(spawnTimes) ? spawnTimes : []).filter((t) => Number.isFinite(t) && t > now - windowMs).length
-
-export const spawnDecision = ({ hop = 0, spawnTimes = [], now = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) => {
-  const o = { ...SPAWN, ...(limits || {}) }
-  if (disabled) return { ok: false, reason: 'Spawning terminals is disabled in this room.' }
-  if (hop >= o.maxHop) return { ok: false, reason: 'Spawn limit reached — a terminal reached via cross-terminal cannot itself open further terminals; a person must open the next lane.' }
-  if (totalLive >= o.machineMax) return { ok: false, reason: `Room is at the machine cap (${o.machineMax} live lanes) — close one before opening another.` }
-  const cap = maxSpawnedFor(plan, o)
-  if (spawnedLive >= cap) return { ok: false, reason: `Dispatch ceiling reached (${cap} lane${cap === 1 ? '' : 's'} on the ${plan} plan)${plan !== 'plus' ? ` — Plus raises it to ${o.plusMaxSpawned}.` : '.'} Close a dispatched lane to open another.` }
-  if (recentSpawnCount(spawnTimes, now, o.windowMs) >= o.perWindowCap) {
-    const mins = Math.round(o.windowMs / 60000)
-    return { ok: false, reason: `Spawn burst limit reached (${o.perWindowCap} in ${mins} min) — this replenishes as the window slides forward, or instantly when a person types into this lane.` }
-  }
-  return { ok: true }
-}
-
-// ── Previewed Dispatch contract ────────────────────────────────────────────
-// The durable pair-control row remains the approval authority. This contract
-// supplies the immutable, secret-free object that row refers to and the bridge
-// rechecks immediately before it spends a lane. No token, provider credential,
-// host path, or mutable process object is copied into the preview.
-const DISPATCH_ARG_KEYS = Object.freeze(['mode', 'model', 'name', 'provider', 'runtime', 'sliceType', 'task'])
-// `review` is an internal Codex-only mode selected by structuredModeForSlice.
-// It is not user-selectable in the spawn schema, but it must survive the immutable
-// preview boundary or every Codex review lane fails before creation.
-const DISPATCH_MODES = new Set(['default', 'acceptEdits', 'bypassPermissions', 'plan', 'review'])
-const DISPATCH_RUNTIMES = new Set(['claude', 'codex', 'hermes'])
-const DISPATCH_SLICES = new Set(['scaffold', 'feature', 'fix', 'review'])
-const secretValue = /((?<![a-z0-9])sk-[a-z0-9_-]{8,}|(?<![a-z0-9])gsk_[a-z0-9_-]{8,}|(?<![a-z0-9])AIza[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,})/ig
-const hostPath = /(?:\/home\/|\/users\/|\/private\/|\/tmp\/|[a-z]:\\|\\\\)/ig
-const canonical = (value) => {
-  if (Array.isArray(value)) return value.map(canonical)
-  if (value && typeof value === 'object') return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])]))
-  return value
-}
-const sha256 = (value) => createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex')
-const bounded = (value, max) => value == null ? null : String(value).slice(0, max)
-const safeCopy = (value, max) => bounded(value, max)?.replace(secretValue, '[credential redacted]').replace(hostPath, '[host path redacted]') || ''
-
-export function normalizeDispatchArgs (args = {}, inherited = {}) {
-  if (!args || typeof args !== 'object' || Array.isArray(args) || Object.keys(args).some((key) => !DISPATCH_ARG_KEYS.includes(key))) {
-    throw new TypeError('Invalid dispatch arguments')
-  }
-  const runtime = args.runtime || inherited.runtime || 'claude'
-  const mode = args.mode || (inherited.mode === 'plan' ? 'default' : inherited.mode) || 'default'
-  if (!DISPATCH_RUNTIMES.has(runtime) || !DISPATCH_MODES.has(mode) || (args.sliceType && !DISPATCH_SLICES.has(args.sliceType))) {
-    throw new TypeError('Invalid dispatch arguments')
-  }
-  return Object.freeze({
-    name: bounded(args.name, 80),
-    task: bounded(args.task, 12000),
-    model: bounded(args.model, 160),
-    sliceType: bounded(args.sliceType, 24),
-    runtime,
-    provider: bounded(args.provider, 160),
-    mode,
-  })
-}
-
-export function dispatchCapSnapshot ({ hop = 0, spawnTimes = [], now = 0, spawnedLive = 0, totalLive = 0, plan = 'free', disabled = false } = {}, limits = SPAWN) {
-  const o = { ...SPAWN, ...(limits || {}) }
-  const planName = plan === 'plus' ? 'plus' : 'free'
-  const planLimit = maxSpawnedFor(planName, o)
-  return Object.freeze({
-    killSwitch: disabled === true,
-    hop: Object.freeze({ used: Math.max(0, Number(hop) || 0), limit: o.maxHop }),
-    width: Object.freeze({ requested: 1, live: Math.max(0, Number(spawnedLive) || 0), limit: planLimit }),
-    machine: Object.freeze({ live: Math.max(0, Number(totalLive) || 0), limit: o.machineMax }),
-    plan: Object.freeze({ name: planName, price: planName === 'plus' ? '€5/mo' : '€0', used: Math.max(0, Number(spawnedLive) || 0), limit: planLimit }),
-    burst: Object.freeze({ used: recentSpawnCount(spawnTimes, now, o.windowMs), limit: o.perWindowCap, windowMinutes: Math.round(o.windowMs / 60000) }),
-  })
-}
-
-export function buildDispatchPreview ({ args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
-  if (!initiatorTerminalId || !roomCode || !bridgeAuthorityId || !localAuthorityId) throw new TypeError('Dispatch authority is incomplete')
-  const exactArgs = normalizeDispatchArgs(args, { runtime: context.runtime, mode: context.mode })
-  const caps = dispatchCapSnapshot(context, limits)
-  // The terminal initiates the request; it is NOT the human approver. The human
-  // actor is bound later by code_pair_control_items.resolved_by plus the matching
-  // durable resolution/delivery-attempt events.
-  const authority = Object.freeze({ initiatorTerminalId: String(initiatorTerminalId), roomCode: String(roomCode).toUpperCase(), bridgeAuthorityId: String(bridgeAuthorityId), localAuthorityId: String(localAuthorityId) })
-  const fingerprint = sha256({ authority, exactArgs, caps })
-  const provider = exactArgs.provider || (exactArgs.runtime === 'codex'
-    ? 'OpenAI / Codex login'
-    : exactArgs.runtime === 'hermes' ? 'Hermes ACP profile' : 'Anthropic / host default')
-  const model = exactArgs.model || context.resolvedModel || 'runtime default'
-  const purpose = safeCopy(exactArgs.name || exactArgs.task?.split(/\r?\n/)[0] || 'Open one worker lane', 120)
-  return Object.freeze({
-    version: 1,
-    fingerprint,
-    purpose,
-    packages: Object.freeze([{ title: safeCopy(exactArgs.name || 'Worker package', 80), task: safeCopy(exactArgs.task || 'Open idle for a later hand-off.', 600) }]),
-    runtime: Object.freeze({
-      name: exactArgs.runtime,
-      provider: safeCopy(context.providerName || provider, 120),
-      model: safeCopy(model, 160),
-      band: 'Start: now–1 min · completion: task-dependent',
-      execution: 'Runs locally on the bridge machine; no cloud worker is created.',
-      accountAndSpend: `Uses the host’s ${safeCopy(context.providerName || provider, 100)} account/BYOK. Provider usage is the spend source; ThinkPool has no credit meter.`,
-    }),
-    permissions: Object.freeze({ mode: exactArgs.mode, consequence: exactArgs.mode === 'bypassPermissions'
-      ? 'Unattended local access within this worker’s sandbox and tool policy.'
-      : exactArgs.mode === 'review' ? 'Read-only inspection of the pinned parent snapshot; writes and approval escapes are unavailable.'
-        : exactArgs.mode === 'plan' ? 'Planning only; execution remains gated.' : 'Protected local actions keep their normal permission gates.' }),
-    worktree: 'Automatically creates one visible lateral worker lane and an isolated git worktree on this machine.',
-    caps,
-  })
-}
-
-export function authorizeDispatchApproval ({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, decision = 'allow', consumed = false, permissionId = null, consumedPermissionId = null, limits = SPAWN } = {}) {
-  if (decision !== 'allow') return { ok: false, code: 'dispatch_canceled' }
-  if (consumed) return { ok: false, code: permissionId && permissionId === consumedPermissionId ? 'idempotent_replay' : 'approval_replayed' }
-  return authorizeBoundDispatch({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits })
-}
-
-// Spawned workers are autonomous by product contract: Dispatch never pauses on
-// a room approval card, and every worker runs in bypassPermissions. The immutable
-// preview still binds the exact package and caps, which are rechecked immediately
-// before opening the lane.
-export function authorizeDirectDispatch ({ preview, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
-  return authorizeBoundDispatch({ preview, approvedFingerprint: preview?.fingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits })
-}
-
-function authorizeBoundDispatch ({ preview, approvedFingerprint, args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context = {}, limits = SPAWN } = {}) {
-  let current
-  try { current = buildDispatchPreview({ args, initiatorTerminalId, roomCode, bridgeAuthorityId, localAuthorityId, context, limits }) } catch { return { ok: false, code: 'invalid_dispatch' } }
-  if (!preview || preview.fingerprint !== approvedFingerprint) return { ok: false, code: 'approval_mismatch' }
-  if (current.fingerprint !== preview.fingerprint) return { ok: false, code: 'stale_dispatch' }
-  const gate = spawnDecision(context, limits)
-  if (!gate.ok) return { ok: false, code: 'cap_denied', reason: gate.reason }
-  return { ok: true, code: 'approved', preview: current }
-}
-
-// A public Realtime broadcast is only a wake-up hint. This verifier consumes the
-// rows the bridge re-read through its authenticated room-member token. Exactly one
-// durable winner (resolved_by) must own both the resolution and the single delivery
-// attempt, and every immutable authority/fingerprint field must match.
-export function verifyDurableDispatchAuthority ({ item, events = [], expected = {} } = {}) {
-  const fail = (code) => ({ ok: false, code })
-  const fp = String(expected.fingerprint || '')
-  if (!item || item.id !== expected.controlItemId) return fail('control_item_mismatch')
-  if (item.session_code !== String(expected.roomCode || '').toUpperCase()) return fail('wrong_room')
-  if (item.action_kind !== 'dispatch' || item.item_kind !== 'approval') return fail('wrong_action')
-  if (item.status !== 'resolved' || item.resolution_code !== 'approved' || !item.resolved_by) return fail('not_approved')
-  if (item.resolution_policy !== 'either_member' || item.required_actor_id != null) return fail('wrong_resolution_policy')
-  if (item.bridge_authority_id !== expected.bridgeAuthorityId) return fail('wrong_bridge_authority')
-  if (item.local_authority_id !== expected.localAuthorityId) return fail('wrong_local_authority')
-  if (!/^[0-9a-f]{64}$/.test(fp)) return fail('invalid_fingerprint')
-  if (!String(item.request_context?.action || '').includes(`fp:${fp}`)) return fail('request_fingerprint_mismatch')
-  if (item.resolution_payload?.dispatch_fingerprint !== fp) return fail('resolution_fingerprint_mismatch')
-  const relevant = (Array.isArray(events) ? events : []).filter((event) => event?.item_id === item.id)
-  const resolutions = relevant.filter((event) => event.event_type === 'resolved' && event.actor_id === item.resolved_by &&
-    event.payload?.resolution_payload?.dispatch_fingerprint === fp && event.payload?.resolution_code === 'approved')
-  if (resolutions.length !== 1) return fail('resolution_event_mismatch')
-  const attempts = relevant.filter((event) => event.event_type === 'delivery_attempted' && event.actor_id === item.resolved_by &&
-    event.payload?.data?.dispatch_fingerprint === fp)
-  if (attempts.length !== 1) return fail('delivery_attempt_mismatch')
-  if (relevant.some((event) => event.event_type === 'delivered' || event.event_type === 'delivery_failed')) return fail('delivery_already_final')
-  return { ok: true, code: 'durable_dispatch_authorized', fingerprint: fp, humanActorId: item.resolved_by, attemptKey: attempts[0].correlation_key }
-}
-
-// When a spawn is refused, "close one before opening another" is useless advice if the
-// caller has to go hunting for WHICH one. Rooms fill up with finished lanes nobody
-// closed (Max, 2026-07-10: "clean up the finished ensemble terminals there's a lot"),
-// because the old preamble asked politely and nothing named the cost. So the refusal
-// now names the caller's OWN idle spawned lanes — the exact ones close_terminal will
-// accept — newest last, capped so a long list can't drown the reason above it.
-//
-// Pure: takes the roster, returns a string. `lanes` = [{ ref, name, spawnedBy, busy }].
-// Only lanes this caller spawned are suggested: close_terminal refuses the others, and
-// suggesting a sibling's lane is how you get an agent killing someone else's work.
-export const CLOSABLE_HINT_MAX = 6
-export const closeLaneDecision = ({ callerId, spawnedBy, busy } = {}) => {
-  if (!callerId || spawnedBy !== callerId) return { ok: false, reason: 'not-owner' }
-  if (busy) return { ok: false, reason: 'busy' }
-  return { ok: true }
-}
-
-export const closableLanes = (callerId, lanes = []) =>
-  (Array.isArray(lanes) ? lanes : []).filter((l) => l && closeLaneDecision({
-    callerId,
-    spawnedBy: l.spawnedBy,
-    busy: l.busy,
-  }).ok)
-
-export const formatClosableHint = (callerId, lanes = [], max = CLOSABLE_HINT_MAX) => {
-  const idle = closableLanes(callerId, lanes)
-  if (!idle.length) return ''
-  const shown = idle.slice(0, max)
-  const list = shown.map((l) => `${l.ref}${l.name ? ` ("${l.name}")` : ''}`).join(', ')
-  const more = idle.length > shown.length ? ` (+${idle.length - shown.length} more)` : ''
-  return `\n\nYou have ${idle.length} finished lane${idle.length === 1 ? '' : 's'} of your own still open — collect ${idle.length === 1 ? 'it' : 'them'} with read_terminal, then close_terminal: ${list}${more}`
-}
-
-// ── Tier 1 cross-ROOM peek (read-only, same-machine) ─────────────────────────
-// Thinkpool Ensemble expanded from cross-TERMINAL (sibling lanes in one room) to
-// cross-SESSION (the account's OTHER rooms served by the same account supervisor).
-// This module only formats the ROSTER of other rooms; the per-room terminal read
-// reuses formatPeek as-is on the REMOTE side (the target room's bridge runs it over
-// its own registries). Cross-room is rarer + costlier than in-room peek (an IPC /
-// future-bus round-trip per call), so the per-turn cap is tighter than PEEK's.
-// Spec: docs/specs/2026-06-30-cross-room-ensemble.md
-export const CROSSROOM = {
-  peekPerTurnCap: 5,   // list_sessions + read_session calls allowed per turn (vs PEEK.perTurnCap=10 in-room)
-}
-
-// Canonical ThinkPool peer capability names. Claude/Codex receive the SDK MCP
-// server directly; Hermes reconstructs a process-local schema and therefore
-// needs the same names explicitly. Keep the peer surface here beside its gates
-// so a runtime cannot silently lose cross-room reach when the server grows.
-export const PEER_READ_MCP_TOOLS = Object.freeze([
-  'read_terminal',
-  'list_sessions',
-  'read_session',
-])
-
-export const PEER_POST_MCP_TOOLS = Object.freeze([
-  'post_to_terminal',
-  'post_to_session',
-])
-
-export const PEER_MCP_TOOLS = Object.freeze([
-  ...PEER_READ_MCP_TOOLS,
-  ...PEER_POST_MCP_TOOLS,
-])
-
-// Render the list_sessions roster from the supervisor's room list. `rooms` is
-// [{ code, name }]; `thisRoom` is excluded defensively (the supervisor already
-// drops it). Mirrors formatPeek's no-arg roster shape so the agent reads one voice.
-export const formatPairRoster = (rooms, { thisRoom, error } = {}) => {
-  if (error) return String(error)
-  const seen = new Set()
-  const list = (Array.isArray(rooms) ? rooms : []).filter((r) => {
-    if (!r || !r.code || r.code === thisRoom || seen.has(r.code)) return false
-    seen.add(r.code); return true
-  })
-  if (!list.length) return 'No other sessions of yours are open right now. (Cross-session reach is limited to rooms this account is running here, plus your partner\'s rooms in the same pair.)'
-  // `host` is set for a Tier-2 cross-MACHINE room (it lives on a partner's Mac,
-  // reached over the pair bus); a same-machine Tier-1 room has none. Rendering the
-  // host tells the agent (and the people) which rooms are "over there".
-  const rows = list.map((r) => `- ${r.code}${r.name ? ` · "${r.name}"` : ''}${r.host ? ` · on ${r.host}` : ''}${r.online === false ? ' · partner bridge offline' : ''}`)
-  return `Your other ThinkPool Code sessions (call read_session with a room code to look inside one):\n${rows.join('\n')}`
-}
-
-// ── Tier 2 cross-MACHINE peek — the pair bus ─────────────────────────────────
-// Tier 1 reached the account's OTHER rooms on the SAME machine over Node IPC.
-// Tier 2 reaches a PARTNER's rooms on ANOTHER machine over a per-pair Supabase
-// Broadcast channel, `tppair:<pairKey>`. The firewall IS the channel: only the
-// two people who actually share a 2-person room can join it (RLS on
-// realtime.messages, server-side) — so a supervisor never even hears a stranger's
-// room, and there's no client-side trust to get wrong. pairKeyFor builds the
-// IDENTICAL channel name on both Macs from the two participant UUIDs, so they meet
-// on the same bus without coordinating. Spec: docs/specs/2026-06-30-cross-room-pair-bus.md
-export const CROSSROOM_BUS = {
-  busTimeoutMs: 4000,   // a cross-MACHINE round-trip fails soft after this (never hangs a turn)
-}
-
-// Deterministic, order-INDEPENDENT channel key for the pair {a, b}: lowercased,
-// sorted, dot-joined. Both Macs derive the same string from the shared room's two
-// participants, so they subscribe to the same tppair channel. Returns null unless
-// given two DISTINCT uuids — a self-only "pair" (one participant) has no partner on
-// another machine to reach, so it gets no bus.
-export const pairKeyFor = (a, b) => {
-  const x = String(a == null ? '' : a).toLowerCase().trim()
-  const y = String(b == null ? '' : b).toLowerCase().trim()
-  if (!x || !y || x === y) return null
-  return x < y ? `${x}.${y}` : `${y}.${x}`
-}
-
-// The realtime topic both supervisors subscribe to for a pair. The two UUIDs in the
-// name are not secrets (they're already in tpacct:<uid>), and the RLS policy re-derives
-// + verifies membership server-side; the name is just the rendezvous point.
-export const pairTopic = (key) => key ? `tppair:${key}` : null
-
-// ── Tier 3 cross-ROOM POST — directed, dual-consent, possibly cross-machine ──
-// Posting work INTO another room (yours on this machine, or a partner's over the
-// pair bus). Deliberately TIGHTER than the in-room cross-TERMINAL post (CROSSPOST):
-// it spends real model tokens in another room — maybe on another person's machine —
-// so (a) the per-turn cap starts at ONE, (b) a room reached VIA a cross-room post
-// cannot post onward (roomHop loop-breaker), and (c) BOTH ends gate on a person:
-// the sender's room approves the send, the recipient's room approves the receipt.
-// The bridge enforces (a)+(b) here; the dual cards live in the gate + the web.
-// Kill-switch: TP_PAIRBUS_OFF (the same switch that disables the bus).
-export const CROSSROOM_POST = {
-  maxRoomHop: 1,          // human turn = roomHop 0; a turn injected via cross-room post = 1, which CANNOT post onward
-  crossRoomPostCap: 1,    // post_to_session calls allowed per human turn (tighter than in-room CROSSPOST.perTurnCap)
-}
-
-export const crossRoomPostDecision = ({ roomHop = 0, postCount = 0, disabled = false } = {}, limits = CROSSROOM_POST) => {
-  const o = { ...CROSSROOM_POST, ...(limits || {}) }
-  if (disabled) return { ok: false, reason: 'Cross-room posting is turned off on this bridge.' }
-  if (roomHop >= o.maxRoomHop) return { ok: false, reason: 'Cross-room hop limit reached — a room reached via a cross-room post cannot itself post into another room; a person must direct the next cross-room action.' }
-  if (postCount >= o.crossRoomPostCap) return { ok: false, reason: `Cross-room post limit reached for this turn (${o.crossRoomPostCap}).` }
-  return { ok: true }
-}
+import{createHash as e}from"node:crypto";import{BLOCKED_REASON as t,projectLaneLifecycle as r}from"./lane-lifecycle.mjs";export const PEEK={defaultLines:20,maxLines:200,perTurnCap:10,rosterPerTurnCap:1,lineCap:200,rosterPreview:100};export const readTerminalBudgetDecision=({targeted:e=!1,targetedCount:t=0,rosterCount:r=0}={},n=PEEK)=>{const o=Math.max(0,Number(t)||0),i=Math.max(0,Number(r)||0);return e?o>=n.perTurnCap?{ok:!1,targetedCount:o,rosterCount:i,reason:`Cross-terminal transcript read limit reached for this turn (${n.perTurnCap}). Stop polling and continue with the worker results already collected; a fresh accepted room turn resets the allowance.`}:{ok:!0,targetedCount:o+1,rosterCount:i}:i>=n.rosterPerTurnCap?{ok:!1,targetedCount:o,rosterCount:i,reason:`The full terminal roster was already read this turn (${n.rosterPerTurnCap}/${n.rosterPerTurnCap}). Use the current ROOM NOW snapshot or read one relevant terminal by ref or name.`}:{ok:!0,targetedCount:o,rosterCount:i+1}};export const readTerminalTurnBudgetDecision=({targeted:e=!1,targetedCount:t=0,rosterCount:r=0,budgetTurnRev:n=null,currentTurnRev:o=0}={},i=PEEK)=>{const s=Math.max(0,Number(o)||0),a=(null==n?null:Number.isFinite(Number(n))?Number(n):null)===s;return{...readTerminalBudgetDecision({targeted:e,targetedCount:a?t:0,rosterCount:a?r:0},i),budgetTurnRev:s}};export const LANE_STATUS={stuckAfterMs:9e4,repeatedFailureCount:2,failureWindow:12};const n=e=>!!e&&("error"===e.kind||"tool_result"===e.kind&&e.isError||"result"===e.kind&&e.subtype&&"success"!==e.subtype);export const laneBusyOf=(e={})=>"boolean"==typeof e?.busy?e.busy:"boolean"==typeof e?._busyAnn?e._busyAnn:e?.session?.turnActive??!1;export const settleLaneBusy=e=>!(!e||!1===e._busyAnn||(e._busyAnn=!1,0));export const settleLaneControl=(e,t=Date.now())=>!(!e||!0!==e._busyAnn||!settleLaneBusy(e)||(e._settledTurnRev=Number(e._turnRev)||null,e._turnSettledAt=Number(t)||Date.now(),e._turnStart=null,0));export const laneStatusOf=(e={},o=Date.now(),i=LANE_STATUS)=>{const s=Array.isArray(e?.log)?e.log:[],a=s.slice(-i.failureWindow);!e?.lastEvent||e.lastEvent===s[s.length-1]||e.lastEvent.cid&&e.lastEvent.cid===s[s.length-1]?.cid||a.push(e.lastEvent);let l=null;for(let e=a.length-1;e>=0;e--)if(Number.isFinite(a[e]?.ts)){l=a[e].ts;break}const c=Number.isFinite(e?.lastActionAt)?e.lastActionAt:l??null,d=null==c?null:Math.max(0,o-c),u=laneBusyOf(e),p=e?.pending instanceof Map?e.pending.size:Math.max(0,Number(e?.pendingCount)||0),m=e?.pending instanceof Map&&[...e.pending.values()].some(e=>"ask"===e?.payload?.risk)?t.NEEDS_INPUT:t.NEEDS_DECISION,h=((e,t=LANE_STATUS)=>{let r=0,o=0;for(let i=(Array.isArray(e)?e.length:0)-1;i>=0&&o<t.failureWindow;i--){const t=e[i];if(t&&"object"==typeof t){if(o++,"result"===t.kind&&(!t.subtype||"success"===t.subtype)||"you"===t.kind)break;n(t)&&r++}}return r})(a,i);let f=null,g=null;return p>0?(f="BLOCKED",g="waiting for input"):e?.stalled||u&&!e?.compacting&&null!=d&&d>=i.stuckAfterMs?(f="STUCK",g="no events while busy"):h>=i.repeatedFailureCount&&(f="BLOCKED",g="repeated errors"),{busy:!!u,lastActionAt:c,lastActionAgeMs:d,statusFlag:f,statusReason:g,lifecycle:r({events:a,busy:!!u,pendingCount:p,pendingReason:m,stalled:"STUCK"===f,failed:h>=i.repeatedFailureCount&&!u,rawStatus:f||(u?"busy":"idle")})}};export const formatLaneAge=e=>{if(!Number.isFinite(e))return"no activity";const t=Math.max(0,Math.floor(e/1e3));if(t<60)return`${t}s ago`;const r=Math.floor(t/60);if(r<60)return`${r}m ago`;const n=Math.floor(r/60);return n<24?`${n}h ago`:`${Math.floor(n/24)}d ago`};const o=e=>`${e.lifecycle?.state||"Blocked"}${e.lifecycle?.reason?` (${e.lifecycle.reason})`:""} · ${formatLaneAge(e.lastActionAgeMs)}`,i=(e,t)=>{const r=String(null==e?"":e).replace(/\s+/g," ").trim();return r.length>t?r.slice(0,t-1)+"…":r};export const digestLogEvent=(e,t=PEEK.lineCap)=>{if(!e||"object"!=typeof e)return"";switch(e.kind){case"you":return i(`${e.by||"someone"}: ${e.text||""}`,t);case"assistant":{const r=[];for(const t of Array.isArray(e.blocks)?e.blocks:[])"text"===t?.type&&String(t.text||"").trim()?r.push(String(t.text).trim()):"tool_use"===t?.type&&t.name&&r.push(`→ ${t.name}`);return r.length?i(`assistant: ${r.join(" ")}`,t):""}case"tool_result":return e.isError?i("⎿ error",t):"";case"result":return e.subtype&&"success"!==e.subtype?i(`turn ended — ${e.subtype}`,t):"";case"error":return i(`error: ${e.message||""}`,t);default:return""}};export const cleanPtyTail=(e,t)=>String(e||"").replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g,"").replace(/\x1b[@-_][0-?]*[ -/]*[@-~]/g,"").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").split(/\r?\n/).map(e=>e.replace(/\s+$/,"")).filter(e=>e.trim()).slice(-Math.max(1,t));export const siblingRef=e=>String(e).slice(0,8);export const siblingsOf=({selfId:e,sessions:t,terms:r,names:n={},now:o=Date.now()}={})=>{const i=e=>n&&n[e]||"",s=[];for(const[r,n]of t||new Map)r!==e&&s.push({id:r,ref:siblingRef(r),name:i(r),kind:"agent",cmd:n?.cmd||"claude",log:Array.isArray(n?.log)?n.log:[],...laneStatusOf(n,o)});for(const[t,n]of r||new Map)t!==e&&s.push({id:t,ref:siblingRef(t),name:i(t),kind:"shell",cmd:n?.cmd||"shell",buf:n?.buf||"",...laneStatusOf(n,o)});return s};export const isOrdinalRef=e=>/^(terminal\s*)?\d+$/i.test(e)||/^t\d+$/i.test(e);export const resolveSibling=(e,t)=>{const r=String(t||"").toLowerCase().trim();if(!r)return null;const n=Array.isArray(e)?e:[];return n.find(e=>String(e.id).toLowerCase()===r)||n.find(e=>String(e.name||"").toLowerCase()===r)||n.find(e=>String(e.ref).toLowerCase()===r)||(isOrdinalRef(r)?null:n.find(e=>r.length>=4&&String(e.id).toLowerCase().startsWith(r))||n.find(e=>e.name&&String(e.name).toLowerCase().includes(r))||n.find(e=>String(e.cmd).toLowerCase().includes(r))||null)};const s=e=>`${e.ref}${e.name?` · "${e.name}"`:""}`;export const formatPeek=({selfId:e,sessions:t,terms:r,names:n={},terminal:a,lines:l,now:c=Date.now()}={})=>{const d=Math.min(PEEK.maxLines,Math.max(1,Number(l)||PEEK.defaultLines)),u=siblingsOf({selfId:e,sessions:t,terms:r,names:n,now:c});if(!u.length)return"No other terminals are open in this room right now.";if(!a)return`Other terminals in this room (call read_terminal with a ref or name to read one):\n${u.map(e=>{let t;if("agent"===e.kind){const r=e.log.map(e=>digestLogEvent(e,PEEK.rosterPreview)).filter(Boolean);t=r[r.length-1]||"(no activity yet)"}else t=cleanPtyTail(e.buf,1)[0]||"(no output yet)";return`- ${s(e)} · ${e.kind} · ${e.cmd} · ${o(e)} — ${i(t,PEEK.rosterPreview)}`}).join("\n")}`;const p=resolveSibling(u,a);if(!p)return`No terminal matches "${a}". Call read_terminal with no argument to list the open terminals (refer to one by its name or ref).${isOrdinalRef(String(a||"").toLowerCase().trim())?" On-screen numbers like \"Terminal N\" shift when a terminal closes, so they can't identify a lane — use a terminal's name or ref instead.":""}`;let m;return m="agent"===p.kind?p.log.map(e=>digestLogEvent(e,PEEK.lineCap)).filter(Boolean).slice(-d).join("\n")||"(no activity yet)":cleanPtyTail(p.buf,d).join("\n")||"(no output yet)",`Terminal ${s(p)} (${p.kind} · ${p.cmd}) · ${o(p)} — last ${d} lines:\n${m}`};export const nativeClaudeProviderAccessFailed=e=>{let t="";try{t="string"==typeof e?e:JSON.stringify(e||"")}catch{t=String(e||"")}return/organization has disabled (?:claude(?: subscription access)?|subscription access)|(?:claude )?subscription access (?:has been |is )?disabled|invalid anthropic (?:api )?key|invalid x-api-key|not logged in to claude|(?:run|use) \/login[^\n]{0,80}claude|no valid anthropic (?:api )?key/i.test(t)};const a=Object.freeze(["nous:anthropic/claude-sonnet-4.6","nous:anthropic/claude-sonnet-4.5","nous:anthropic/claude-sonnet-4"]);export const preferredHermesClaudeReviewModel=(e=[])=>{const t=new Set((Array.isArray(e)?e:[]).map(e=>"string"==typeof e?e:e?.value||e?.slug).filter(Boolean));for(const e of a)if(t.has(e))return e;for(const e of t)if(/^nous:anthropic\/claude-sonnet-/i.test(e))return e;for(const e of t)if(/^nous:anthropic\/claude-haiku-/i.test(e))return e;for(const e of t)if(/^nous:anthropic\/claude-opus-/i.test(e))return e;return null};export const nativeClaudeFallbackHint=({parentRuntime:e,parentModels:t,targetRuntime:r,targetLog:n}={})=>{if("claude"!==r||!nativeClaudeProviderAccessFailed(n))return"";const o="ThinkPool provider status: native Claude access failed at the account/provider level. Do not retry Sonnet, Opus, Haiku, or another model alias on the same native Claude provider during this task.",i="hermes"===e?preferredHermesClaudeReviewModel(t):null;return i?`\n\n${o} For a visible manual review fallback, spawn exactly one worker with runtime="hermes", model=${JSON.stringify(i)}, mode="default", and sliceType="review". This Hermes lane is permission-gated, not structurally read-only: instruct it not to edit, deny/stop any write request, and do not treat its review as a Flow safety proof. Never use Hermes delegate_task.`:`\n\n${o} Use a different available runtime/provider once, or report the blocker.`};export const ROOMNOW={laneCap:8,previewLen:70,wtCap:10};export const formatRoomNow=({selfId:e,sessions:t,terms:r,names:n={},worktrees:a=[],now:l=Date.now()}={},c=ROOMNOW)=>{const d=siblingsOf({selfId:e,sessions:t,terms:r,names:n,now:l}),u=[];if(d.length){const e=d.slice(0,c.laneCap),t=e.map(e=>{let t;if("agent"===e.kind){const r=e.log.map(e=>digestLogEvent(e,c.previewLen)).filter(Boolean);t=r[r.length-1]||"(no activity yet)"}else t=cleanPtyTail(e.buf,1)[0]||"(no output yet)";return`- ${s(e)} · ${e.kind} · ${o(e)} — ${i(t,c.previewLen)}`});d.length>e.length&&t.push(`- … +${d.length-e.length} more (read_terminal lists all)`),u.push(`Other lanes in this room right now (this is the roster; use targeted read_terminal only for needed detail):\n${t.join("\n")}`)}const p=Array.isArray(a)?a:[],m=p.slice(0,c.wtCap);if(m.length){const e=m.map(e=>`- ${i(e,c.previewLen+30)}`);p.length>m.length&&e.push(`- … +${p.length-m.length} more (\`git worktree list\` shows all)`),u.push(`Active git worktrees on this host (code edits go in your OWN worktree — never one another lane is on):\n${e.join("\n")}`)}return u.length?`ROOM NOW (live snapshot, this turn):\n${u.join("\n")}`:null};export const CROSSPOST={maxHop:1,perTurnCap:3};export const crossPostDecision=({hop:e=0,postCount:t=0,disabled:r=!1}={},n=CROSSPOST)=>{const o={...CROSSPOST,...n||{}};return r?{ok:!1,reason:"Cross-terminal posting is disabled in this room."}:e>=o.maxHop?{ok:!1,reason:"Cross-terminal hop limit reached — an agent reached via cross-post cannot itself post onward; a person must direct the next cross-terminal action."}:t>=o.perTurnCap?{ok:!1,reason:`Cross-terminal post limit reached for this turn (${o.perTurnCap}).`}:{ok:!0}};export const crossPostNeedsCard=({mode:e="default",spawnedByMe:t=!1}={})=>!("bypassPermissions"===e||!0===t);export const SPAWN={maxHop:1,perWindowCap:6,windowMs:6e5,freeMaxSpawned:3,plusMaxSpawned:6,machineMax:12};export const maxSpawnedFor=(e,t=SPAWN)=>{const r={...SPAWN,...t||{}};return"plus"===e?r.plusMaxSpawned:r.freeMaxSpawned};export const recentSpawnCount=(e,t,r=SPAWN.windowMs)=>(Array.isArray(e)?e:[]).filter(e=>Number.isFinite(e)&&e>t-r).length;export const spawnDecision=({hop:e=0,spawnTimes:t=[],now:r=0,spawnedLive:n=0,totalLive:o=0,plan:i="free",disabled:s=!1}={},a=SPAWN)=>{const l={...SPAWN,...a||{}};if(s)return{ok:!1,reason:"Spawning terminals is disabled in this room."};if(e>=l.maxHop)return{ok:!1,reason:"Spawn limit reached — a terminal reached via cross-terminal cannot itself open further terminals; a person must open the next lane."};if(o>=l.machineMax)return{ok:!1,reason:`Room is at the machine cap (${l.machineMax} live lanes) — close one before opening another.`};const c=maxSpawnedFor(i,l);if(n>=c)return{ok:!1,reason:`Dispatch ceiling reached (${c} lane${1===c?"":"s"} on the ${i} plan)${"plus"!==i?` — Plus raises it to ${l.plusMaxSpawned}.`:"."} Close a dispatched lane to open another.`};if(recentSpawnCount(t,r,l.windowMs)>=l.perWindowCap){const e=Math.round(l.windowMs/6e4);return{ok:!1,reason:`Spawn burst limit reached (${l.perWindowCap} in ${e} min) — this replenishes as the window slides forward, or instantly when a person types into this lane.`}}return{ok:!0}};const l=Object.freeze(["mode","model","name","provider","runtime","sliceType","task"]),c=new Set(["default","acceptEdits","bypassPermissions","plan","review"]),d=new Set(["claude","codex","hermes"]),u=new Set(["scaffold","feature","fix","review"]),p=/((?<![a-z0-9])sk-[a-z0-9_-]{8,}|(?<![a-z0-9])gsk_[a-z0-9_-]{8,}|(?<![a-z0-9])AIza[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,})/gi,m=/(?:\/home\/|\/users\/|\/private\/|\/tmp\/|[a-z]:\\|\\\\)/gi,h=e=>Array.isArray(e)?e.map(h):e&&"object"==typeof e?Object.fromEntries(Object.keys(e).sort().map(t=>[t,h(e[t])])):e,f=(e,t)=>null==e?null:String(e).slice(0,t),g=(e,t)=>f(e,t)?.replace(p,"[credential redacted]").replace(m,"[host path redacted]")||"";export function normalizeDispatchArgs(e={},t={}){if(!e||"object"!=typeof e||Array.isArray(e)||Object.keys(e).some(e=>!l.includes(e)))throw new TypeError("Invalid dispatch arguments");const r=e.runtime||t.runtime||"claude",n=e.mode||("plan"===t.mode?"default":t.mode)||"default";if(!d.has(r)||!c.has(n)||e.sliceType&&!u.has(e.sliceType))throw new TypeError("Invalid dispatch arguments");return Object.freeze({name:f(e.name,80),task:f(e.task,12e3),model:f(e.model,160),sliceType:f(e.sliceType,24),runtime:r,provider:f(e.provider,160),mode:n})}export function dispatchCapSnapshot({hop:e=0,spawnTimes:t=[],now:r=0,spawnedLive:n=0,totalLive:o=0,plan:i="free",disabled:s=!1}={},a=SPAWN){const l={...SPAWN,...a||{}},c="plus"===i?"plus":"free",d=maxSpawnedFor(c,l);return Object.freeze({killSwitch:!0===s,hop:Object.freeze({used:Math.max(0,Number(e)||0),limit:l.maxHop}),width:Object.freeze({requested:1,live:Math.max(0,Number(n)||0),limit:d}),machine:Object.freeze({live:Math.max(0,Number(o)||0),limit:l.machineMax}),plan:Object.freeze({name:c,price:"plus"===c?"€5/mo":"€0",used:Math.max(0,Number(n)||0),limit:d}),burst:Object.freeze({used:recentSpawnCount(t,r,l.windowMs),limit:l.perWindowCap,windowMinutes:Math.round(l.windowMs/6e4)})})}export function buildDispatchPreview({args:t,initiatorTerminalId:r,roomCode:n,bridgeAuthorityId:o,localAuthorityId:i,context:s={},limits:a=SPAWN}={}){if(!(r&&n&&o&&i))throw new TypeError("Dispatch authority is incomplete");const l=normalizeDispatchArgs(t,{runtime:s.runtime,mode:s.mode}),c=dispatchCapSnapshot(s,a),d=(u={authority:Object.freeze({initiatorTerminalId:String(r),roomCode:String(n).toUpperCase(),bridgeAuthorityId:String(o),localAuthorityId:String(i)}),exactArgs:l,caps:c},e("sha256").update(JSON.stringify(h(u))).digest("hex"));var u;const p=l.provider||("codex"===l.runtime?"OpenAI / Codex login":"hermes"===l.runtime?"Hermes ACP profile":"Anthropic / host default"),m=l.model||s.resolvedModel||"runtime default",f=g(l.name||l.task?.split(/\r?\n/)[0]||"Open one worker lane",120);return Object.freeze({version:1,fingerprint:d,purpose:f,packages:Object.freeze([{title:g(l.name||"Worker package",80),task:g(l.task||"Open idle for a later hand-off.",600)}]),runtime:Object.freeze({name:l.runtime,provider:g(s.providerName||p,120),model:g(m,160),band:"Start: now–1 min · completion: task-dependent",execution:"Runs locally on the bridge machine; no cloud worker is created.",accountAndSpend:`Uses the host’s ${g(s.providerName||p,100)} account/BYOK. Provider usage is the spend source; ThinkPool has no credit meter.`}),permissions:Object.freeze({mode:l.mode,consequence:"bypassPermissions"===l.mode?"Unattended local access within this worker’s sandbox and tool policy.":"review"===l.mode?"Read-only inspection of the pinned parent snapshot; writes and approval escapes are unavailable.":"plan"===l.mode?"Planning only; execution remains gated.":"Protected local actions keep their normal permission gates."}),worktree:"Automatically creates one visible lateral worker lane and an isolated git worktree on this machine.",caps:c})}export function authorizeDispatchApproval({preview:e,approvedFingerprint:t,args:r,initiatorTerminalId:n,roomCode:o,bridgeAuthorityId:i,localAuthorityId:s,context:a={},decision:l="allow",consumed:c=!1,permissionId:d=null,consumedPermissionId:u=null,limits:p=SPAWN}={}){return"allow"!==l?{ok:!1,code:"dispatch_canceled"}:c?{ok:!1,code:d&&d===u?"idempotent_replay":"approval_replayed"}:y({preview:e,approvedFingerprint:t,args:r,initiatorTerminalId:n,roomCode:o,bridgeAuthorityId:i,localAuthorityId:s,context:a,limits:p})}export function authorizeDirectDispatch({preview:e,args:t,initiatorTerminalId:r,roomCode:n,bridgeAuthorityId:o,localAuthorityId:i,context:s={},limits:a=SPAWN}={}){return y({preview:e,approvedFingerprint:e?.fingerprint,args:t,initiatorTerminalId:r,roomCode:n,bridgeAuthorityId:o,localAuthorityId:i,context:s,limits:a})}function y({preview:e,approvedFingerprint:t,args:r,initiatorTerminalId:n,roomCode:o,bridgeAuthorityId:i,localAuthorityId:s,context:a={},limits:l=SPAWN}={}){let c;try{c=buildDispatchPreview({args:r,initiatorTerminalId:n,roomCode:o,bridgeAuthorityId:i,localAuthorityId:s,context:a,limits:l})}catch{return{ok:!1,code:"invalid_dispatch"}}if(!e||e.fingerprint!==t)return{ok:!1,code:"approval_mismatch"};if(c.fingerprint!==e.fingerprint)return{ok:!1,code:"stale_dispatch"};const d=spawnDecision(a,l);return d.ok?{ok:!0,code:"approved",preview:c}:{ok:!1,code:"cap_denied",reason:d.reason}}export function verifyDurableDispatchAuthority({item:e,events:t=[],expected:r={}}={}){const n=e=>({ok:!1,code:e}),o=String(r.fingerprint||"");if(!e||e.id!==r.controlItemId)return n("control_item_mismatch");if(e.session_code!==String(r.roomCode||"").toUpperCase())return n("wrong_room");if("dispatch"!==e.action_kind||"approval"!==e.item_kind)return n("wrong_action");if("resolved"!==e.status||"approved"!==e.resolution_code||!e.resolved_by)return n("not_approved");if("either_member"!==e.resolution_policy||null!=e.required_actor_id)return n("wrong_resolution_policy");if(e.bridge_authority_id!==r.bridgeAuthorityId)return n("wrong_bridge_authority");if(e.local_authority_id!==r.localAuthorityId)return n("wrong_local_authority");if(!/^[0-9a-f]{64}$/.test(o))return n("invalid_fingerprint");if(!String(e.request_context?.action||"").includes(`fp:${o}`))return n("request_fingerprint_mismatch");if(e.resolution_payload?.dispatch_fingerprint!==o)return n("resolution_fingerprint_mismatch");const i=(Array.isArray(t)?t:[]).filter(t=>t?.item_id===e.id);if(1!==i.filter(t=>"resolved"===t.event_type&&t.actor_id===e.resolved_by&&t.payload?.resolution_payload?.dispatch_fingerprint===o&&"approved"===t.payload?.resolution_code).length)return n("resolution_event_mismatch");const s=i.filter(t=>"delivery_attempted"===t.event_type&&t.actor_id===e.resolved_by&&t.payload?.data?.dispatch_fingerprint===o);return 1!==s.length?n("delivery_attempt_mismatch"):i.some(e=>"delivered"===e.event_type||"delivery_failed"===e.event_type)?n("delivery_already_final"):{ok:!0,code:"durable_dispatch_authorized",fingerprint:o,humanActorId:e.resolved_by,attemptKey:s[0].correlation_key}}export const CLOSABLE_HINT_MAX=6;export const closeLaneDecision=({callerId:e,spawnedBy:t,busy:r}={})=>e&&t===e?r?{ok:!1,reason:"busy"}:{ok:!0}:{ok:!1,reason:"not-owner"};export const closableLanes=(e,t=[])=>(Array.isArray(t)?t:[]).filter(t=>t&&closeLaneDecision({callerId:e,spawnedBy:t.spawnedBy,busy:t.busy}).ok);export const formatClosableHint=(e,t=[],r=6)=>{const n=closableLanes(e,t);if(!n.length)return"";const o=n.slice(0,r),i=o.map(e=>`${e.ref}${e.name?` ("${e.name}")`:""}`).join(", "),s=n.length>o.length?` (+${n.length-o.length} more)`:"";return`\n\nYou have ${n.length} finished lane${1===n.length?"":"s"} of your own still open — collect ${1===n.length?"it":"them"} with read_terminal, then close_terminal: ${i}${s}`};export const CROSSROOM={peekPerTurnCap:5};export const PEER_READ_MCP_TOOLS=Object.freeze(["read_terminal","list_sessions","read_session"]);export const PEER_POST_MCP_TOOLS=Object.freeze(["post_to_terminal","post_to_session"]);export const PEER_MCP_TOOLS=Object.freeze([...PEER_READ_MCP_TOOLS,...PEER_POST_MCP_TOOLS]);export const formatPairRoster=(e,{thisRoom:t,error:r}={})=>{if(r)return String(r);const n=new Set,o=(Array.isArray(e)?e:[]).filter(e=>!(!e||!e.code||e.code===t||n.has(e.code)||(n.add(e.code),0)));return o.length?`Your other ThinkPool Code sessions (call read_session with a room code to look inside one):\n${o.map(e=>`- ${e.code}${e.name?` · "${e.name}"`:""}${e.host?` · on ${e.host}`:""}${!1===e.online?" · partner bridge offline":""}`).join("\n")}`:"No other sessions of yours are open right now. (Cross-session reach is limited to rooms this account is running here, plus your partner's rooms in the same pair.)"};export const CROSSROOM_BUS={busTimeoutMs:4e3};export const pairKeyFor=(e,t)=>{const r=String(null==e?"":e).toLowerCase().trim(),n=String(null==t?"":t).toLowerCase().trim();return r&&n&&r!==n?r<n?`${r}.${n}`:`${n}.${r}`:null};export const pairTopic=e=>e?`tppair:${e}`:null;export const CROSSROOM_POST={maxRoomHop:1,crossRoomPostCap:1};export const crossRoomPostDecision=({roomHop:e=0,postCount:t=0,disabled:r=!1}={},n=CROSSROOM_POST)=>{const o={...CROSSROOM_POST,...n||{}};return r?{ok:!1,reason:"Cross-room posting is turned off on this bridge."}:e>=o.maxRoomHop?{ok:!1,reason:"Cross-room hop limit reached — a room reached via a cross-room post cannot itself post into another room; a person must direct the next cross-room action."}:t>=o.crossRoomPostCap?{ok:!1,reason:`Cross-room post limit reached for this turn (${o.crossRoomPostCap}).`}:{ok:!0}};