thinkpool-pair 0.7.364 → 0.7.366

package/claude-session.mjs

@@ -1,1519 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   claude-session.mjs — a structured, interactive Claude Code session
-   for the ThinkPool bridge. Wraps @anthropic-ai/claude-agent-sdk:
-   one long-lived streaming-input query() per terminal, structured
-   events out, user turns + abort in, and a PreToolUse permission gate
-   that classifies each tool call's risk and round-trips the decision
-   to the room (the risk-tiered permission card).
-
-   This replaces the PTY byte relay for Claude Code only. Other CLIs
-   keep the node-pty path in bridge.mjs. Auth is the HOST's own Claude
-   Code login (Keychain / API key) — no ThinkPool credential involved.
-   Spec: docs/specs/2026-06-11-code-structured-reader.md
-   ───────────────────────────────────────────────────────────── */
-
-import { randomUUID } from 'node:crypto'
-import { createRequire } from 'node:module'
-import { readFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { query } from '@anthropic-ai/claude-agent-sdk'
-import { sanitizeSession } from './transcript-sanitize.mjs'
-import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
-import { crossPostNeedsCard } from './cross-terminal.mjs'
-import { correctContext } from './context-windows.mjs'
-import { normalizeClaudeCommandCatalog } from './claude-command-catalog.mjs'
-import { evidenceForToolResult } from './evidence-citations.mjs'
-import { THINKPOOL_CASCADE_RULE, THINKPOOL_REMOTE_DELIVERY_RULES, THINKPOOL_RUNTIME_AUTHORITY_RULE, THINKPOOL_RUNTIME_TURN_REMINDER, buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoolReminder } from './thinkpool-room-prompt.mjs'
-import { stallDecision, stallEvent, isCompactTurn } from './turn-stall.mjs'
-import { createSameTargetResilienceController, formatResilienceTrace } from './provider-resilience.mjs'
-
-// The caret-pulled SDK's real version (^0.3.x auto-upgrades on restart). Resolved
-// once at import by walking up from the package entry to its own package.json.
-const req = createRequire(import.meta.url)
-
-// Shared raw one-shot for tiny bridge-owned inference jobs. No settings, skills,
-// MCP servers, or repo instructions are loaded; callers provide the model + prompt.
-export async function claudeOneShot({ prompt, model = 'claude-haiku-4-5', cwd, env, timeoutMs = 8000 } = {}) {
-  const abortController = new AbortController()
-  const timer = setTimeout(() => { try { abortController.abort() } catch { /* noop */ } }, timeoutMs)
-  try {
-    const result = query({
-      prompt,
-      options: {
-        model,
-        ...(cwd ? { cwd } : {}),
-        env,
-        maxTurns: 1,
-        permissionMode: 'bypassPermissions',
-        settingSources: [],
-        strictMcpConfig: true,
-        mcpServers: {},
-        abortController,
-      },
-    })
-    let out = ''
-    for await (const message of result) {
-      if (message.type === 'assistant') {
-        for (const block of (message.message?.content || [])) if (block.type === 'text') out += block.text
-      }
-      if (message.type === 'result') break
-    }
-    return out.trim()
-  } finally { clearTimeout(timer) }
-}
-
-// Named in the [SDK-REGRESSION] guard below so a silent gate-change is attributable.
-const SDK_VERSION = (() => {
-  try {
-    let d = dirname(req.resolve('@anthropic-ai/claude-agent-sdk'))
-    for (let i = 0; i < 8; i++) {
-      try { const p = JSON.parse(readFileSync(join(d, 'package.json'), 'utf8')); if (p.name === '@anthropic-ai/claude-agent-sdk') return p.version } catch { /* keep walking */ }
-      const up = dirname(d); if (up === d) break; d = up
-    }
-  } catch { /* unresolved */ }
-  return 'unknown'
-})()
-
-// ── risk classification — the accent/danger tier of the permission card ──
-// low (read-only) · medium (writes/runs) · network (leaves the machine) ·
-// high (destructive, deny-first). See the permission spec + mockups.
-// Any `rm`/`rmdir` with an argument is destructive (a bare `rm NOTES.md`
-// deletes just as permanently as `rm -rf`). Plus force-push, hard reset,
-// clean -f, DROP, mkfs/dd, sudo, /dev redirects, recursive chmod/chown, etc.
-const DESTRUCTIVE = /\brm\s+\S|\brmdir\s+\S|\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)|\bdrop\s+(table|database)\b|\b(mkfs|dd)\b|\bsudo\b|>\s*\/dev\/|\bchmod\s+-R|\bchown\s+-R|\bkillall\b|\btruncate\b/i
-const READONLY_TOOLS = new Set(['Read', 'Grep', 'Glob', 'NotebookRead', 'TodoRead', 'LS'])
-const NETWORK_TOOLS = new Set(['WebFetch', 'WebSearch'])
-const WRITE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'TodoWrite'])
-
-export function classifyRisk(toolName, input) {
-  if (toolName === 'Bash') {
-    const cmd = (input && (input.command ?? input.cmd)) || ''
-    return DESTRUCTIVE.test(cmd) ? 'high' : 'medium'
-  }
-  if (READONLY_TOOLS.has(toolName)) return 'low'
-  if (NETWORK_TOOLS.has(toolName)) return 'network'
-  if (WRITE_TOOLS.has(toolName)) return 'medium'
-  // Unknown / MCP / Task tools: treat as medium (asks, amber) rather than
-  // silently allowing — safer default for a remote-driven agent.
-  return 'medium'
-}
-
-// ── safe-doc writes — auto-allow regardless of permission mode ──
-// The repo MANDATES end-of-session writes (devlogs under .claude/SESSIONS/, and
-// CLAUDE.md updates). They're append-only documentation with no runtime blast
-// radius. Carding them in `default` mode dead-ended a phone-driven paired session
-// (2026-06-15 SESSIONS-gate: every write threw a room card, deny-default + the
-// "do not retry" deny-reason made Claude abandon the write and re-explain). These
-// paths skip the card always; Bash/network/destructive/other writes are unchanged.
-// Spec: docs/specs/2026-06-15-paired-permission-safe-doc-writes.md.
-const SAFE_DOC_RE = /(^|\/)\.claude\/SESSIONS\/|(^|\/)CLAUDE\.md$/
-export function isSafeDocWrite(toolName, input) {
-  if (!WRITE_TOOLS.has(toolName)) return false
-  const p = (input && (input.file_path || input.notebook_path)) || ''
-  return SAFE_DOC_RE.test(p)
-}
-
-// The full auto-allow decision (exported for the contract test, so the policy
-// can't drift away from docs/specs/2026-06-15-paired-permission-safe-doc-writes.md).
-// Mirrors the PreToolUse policy: reads always; bypass mode always; acceptEdits for
-// non-high writes; mandated safe-doc writes always; per tool:risk "always allow".
-export function autoAllow({ toolName, input, mode = 'default', alwaysAllow = new Set() }) {
-  const risk = classifyRisk(toolName, input)
-  return (
-    risk === 'low' ||
-    mode === 'bypassPermissions' ||
-    (mode === 'acceptEdits' && WRITE_TOOLS.has(toolName) && risk !== 'high') ||
-    isSafeDocWrite(toolName, input) ||
-    alwaysAllow.has(`${toolName}:${risk}`)
-  )
-}
-
-// AskUserQuestion answer path — pure mapping from the room's requestPermission
-// result to the PreToolUse decision fed back to the model. The card handler
-// denies (PreToolUse can't inject a tool_result) and puts the human's pick in
-// the deny reason, which IS what the model receives. Exported so the feedback
-// contract is locked in a unit test (mock requestPermission → this output).
-// `decision` is the requestPermission return: either the legacy 'answer:<pick>'
-// string or { decision, responder } from the durable room control. Anything else
-// (including '' / dismissal / a broken path) is treated as "no selection".
-export function askUserQuestionHookOutput(decision) {
-  const rawDecision = decision && typeof decision === 'object' ? decision.decision : decision
-  const ans = (typeof rawDecision === 'string' && rawDecision.startsWith('answer:')) ? rawDecision.slice(7) : ''
-  const responder = decision && typeof decision === 'object' ? decision.responder : null
-  const answeredBy = typeof responder?.name === 'string' && responder.name.trim()
-    ? responder.name.trim()
-    : typeof responder?.id === 'string' && responder.id
-      ? `room member ${responder.id}`
-      : 'The user'
-  return {
-    continue: true,
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason: ans
-        ? `${answeredBy} answered in the ThinkPool room — ${ans}. Treat this as their selection and continue; do not call AskUserQuestion again for the same question.`
-        : 'The user dismissed the question in the ThinkPool room without selecting. Ask in plain prose, or proceed with a sensible default.',
-    },
-  }
-}
-
-// Regression guard for the AskUserQuestion gate. SDK 0.3.173 enabled the tool
-// unconditionally; a later bump in the 0.3.185→0.3.204 window flipped it to require
-// a `canUseTool` callback, and the ^0.3.x caret silently killed the feature on a
-// routine restart (2026-07-08). The bridge DOES pass canUseTool, so the SDK's init
-// `tools[]` MUST advertise AskUserQuestion — checked against the real init message
-// the live session already receives (no boot-time probe: cold-CLI init is flaky).
-// If the message carries a tools[] that lacks AskUserQuestion → return the loud
-// [SDK-REGRESSION] reason (logged + surfaced in the room). If it carries no tools[]
-// (older/other SDK message shape) → fail OPEN (null), never a false alarm. Pure +
-// exported so both branches are locked by a unit test.
-export function askUserQuestionRegression(tools, version) {
-  if (!Array.isArray(tools)) return null
-  if (tools.includes('AskUserQuestion')) return null
-  return `[SDK-REGRESSION] agent SDK v${version || 'unknown'} init tools[] is missing 'AskUserQuestion' — the multiple-choice question card is disabled. A caret SDK bump likely changed the canUseTool gate; pin a known-good SDK in bridge/package.json + republish.`
-}
-
-// ── input stream — a generator we keep open and feed turns into ──
-function makeInputStream() {
-  const queue = []
-  let wake = null
-  let ended = false
-  async function* gen() {
-    while (!ended) {
-      if (queue.length) { yield queue.shift(); continue }
-      await new Promise((r) => { wake = r })
-    }
-  }
-  return {
-    stream: gen(),
-    push(content) {
-      if (ended) return false      // session ended — caller (sendTurn) can surface this
-      queue.push({ type: 'user', message: { role: 'user', content } })
-      if (wake) { wake(); wake = null }
-      return true
-    },
-    end() { ended = true; if (wake) { wake(); wake = null } },
-  }
-}
-
-// Simplify SDK assistant content blocks to a stable wire shape.
-const simplifyBlocks = (blocks = []) => blocks.map((b) => {
-  if (b.type === 'text') return { type: 'text', text: b.text }
-  if (b.type === 'thinking') return { type: 'thinking', text: b.thinking || '', reasoningKind: 'thought' }
-  if (b.type === 'tool_use') return { type: 'tool_use', id: b.id, name: b.name, input: b.input }
-  return { type: b.type }
-}).filter(Boolean)
-
-/**
- * Start a structured Claude Code session.
- *
- * @param {object}   o
- * @param {string=}  o.cwd               working directory for the agent
- * @param {string=}  o.model             model id (default: host's configured)
- * @param {string=}  o.resume            session id to resume
- * @param {object=}  o.env               full environment for the agent subprocess
- *        (REPLACES process.env in the child — spread process.env yourself).
- *        Used to hand each session its own TP_MOCKUP_OUTBOX so mockup cards
- *        attribute to the session that generated them, not a Map-order guess.
- * @param {(evt)=>void} o.onEvent        receives normalized structured events
- * @param {(req)=>Promise<'allow'|'deny'>} o.requestPermission
- *        called for EVERY tool call with { id, toolName, input, risk };
- *        resolve 'allow'/'deny'. (Caller implements any auto-allow policy.)
- * @param {boolean=} o.suggest          allow the Haiku composer-prefill fallback.
- *        MUST be false on a lane running a custom provider — see haikuSuggest.
- * @returns {{ sendTurn(text), abort(), end(), readonly sessionId }}
- */
-const MODES = new Set(['default', 'acceptEdits', 'plan', 'bypassPermissions'])
-
-// Periodic salience reminder. The full ThinkPool Code ruleset lives in
-// `appendSystemPrompt` (baked once at session start), but on a long session — heavy
-// tool output, and especially after auto-compaction — the model's attention drifts
-// off a system prompt that sits behind the large host CLAUDE.md. The classic tell:
-// the agent hands the room a host-local path (`open …`, "it's in ~/claude-shots/")
-// or narrates instead of showing, forgetting it's driven from a phone. So we re-state
-// the highest-drift rules in a <system-reminder> at session start, after recovery,
-// and every fifth prompt. Ordinary turns get only the compact invariant and any
-// route-specific guidance implied by the request.
-// adjacent to where the model's attention actually is — the same trick the host
-// harness uses to keep CLAUDE.md alive. The shared capability router deliberately
-// A live "ROOM NOW" tail (sibling lanes + active worktrees) is appended when it
-// changes and on the same periodic refresh cadence.
-const TP_ROOM_REMINDER = [
-  'You are Claude in a ThinkPool Code room, driven live from a phone or browser — NOT a local terminal. Keep using the room\'s features.',
-  THINKPOOL_RUNTIME_TURN_REMINDER,
-  'TERMINAL HIERARCHY: obey your authoritative TERMINAL ROLE. A person-authored request to open, launch, start, spawn, or create a new, separate, independent, top-level, or main terminal uses open_main_terminal — NEVER spawn_terminal — even for ordinary work or a handoff. If the wording includes new or separate terminal, main-terminal routing wins. Use spawn_terminal only for agent-decided bounded worker slices or when the person explicitly asks for a worker, sub-terminal, Ensemble lane, or delegated slice. If open_main_terminal is unavailable, say so; never substitute an Ensemble child. Leaf, worker, Side, and managed Flow lanes work directly. Never use built-in invisible Task/Agent subagents or hijack a busy sibling.',
-  'WORKTREES: parallel lanes share one repo — before code edits run `git worktree list`; if linked worktrees exist, take your OWN worktree + branch, never the shared checkout or a branch another lane is on.',
-  'BUILD WORKFLOW (default, no magic word): right-size within your TERMINAL ROLE — a trivial ask or delegated slice you just do; a conductor-capable role with a genuinely decomposable build FIRST writes a short plan in chat, THEN fans worker slices into visible spawn_terminal lanes and verifies them. Worker/leaf/Side/managed Flow roles do not fan out. A person-requested new or separate terminal uses open_main_terminal. Never plan-mode/ExitPlanMode; plans live in chat and lanes in the existing list.',
-].join(' ')
-
-export function startClaudeSession({ cwd, model, effort: initialEffort = 'high', resume, env, mode: initialMode = 'default', onEvent, requestPermission, mcpServers, crossPostGate, crossRoomPostGate, didSpawnTarget = null, terminalRolePrompt, rolePrompt, blockSubagents = false, onSubmitPlan = null, onLaneDone = null, onReviewVerdict = null, reviewGate = null, lazy = false, roomContext = null, suggest = true, prepareCwd = null, admitStart = null, resilienceObserver = null, resilience = null }) {
-  // Per-turn reminder + live ROOM NOW tail. roomContext (bridge-supplied) returns the
-  // room's CURRENT state — sibling lanes, active git worktrees — or null. The static
-  // rules keep the agent aware of the room's FEATURES; the live tail keeps it aware of
-  // the room's STATE (2026-07-02 ask: "aware at all points that it's in a ThinkPool
-  // Code session"). A broken snapshot must never break a turn — fail-quiet to static.
-  const selectRoomContext = createRoomContextSelector(roomContext)
-  let userPromptNo = 0
-  let forceFullReminder = true
-  const roomReminder = (text, { promptIndex = 0, forceFull = false } = {}) => {
-    const fullReminder = usesFullThinkPoolReminder({ promptIndex, forceFull })
-    const live = selectRoomContext({ force: fullReminder })
-    const role = String(terminalRolePrompt || '').trim()
-    const guidance = fullReminder ? TP_ROOM_REMINDER : buildThinkPoolTurnGuidance({ text, promptIndex, forceFull })
-    return `<system-reminder>\n${fullReminder && role ? `${role}\n\n` : ''}${guidance}${live ? `\n\n${live}` : ''}\n</system-reminder>`
-  }
-  const ac = new AbortController()
-  let input = makeInputStream()   // `let`: auto-restart swaps in a fresh stream
-  let sessionId = resume || null
-  // persistedSessionId — the newest session id we KNOW is written to disk (the resume we
-  // were handed, then advanced on each successful result). A model-switch re-create must
-  // resume THIS, never the live `sessionId`: a resumed query can fork to a fresh session id
-  // that isn't persisted until a turn completes, so re-creating on it fails with
-  // "No conversation found" (Max 2026-07-02). This is always a resumable id.
-  let persistedSessionId = resume || null
-  let lastTurnText = null   // the most recent turn text, so a bad-resume recovery can re-deliver it
-  let lastTurnReminder = null
-  let lastTurnBlocks = null // exact current prompt blocks; same-target retry must replay byte-for-byte
-  let closed = false
-  // Lazy boot (2026-07-02): a RESTORED-IDLE terminal returns a full session object but
-  // defers the expensive query() cold-start (MCP + settingSources, ~50s each) until its
-  // FIRST turn — so a bridge restart restores every tab's transcript instantly and only
-  // the terminals a person actually uses pay the boot. Mid-turn terminals boot eagerly
-  // (lazy:false) so auto-resume still works.
-  let started = false
-  // Cold-start measurement (2026-06-21, spec 2026-06-21-code-session-deploy-stability):
-  // stamp when the open begins so we can log spawn→ready (the SDK's first `init`
-  // system message — when the terminal becomes usable). New room terminals "take a
-  // long time"; settingSources:['user','project','local'] boots every host MCP
-  // server + SessionStart hook + plugin before init. This is the A-side baseline;
-  // open a terminal with TP_MCP_STRICT=1 (below) for the B-side to isolate MCP's share.
-  // A lazy lane may sit unopened for hours. Start the latency clock when query() really
-  // launches, not when the lightweight tab/session wrapper is created.
-  let spawnT0 = null
-  let readyLogged = false
-  let modelsSent = false   // one-shot: emit the SDK's supported-model list on first init
-  let sdkToolsChecked = false   // one-shot: run the AskUserQuestion regression guard on the first init carrying tools[]
-  let q = null            // the live Query — control requests (interrupt /
-                          // setPermissionMode) route through it once streaming.
-  // The session is CREATED in the caller's chosen mode (not hard-coded default):
-  // a bypass session must start in bypass so the agent never enters plan mode and
-  // never throws an ExitPlanMode card. Falls back to 'default' for unknown values.
-  let mode = MODES.has(initialMode) ? initialMode : 'default'  // mirrors ⇧⇥ cycle
-  const alwaysAllow = new Set()  // tool:risk signatures the user chose "don't ask again" for
-  const toolStart = new Map()     // tool_use id → source metadata for duration/evidence
-  const effortLevels = new Set(['low', 'medium', 'high', 'xhigh', 'max'])
-  let effort = effortLevels.has(initialEffort) ? initialEffort : 'high'
-  // Live token count for the thinking indicator — mirrors Claude Code's
-  // "↓ N tokens": the turn's billed OUTPUT tokens (thinking is billed as
-  // output, so this is the full count, not just the reasoning estimate). A
-  // tool-using turn emits several assistant messages; message_delta carries
-  // the running output_tokens for the CURRENT message, so we fold finished
-  // messages into turnBaseOut and add the live message's count on top. Reset
-  // per turn on `result`.
-  let turnBaseOut = 0             // output tokens from completed messages this turn
-  let curMsgOut = 0               // latest output_tokens for the in-flight message
-  let curModel = model || null    // latest model id seen (init/system + ctx); stamped on
-                                  // the result event so the bridge can attribute BYOK Code
-                                  // spend per-model (record_code_usage → chat_usage).
-  // A model switch on a RESUMED session can't be done live — q.setModel() RESOLVES without
-  // error but is a silent no-op there (the turn keeps running the old model). So a switch is
-  // applied by RE-CREATING the query resuming the same session on the new model (which
-  // query({resume, model}) honours). Root of Max's 2026-07-02 "reverts to Opus at start of
-  // turn": every terminal is a resumed session after a restart, so live setModel did nothing.
-  // qAc = the CURRENT query's own AbortController (child of the session `ac`) so the
-  // switch can kill JUST this query without ending the session; qDone resolves when the
-  // current runQuery loop has fully exited (its process dead) so the re-create doesn't
-  // race the old process on the session file lock (proven necessary 2026-07-02).
-  // pendingSwitch defers a mid-turn switch until the active turn finishes.
-  let qAc = null
-  let qDoneResolve = null
-  let qDone = Promise.resolve()
-  let pendingSwitch = false
-  const sleep = (ms) => new Promise((r) => setTimeout(r, ms))
-  // ── stall watchdog (C2) — stream silence ≠ done; a turn can stall (deltas pause
-  // 3+ min) or abort silently with no `result`. Track turn liveness + last event
-  // time; if an active turn goes quiet past STALL_MS, emit one `stalled` chrome
-  // event so the room can stop showing a frozen "working" forever. Cleared on the
-  // next event / `result`. Refs: TS SDK #44, claude-code #38905. The decision layer
-  // (stallDecision/stallEvent, above) is pure + unit-tested; this owns the state +
-  // side effects. 90s status default (2026-07-08 hardening: the 529-overload hang).
-  const STALL_MS = Math.max(30000, parseInt(process.env.TP_STALL_MS, 10) || 90000)
-  let turnActive = false          // true between a sent turn and its `result`
-  let lastEvtTs = Date.now()      // wall-clock of the most recent emitted event
-  let stalledSent = false         // one `stalled` per stall, not a storm
-  // Auto-restart (item 1) — a transient upstream stream drop (e.g. Anthropic
-  // "Connection closed mid-response") used to leave the session half-dead:
-  // query loop gone, turnActive stuck, later sendTurns pushed into a dead
-  // stream (silent freeze). The loop now self-heals: a recoverable throw
-  // re-runs query() with resume, bounded by RESTART_MAX consecutive attempts
-  // (reset to 0 on every successful `result`). Exhaustion/non-recoverable →
-  // closed, so sendTurn stops silently queuing.
-  const RESTART_MAX = 3
-  const RECOVERABLE = /connection closed|connection reset|econnreset|etimedout|socket hang up|fetch failed|network error|socket destroyed/i
-  let restartCount = 0
-  // Phase 0 measurement seam. The observer receives only a coarse recovery
-  // reason/count; it cannot alter this session's existing retry behavior.
-  const observeRecovery = (reason, detail = {}) => { try { resilienceObserver?.({ reason, restartCount, ...detail }) } catch { /* observer is strictly read-only */ } }
-  // Phase 1 is opt-in and applies only to a named non-Anthropic custom target. Keep
-  // disabled/built-in sessions on the established RESTART_MAX recovery path exactly.
-  const resilienceEnabled = !!(resilience?.policy?.enabled && resilience?.providerId && resilience.providerId !== 'anthropic')
-  let turnResilience = null
-  let resilienceDeadlineTimer = null
-  let resilienceRetryPending = false
-  let resilienceTurnRevision = 0
-  let abortPending = false
-  let restartTimer = null   // the pending auto-restart backoff — cancelled by end()
-  // Force-stop a true wedge (item 3): no result, no error, just silence past
-  // FORCE_STOP_MS. As of the 2026-07-08 hardening we no longer just surface an error
-  // and leave the hung loop in place — retryStalledTurn ABORTS the wedged SDK call (via
-  // its AbortController, the same unblock path abort()/recreateForSwitch use) and
-  // AUTO-RETRIES the turn ONCE, preserving the prompt. If that one retry ALSO stalls
-  // past FORCE_STOP_MS, we fall back to the old behavior: force-stop + "send again".
-  // stallRetried bounds it to a single auto-retry per turn (reset on each new turn /
-  // settled result), so a sustained upstream outage can't thundering-herd retries.
-  const FORCE_STOP_MS = Math.max(STALL_MS * 3, parseInt(process.env.TP_FORCE_STOP_MS, 10) || 300000)
-  let forceStopped = false
-  let stallRetried = false        // one auto-retry per turn (the abort+re-run path below)
-  // A manual /compact is one long, LEGITIMATELY silent model call — not a wedge. The
-  // watchdog stands down for its whole duration (stallDecision's `compacting` branch);
-  // only a compaction quiet for COMPACT_FORCE_STOP_MS (20 min default) is force-stopped,
-  // and never by aborting the query. Set in sendTurn, cleared on compact_boundary (the
-  // compaction landed) and on any result/error (the turn settled, incl. a no-op compact).
-  const COMPACT_FORCE_STOP_MS = Math.max(FORCE_STOP_MS, parseInt(process.env.TP_COMPACT_FORCE_STOP_MS, 10) || 1200000)
-  let compacting = false
-  // Waiting on a HUMAN decision (permission card / plan gate / AskUserQuestion)
-  // is NOT a wedge — the turn is correctly idle until the person answers. Every
-  // interactive gate goes through requestPermission, so wrap it once to bump a
-  // counter while a card is pending; the stall watchdog below stands down while
-  // awaitingUser > 0. Without this, a slow human answer (e.g. a late
-  // AskUserQuestion pick) trips FORCE_STOP_MS, the turn is force-stopped, and the
-  // answer lands on a dead turn ("agent went silent … send again to resume").
-  // On release, stamp lastEvtTs = now so the resumed turn isn't force-stopped on
-  // the very next tick by a now-stale (minutes-old) timestamp.
-  let awaitingUser = 0
-  const _requestPermission = requestPermission
-  requestPermission = async (req) => {
-    awaitingUser++
-    try { return await _requestPermission?.(req) }
-    finally { awaitingUser = Math.max(0, awaitingUser - 1); lastEvtTs = Date.now() }
-  }
-  // Set while an interrupt is settling. q.interrupt() doesn't end the turn cleanly on this
-  // SDK — it surfaces a REDUNDANT pair of terminal results (subtype `aborted` AND
-  // `error_during_execution`) and re-inits the session. abort() emits the single canonical
-  // aborted boundary itself; this flag tells the result handler to swallow the SDK's extra
-  // teardown results so the web never sees a second turn-end. Without it, the web suppresses
-  // only the first (isAbortEcho) and the second buried the flushed steer — "Stop injects the
-  // queued message but nothing happens". Cleared by the first real (non-teardown) result.
-  // Verified: bridge/test-steer-after-abort.mjs (Maks 2026-06-26). The teardown results
-  // arrive async and can interleave with the NEXT turn (a late error_during_execution can
-  // land after the steer's own output), so the window is bounded by a timer rather than
-  // cleared on the next result — "all teardown has arrived" isn't observable. `success`
-  // results are never swallowed, so the flushed steer's completion always surfaces.
-  let interrupting = false
-  let interruptingRevision = null
-  let interruptTimer = null
-  const INTERRUPT_SWALLOW_MS = 6000
-  // ── Haiku suggestion fallback ──
-  // Claude Code's own `prompt_suggestion` rarely fires in /code — the binary suppresses it
-  // per-turn (cache_cold when a turn's tokens > 10k, rate_limit when throttled, first turn).
-  // When it doesn't arrive shortly after `result`, we generate one ourselves with a cheap
-  // one-shot Haiku call on the SAME subscription auth (no API key), fed ONLY the last
-  // assistant reply (suggestions are short: "proceed" / "go with A") — fast + ~free.
-  let sawSuggestion = false       // did Claude's own prompt_suggestion fire this turn?
-  let lastAssistantText = ''      // most recent assistant prose — the only context the fallback needs
-  let sugTimer = null             // pending fallback timer
-  const SUGGEST_FALLBACK_MS = Math.max(1200, parseInt(process.env.TP_SUGGEST_FALLBACK_MS, 10) || 2500)
-
-  // emitRaw forwards an event WITHOUT stamping lastEvtTs — used for the watchdog's OWN
-  // synthetic status/error events, which are not SDK activity and must not reset the
-  // silence clock (else the 5-min abort would measure from our 90s status emit, not from
-  // the last real SDK event). emit() is the normal path: it stamps liveness + clears the
-  // one-shot stall flag on any real event other than a `stalled` re-emit.
-  const emitRaw = (evt) => { try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
-  // The compaction window closes on its milestone (`compaction`) or on the turn settling
-  // (`result`/`error` — covers a no-op "Not enough messages to compact" and a Stop). After
-  // that the normal wedge timeline applies again.
-  const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; if (evt && (evt.kind === 'compaction' || evt.kind === 'result' || evt.kind === 'error')) compacting = false; emitRaw(evt) }
-  // The controller only receives its own allowlisted records. Room notes are likewise
-  // rendered from that projection, never from an SDK error, URL, credential, or prompt.
-  const resilienceRecord = (record) => {
-    try { resilience?.onRecord?.(record) } catch { /* observer is never control flow */ }
-    if (record?.outcome === 'retrying' || record?.outcome === 'cap_blocked' || record?.outcome === 'circuit_open') {
-      emit({ kind: 'note', text: formatResilienceTrace(record) })
-    }
-  }
-  const clearResilienceDeadline = () => {
-    if (resilienceDeadlineTimer == null) return
-    try { (resilience?.clearTimer || clearTimeout)(resilienceDeadlineTimer) } catch { /* deadline cleanup is best-effort */ }
-    resilienceDeadlineTimer = null
-  }
-  const armResilienceDeadline = () => {
-    clearResilienceDeadline()
-    if (!turnResilience) return
-    const timeoutMs = Number(resilience?.policy?.timeoutMs)
-    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return
-    const schedule = resilience?.setTimer || setTimeout
-    resilienceDeadlineTimer = schedule(() => {
-      resilienceDeadlineTimer = null
-      if (closed || !turnResilience || !turnActive) return
-      // This is a bridge-authored timeout classification, never a raw provider
-      // error. Abort the wedged iterator, then reuse the same controller budget.
-      turnResilience.failure({ message: 'timeout' })
-      turnActive = false
-      try { qAc?.abort() } catch { /* the disposal wait below still fails closed */ }
-      retryResilientTurn()
-    }, timeoutMs)
-  }
-  const createTurnResilience = () => {
-    if (!resilienceEnabled) return null
-    try {
-      const controller = createSameTargetResilienceController({
-        runtime: 'claude', providers: resilience.providers || [], providerId: resilience.providerId,
-        model: resilience.model || opts.model || model,
-        requestedModel: resilience.requestedModel || resilience.model || opts.model || model,
-        policy: resilience.policy, bridgeHostId: resilience.bridgeHostId,
-        circuit: resilience.circuit, capGate: resilience.capGate,
-        traceId: resilience.traceId,
-        turnRev: typeof resilience.turnRev === 'function' ? resilience.turnRev() : resilience.turnRev,
-        onRecord: resilienceRecord,
-      })
-      controller.start()
-      return controller
-    } catch { return null }
-  }
-  const admitResilientSubmission = async () => {
-    if (!turnResilience) return true
-    let admission = null
-    try { admission = await turnResilience.preflight() } catch { return false }
-    return admission?.admitted === true
-  }
-  const stallTimer = setInterval(() => {
-    const quiet = Date.now() - lastEvtTs
-    const action = stallDecision({ turnActive, awaitingUser, quietMs: quiet, stallMs: STALL_MS, forceStopMs: FORCE_STOP_MS, stalledSent, stallRetried, compacting, compactForceStopMs: COMPACT_FORCE_STOP_MS })
-    if (action === 'none') return
-    // ALWAYS surface — a stall is never swallowed. emitRaw so this synthetic event
-    // doesn't reset the silence clock (see emitRaw above).
-    const ev = stallEvent(action, quiet)
-    if (ev) emitRaw(ev)
-    if (action === 'status') { stalledSent = true; return }
-    if (action === 'retry') {
-      forceStopped = true
-      if (turnResilience) {
-        // The legacy watchdog must never create a second retry ledger. Route
-        // its terminal timeout through the same controller; visible output or
-        // an exhausted attempt budget makes the following preflight fail closed.
-        observeRecovery('resilience_stall', { quietMs: quiet })
-        turnResilience.failure({ message: 'timeout' })
-        turnActive = false
-        try { qAc?.abort() } catch { /* disposal is awaited by the shared retry path */ }
-        retryResilientTurn()
-        return
-      }
-      observeRecovery('stall_replay', { quietMs: quiet })
-      retryStalledTurn(quiet)
-      return
-    }
-    // 'giveup' — the one auto-retry ALSO stalled past FORCE_STOP_MS. Fall back to the
-    // pre-2026-07-08 behavior: force-stop the turn so between-turns updates unblock, and
-    // let the human resend. The wedged loop is left in place; if it later throws, the
-    // catch self-heals.
-    forceStopped = true
-    turnActive = false
-  }, 5000)
-  stallTimer.unref?.()
-
-  // Apply a permission-mode change to the live SDK *outside* any hook callback.
-  // setPermissionMode is a streaming control request; awaiting it from INSIDE the
-  // PreToolUse hook (which the SDK is itself awaiting) jams the control channel —
-  // the call throws, and when that was silently swallowed the SDK stayed in plan
-  // mode, so the agent got bounced back to planning after every approved edit
-  // (the "PLAN READY every turn" loop). Deferring to the next tick lets the hook
-  // return first, freeing the channel. Errors are logged to the bridge, not eaten.
-  const scheduleSdkMode = (next) => {
-    setTimeout(() => {
-      Promise.resolve(q?.setPermissionMode?.(next)).catch((e) =>
-        console.error(`[claude-session] setPermissionMode(${next}) failed:`, e?.message || e))
-    }, 0)
-  }
-
-  // PreToolUse — fires on EVERY tool call (the universal gate). The mode policy
-  // mirrors Claude Code exactly: reads never prompt (any mode); Auto-accept
-  // edits auto-approves non-destructive writes; Bash / network / destructive
-  // always round-trip to the room's risk-tiered permission card.
-  const preTool = async (hookInput) => {
-    const toolName = hookInput.tool_name
-    const toolInput = hookInput.tool_input
-    // The hook input carries the turn's active reasoning effort (post any
-    // model downgrade) — the real signal for "thinking with <X> effort".
-    // Surface it to the room when it changes; absent on models without effort.
-    const lvl = hookInput.effort?.level
-    if (lvl && lvl !== effort) { effort = lvl; emit({ kind: 'effort', level: effort }) }
-    // Flow CONDUCTOR hard-stop: a conductor must DECOMPOSE using ONLY Read/Grep/Glob (which
-    // are auto-allowed, no card) then ExitPlanMode. FOUR tool classes otherwise stall it on a
-    // permission card on the now-hidden conductor terminal: (1) Task/Agent subagents — the
-    // model's parallelize instinct fans out Explore agents despite the prompt; (2) Bash —
-    // the model reaches for `find`/`grep`/`wc`, and Bash is medium-risk → a card in plan
-    // mode; (3) Write/Edit — the model's plan-mode habit is to WRITE A PLAN DOC
-    // (`~/.claude/plans/*.md`) instead of emitting the task-graph; that write pops a card AND
-    // never produces tasks, so the flow wedges in `planning` forever (FL-B1). Deny ALL and
-    // redirect to ExitPlanMode. (blockSubagents is set only for the conductor session —
-    // lanes build under their own bypass/one-hop rules.)
-    // FL-B1 — the conductor SUBMITS its decomposition by Writing the task-graph JSON to the
-    // sentinel file FLOW_PLAN.json. Write is a DIRECT (non-deferred) tool, so this avoids the
-    // deferred-tool/ToolSearch path that hangs every other submit route (ExitPlanMode AND the
-    // submit_flow_plan MCP tool are deferred → ToolSearch → hang). We intercept that Write
-    // here (the file is never actually written): validate via onSubmitPlan + broadcast the
-    // plan, then feed the result straight back as the tool result so the conductor re-emits on
-    // a malformed plan or stops on success.
-    const isConductorWrite = toolName === 'Write' || toolName === 'Edit' || toolName === 'MultiEdit' || toolName === 'NotebookEdit'
-    const writePath = toolInput?.file_path || toolInput?.notebook_path || ''
-    if (blockSubagents && isConductorWrite && /(?:^|[/\\])FLOW_PLAN\.json$/i.test(writePath)) {
-      const planText = toolInput?.content ?? toolInput?.new_string ?? ''
-      let res = { ok: false, message: 'Plan submission is not wired for this session.' }
-      try { res = (onSubmitPlan && (await onSubmitPlan(planText))) || res } catch (e) { res = { ok: false, message: `Plan submission failed: ${e?.message || e}` } }
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
-    }
-    if (blockSubagents && (toolName === 'Task' || toolName === 'Agent' || toolName === 'Bash' || isConductorWrite)) {
-      const reason = (toolName === 'Bash')
-        ? 'Flow conductors do NOT run Bash — it pops a permission card and stalls the flow. Use the Grep tool (not `grep`/`rg`), the Glob tool (not `find`/`ls`), and Read (not `cat`/`head`) — those run with no prompt. Then DECOMPOSE and submit by Writing your task-graph JSON to the file FLOW_PLAN.json.'
-        : isConductorWrite
-        ? 'Flow conductors do NOT write project or plan-document files. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). To SUBMIT your decomposition, use the Write tool with file_path "FLOW_PLAN.json" and content = your task-graph JSON ({"summary":"…","tasks":[…]}). That single Write IS how you submit — the room ingests it directly. Do not write any other file.'
-        : 'Flow conductors do NOT spawn subagents — it stalls the flow on a permission card. Inspect the codebase yourself with Read/Grep/Glob (no prompt). Then DECOMPOSE and submit by Writing your task-graph JSON to the file FLOW_PLAN.json. Do not call Task/Agent again.'
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }
-    }
-    // FL-B4 (review lane) — an adversarial reviewer records its verdict by Writing
-    // FLOW_REVIEW.json; the hook routes it to the verdict logic (revert-on-fail + mark the
-    // review slice done). Same deferred-tool workaround as the builder's FLOW_DONE.
-    if (onReviewVerdict && (toolName === 'Write' || toolName === 'Edit') && /(?:^|[/\\])FLOW_REVIEW(\.[a-zA-Z0-9]+)?$/.test(toolInput?.file_path || '')) {
-      let res = { ok: false, message: 'verdict signal failed' }
-      try { res = (await onReviewVerdict(toolInput?.content ?? toolInput?.new_string ?? '')) || res } catch (e) { res = { ok: false, message: `verdict signal failed: ${e?.message || e}` } }
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
-    }
-    // FL-B1 (lane) — a flow lane signals its slice is done by Writing a file named FLOW_DONE
-    // (the mark_flow_done MCP tool is deferred → ToolSearch → hangs; Write is direct). Route
-    // that Write to the done logic and feed the result back; the file is never written.
-    if (onLaneDone && (toolName === 'Write' || toolName === 'Edit') && /(?:^|[/\\])FLOW_DONE(\.[a-zA-Z0-9]+)?$/.test(toolInput?.file_path || '')) {
-      let res = { ok: false, message: 'done signal failed' }
-      try { res = (await onLaneDone(toolInput?.content ?? toolInput?.new_string ?? '')) || res } catch (e) { res = { ok: false, message: `done signal failed: ${e?.message || e}` } }
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: res.message } }
-    }
-    // S5 (slice 1b) — REVIEW-LANE WRITE-BLOCK. A review lane is ADVERSARIAL: it reads +
-    // runs/tests the slice(s) it reviews and emits a verdict, but it must be STRUCTURALLY
-    // unable to Edit/Write/commit the code under review (a reviewer that edits is a second
-    // builder → a false PASS). `reviewGate` is set ONLY on review lanes (bridge.mjs wires it
-    // to reviewGateDecision over the reviewed slices' worktree roots + the lane's own
-    // FLOW_REVIEW.json). It runs AFTER the FLOW_REVIEW.json verdict intercept above, so the
-    // reviewer can still emit its verdict, and BEFORE the normal auto-allow path, so the deny
-    // is structural even in the lane's bypassPermissions mode. Read + run/test stay allowed
-    // (the gate allows read-only tools + non-write Bash — the reviewer's whole method). The
-    // real mitigation for Bash-quoting bypasses is worktree isolation (the review lane runs
-    // in its OWN worktree, not the slice's) — guaranteed by the spawn path.
-    const reviewDeny = reviewGatePreToolDecision({ reviewGate, toolName, toolInput })
-    if (reviewDeny) return reviewDeny
-    // ThinkPool cross-terminal READ (B2) is read-only + within-room — never
-    // prompt, in any mode. It still surfaces as a tool card so the room sees the peek.
-    if (toolName === 'mcp__thinkpool__read_terminal') {
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (read-only ThinkPool cross-terminal read).' } }
-    }
-    // Bridge-owned visual QA is constrained to the lane cwd + a loopback URL
-    // created by the bridge itself, so it does not need a room permission card.
-    if (/^mcp__thinkpool__preview_(start|capture|inspect|stop)$/.test(toolName)) {
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (contained bridge-owned viewport preview).' } }
-    }
-    // FL-B1 — the Flow conductor submits its task-graph through this tool (replaces the
-    // deferred/hanging ExitPlanMode). It only broadcasts a plan for HUMAN approval — no FS or
-    // system effect — so auto-allow it (the conductor runs in plan mode, which would otherwise
-    // card it and re-wedge the flow).
-    if (toolName === 'mcp__thinkpool__submit_flow_plan') {
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (Flow plan submission — broadcasts the task-graph for human approval).' } }
-    }
-    // ThinkPool cross-ROOM READ (list_sessions / read_session) is read-only. It reaches
-    // the account's own other rooms on this machine (Tier 1) and the partner's rooms on
-    // the pair bus (Tier 2) — both firewalled server-side (the supervisor only serves
-    // owned rooms; the pair channel is RLS-gated to the two real partners), so it is the
-    // same trust class as read_terminal → auto-allow. POSTING across rooms
-    // (post_to_session) is NOT read-only — it gates on a card at both ends below.
-    if (toolName === 'mcp__thinkpool__list_sessions' || toolName === 'mcp__thinkpool__read_session') {
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (read-only ThinkPool cross-session read — your own rooms).' } }
-    }
-    // ThinkPool cross-terminal CLOSE (Tier C+) — closes only a lane the agent itself
-    // spawned (bridge-side spawnedBy check), never a sibling's work nor the host
-    // terminal. Low-risk lane management → auto-allow (surfaced as a card for visibility).
-    if (toolName === 'mcp__thinkpool__close_terminal') {
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (ThinkPool cross-terminal close — only self-spawned lanes).' } }
-    }
-    // A spawned worker is the autonomous execution unit: always auto-allow the tool.
-    // Bridge-side resolveAgentOpen pins every worker to bypassPermissions regardless
-    // of parent mode or the legacy mode argument. The one-worker-tier / plan width /
-    // machine / burst / TP_SPAWN_OFF caps still fail closed before the lane opens.
-    if (toolName === 'mcp__thinkpool__spawn_terminal') {
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: 'Auto-approved (autonomous ThinkPool worker; bounded by room caps and isolated in its own worktree).' } }
-    }
-    // Independent main terminals keep their requested/inherited permission mode.
-    // Raising a new main terminal to bypass from a non-bypass parent still asks once.
-    if (toolName === 'mcp__thinkpool__open_main_terminal') {
-      const childMode = toolInput?.mode || mode   // inherit this lane's mode by default
-      const escalating = childMode === 'bypassPermissions' && mode !== 'bypassPermissions'
-      if (!escalating) {
-        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: `Auto-approved (open a fresh ThinkPool terminal in ${childMode} mode — inherited, no escalation; bounded by room caps).` } }
-      }
-      let decision = 'deny'
-      try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: { ...toolInput, mode: childMode }, risk: 'high' }) ?? 'deny' } catch { decision = 'deny' }
-      const allowed = decision === 'allow'
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: allowed ? 'allow' : 'deny', permissionDecisionReason: allowed ? 'Bypass terminal creation approved in the ThinkPool room — the new terminal runs autonomously.' : 'Bypass terminal creation denied in the room — do not retry as bypass; open it without mode:bypassPermissions or ask what to do.' } }
-    }
-    // ThinkPool cross-terminal POST (Tier C) WRITES into a sibling agent's lane.
-    // First a bridge-side precheck (kill-switch / loop-breaker / per-turn cap) so a
-    // blocked or runaway post never even raises a card. THEN the consent SCOPE
-    // (crossPostNeedsCard, 2026-07-03): a post auto-allows with NO card in exactly
-    // two cases — (a) this lane is in bypassPermissions (bypass means bypass), or
-    // (b) this lane SPAWNED the target (parent→child orchestration; bridge-side
-    // didSpawnTarget resolves the sibling + checks spawnedBy). Every OTHER post — a
-    // non-owner into a lane it did not spawn, in any non-bypass mode — still round-
-    // trips the 'high'-risk card (Deny / Allow-once only). This unblocks automated
-    // conductor→lane orchestration (the 3-stacked-Dispatch-cards bug) WITHOUT loosening
-    // the invariant: a lane can never be posted into by a non-owner without a human tap,
-    // except in bypass. Cross-ROOM post_to_session (dual-consent) is untouched below.
-    // Spec: docs/specs/2026-07-03-xpost-consent-scope.md.
-    if (toolName === 'mcp__thinkpool__post_to_terminal') {
-      const gate = crossPostGate ? crossPostGate() : { ok: true }
-      if (!gate.ok) {
-        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: gate.reason || 'Cross-terminal post not allowed right now.' } }
-      }
-      const spawnedByMe = didSpawnTarget ? !!didSpawnTarget(toolInput?.terminal) : false
-      if (!crossPostNeedsCard({ mode, spawnedByMe })) {
-        const why = mode === 'bypassPermissions'
-          ? 'Auto-approved (cross-terminal post in bypassPermissions mode — bypass means bypass).'
-          : 'Auto-approved (cross-terminal post into a lane you spawned — parent→child orchestration, no per-post tap).'
-        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: why } }
-      }
-      let decision = 'deny'
-      try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'high' }) ?? 'deny' } catch { decision = 'deny' }
-      const allowed = decision === 'allow'
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: allowed ? 'allow' : 'deny', permissionDecisionReason: allowed ? 'Cross-terminal post approved in the ThinkPool room.' : 'Cross-terminal post denied in the room — do not retry; ask what to do instead.' } }
-    }
-    // ThinkPool cross-ROOM POST (Tier 3) WRITES into ANOTHER room's agent — possibly
-    // on another person's machine. This is the SENDER-side gate (the recipient room
-    // raises its OWN receipt card before anything injects — dual consent). Same shape
-    // as post_to_terminal: a bridge-side precheck (kill-switch / roomHop / per-turn
-    // cap) so a blocked post never raises a card, then a 'high'-risk human card here.
-    if (toolName === 'mcp__thinkpool__post_to_session') {
-      const gate = crossRoomPostGate ? crossRoomPostGate() : { ok: true }
-      if (!gate.ok) {
-        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: gate.reason || 'Cross-room post not allowed right now.' } }
-      }
-      let decision = 'deny'
-      try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'high' }) ?? 'deny' } catch { decision = 'deny' }
-      const allowed = decision === 'allow'
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: allowed ? 'allow' : 'deny', permissionDecisionReason: allowed ? 'Cross-room post approved in the sending room — the target room will be asked to accept it.' : 'Cross-room post denied in the room — do not retry; ask what to do instead.' } }
-    }
-    // ── Plan approval — ExitPlanMode is how the agent presents its plan in
-    // plan mode. Render a dedicated plan card (not the generic perm card) with
-    // three outcomes: run (exit → default), accept (exit → acceptEdits), keep
-    // (deny → stay planning). On approval we flip the SDK permission mode so
-    // subsequent tools actually execute.
-    if (toolName === 'ExitPlanMode') {
-      // GUARANTEE: a plan card only ever appears when the room is ACTUALLY in Plan
-      // mode (the user pressed ⇧⇥ → Plan). If the agent reaches ExitPlanMode while
-      // the room is in any other mode (default / acceptEdits / bypassPermissions),
-      // it entered plan mode on its own — the user never asked. Don't surface an
-      // unsolicited "PLAN READY" card that blocks them; re-assert the room's real
-      // mode and let the work proceed. This is the backstop for plan-mode leaking
-      // in regardless of source (sticky localStorage, SDK default, a host-global
-      // brainstorm nudge): in a ThinkPool room, plan is opt-in, never imposed.
-      if (mode !== 'plan') {
-        scheduleSdkMode(mode)        // snap the SDK back out of plan, into the real mode
-        emit({ kind: 'mode', mode }) // keep the room chip honest
-        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: `The ThinkPool room is in ${mode} mode, not Plan — the user did not ask for a plan. Do NOT call ExitPlanMode; proceed and make the changes directly. Only present a plan if the user switches the room to Plan mode or explicitly asks.` } }
-      }
-      let choice = 'keep'
-      try { choice = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'plan', plan: toolInput?.plan || '' }) ?? 'keep' }
-      catch { choice = 'keep' }
-      if (choice === 'run' || choice === 'accept') {
-        const next = choice === 'accept' ? 'acceptEdits' : 'default'
-        mode = next            // our auto-allow gate updates immediately
-        scheduleSdkMode(next)  // flip the SDK AFTER this hook returns (see above)
-        emit({ kind: 'mode', mode: next })
-        return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow', permissionDecisionReason: `Plan approved in the ThinkPool room — proceed (${next} mode).` } }
-      }
-      return { continue: true, hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: 'The user chose "keep planning" in the ThinkPool room. Do not exit plan mode — keep refining the plan, then call ExitPlanMode again when ready.' } }
-    }
-    // ── AskUserQuestion — the agent asks the user a multiple-choice question.
-    // It can't run its interactive dialog headless (allowing it errors), so we
-    // render the choice card in the room and feed the selection back as the tool
-    // outcome. PreToolUse can't inject a tool_result, but a deny's reason IS what
-    // the model receives — so we deny and put the answer in the reason.
-    if (toolName === 'AskUserQuestion') {
-      let decision = ''
-      try { decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk: 'ask', questions: toolInput?.questions || [] }) ?? '' }
-      catch { decision = '' }
-      return askUserQuestionHookOutput(decision)
-    }
-    const risk = classifyRisk(toolName, toolInput)
-    // "Don't ask again" is keyed by tool + risk tier, so allowing medium Bash
-    // never silently allows a future destructive one (high always re-asks).
-    const sig = `${toolName}:${risk}`
-    const safeDoc = isSafeDocWrite(toolName, toolInput)
-    const auto = autoAllow({ toolName, input: toolInput, mode, alwaysAllow })
-    let decision = 'allow'
-    if (!auto) {
-      try {
-        decision = await requestPermission?.({ id: randomUUID(), toolName, input: toolInput, risk }) ?? 'deny'
-      } catch { decision = 'deny' } // a broken permission path must fail safe (deny)
-      // "Allow & don't ask again" — remember the signature, then allow.
-      if (decision === 'always') { alwaysAllow.add(sig); decision = 'allow' }
-    }
-    // On deny, permissionDecisionReason IS what the model receives as the
-    // tool error — make it a real instruction, not an opaque tag.
-    const denied = decision === 'deny'
-    if (denied && turnResilience) turnResilience.failure({ permissionDenied: true })
-    return {
-      continue: true,
-      hookSpecificOutput: {
-        hookEventName: 'PreToolUse',
-        permissionDecision: denied ? 'deny' : 'allow',
-        permissionDecisionReason: denied
-          ? 'Denied by the user in the ThinkPool room. Do not retry this tool — ask what to do instead.'
-          : auto
-            ? (safeDoc ? 'Auto-approved (mandated doc write — .claude/SESSIONS/ or CLAUDE.md).' : `Auto-approved (${mode}).`)
-            : 'Approved in the ThinkPool room.',
-      },
-    }
-  }
-
-  const opts = {
-    abortController: ac,
-    permissionMode: mode,
-    hooks: { PreToolUse: [{ hooks: [preTool] }] },
-    // Enable AskUserQuestion (the agent's multiple-choice card) in EVERY mode.
-    // The CLI only adds AskUserQuestion / EnterPlanMode / ExitPlanMode to a
-    // session's toolset when the host declares it can service an interactive
-    // permission — i.e. when a `canUseTool` callback is present. Without it the
-    // tool is absent and the model gets "AskUserQuestion exists but is not
-    // enabled in this context", so the room's card handler above was dead code.
-    // Its PRESENCE is the whole point: in bypassPermissions this callback is
-    // shadowed (never invoked — bypass auto-approves before it, per the SDK's
-    // CLAUDE_SDK_CAN_USE_TOOL_SHADOWED warning), and in gated modes the
-    // PreToolUse hook runs first and stays authoritative (a hook deny — which is
-    // exactly how the AskUserQuestion card feeds its answer back — short-circuits
-    // canUseTool). So the human-gate holds in all modes: an ask-card always waits
-    // for a person via requestPermission inside the hook. This allow is a no-op
-    // relative to the hook, never a second gate that could override a denial.
-    canUseTool: async (_toolName, input) => ({ behavior: 'allow', updatedInput: input }),
-    // Load the host's REAL Claude environment — user + project + local settings —
-    // so custom slash commands (.claude/commands/*.md), CLAUDE.md and agents work
-    // in the room exactly as in the user's own CLI. The Agent SDK isolates by
-    // default (no filesystem settings), which is why a custom /command came back
-    // "isn't available in this environment"; we opt in explicitly so it holds
-    // across SDK versions. The room's PreToolUse gate still runs and stays
-    // authoritative (hooks fire regardless of any loaded permission rules).
-    settingSources: ['user', 'project', 'local'],
-    // Counteract host-global "plan/brainstorm before any work" nudges that ride in
-    // through settingSources:'user' — notably the superpowers plugin's SessionStart
-    // hook ("You MUST use brainstorming before any creative work… about to enter
-    // plan mode?"). In a Code room those make the agent answer a plain "add/fix X"
-    // by presenting a plan and calling ExitPlanMode, so the room shows a
-    // "PLAN READY — APPROVE TO START" card the user never asked for ("always flips
-    // to plan mode"). This is instruction-driven, independent of permissionMode —
-    // a bypass session still planned. Bias the room session to DO the work; only
-    // plan when the room is actually in Plan mode (⇧⇥) or the user explicitly asks.
-    appendSystemPrompt: [
-      ...(terminalRolePrompt ? [terminalRolePrompt] : []),
-      ...(rolePrompt ? [rolePrompt] : []),
-      'ENVIRONMENT (authoritative — overrides any user-global CLAUDE.md or memory that claims otherwise): You are Claude running inside a ThinkPool Code room, driven live by a user (and possibly a partner) from a phone or browser, via the thinkpool-pair bridge.',
-      THINKPOOL_RUNTIME_AUTHORITY_RULE,
-      'Bias strongly toward DOING the work, not stalling in plan-mode ceremony. For a small "add / fix / change X" request, just make the change directly (for a bigger build, right-size it — see DEFAULT BUILD WORKFLOW below).',
-      'Do NOT enter plan mode, do NOT call ExitPlanMode, and do NOT auto-invoke a brainstorming/planning skill UNLESS the user has switched the room into Plan mode or explicitly asks you to plan, design, or brainstorm first.',
-      'Any host-global instruction that says you must always brainstorm or plan before creative work does NOT apply here — this room is the exception.',
-      // DEFAULT BUILD WORKFLOW (2026-07-02 decision — docs/specs/2026-07-02-flow-default-build-workflow.md):
-      // no summon word. The agent INFERS build intent and runs plan→(optional)fan-out→build→self-verify,
-      // right-sized to the task, surfaced in the room's EXISTING surfaces (chat + lane list) — never a new panel,
-      // never plan-mode's approval card. Trivial asks stay single-lane with zero ceremony.
-      THINKPOOL_CASCADE_RULE,
-      'CRUCIAL RECONCILIATION for that workflow: it is NOT plan mode. Never call ExitPlanMode and never make the room wait behind a "plan ready — approve to start" card — your plan lives in the CHAT as a message, and your lanes live in the room\'s EXISTING terminal/lane list. Reuse only those two surfaces; there is no new Flow panel or mode to switch into, and you must not ask for one. Keep the plan and the lanes VISIBLE — that shared visibility is the whole point (it is the pair differentiator, and it catches bugs a single silent lane would hide); never collapse a decomposable build into one hidden lane just to look tidy.',
-      ...THINKPOOL_REMOTE_DELIVERY_RULES,
-      'CROSS-TERMINAL AWARENESS: ROOM NOW is the default roster and already satisfies the room check when it has enough detail. Do not repeat it with a no-argument read_terminal call unless it is missing or truncated. Use a targeted read_terminal call only when the current task depends on a specific lane’s detailed activity; never poll. Identify a terminal by its NAME or stable ref/id, never by an on-screen number like "Terminal 2" — positional labels renumber when a terminal is closed. The tool is read-only and its optional roster lookup is budgeted separately from bounded targeted transcript reads.',
-      'CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',
-      'TERMINAL CREATION CONTRACT: main terminals and workers use different tools. A person-authored request to open, launch, start, spawn, or create a new, separate, independent, top-level, or main terminal uses open_main_terminal(name?, task?, model?) — even for ordinary work or a handoff and even without the words Cascade or conductor. If the wording includes new or separate terminal, main-terminal routing wins. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for agent-decided bounded WORKER SUB-TERMINALS or when the person explicitly asks for a worker, sub-terminal, Ensemble lane, or delegated slice. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers are always autonomous in bypassPermissions and never ask the room for an approval card; the bridge still enforces room caps, hop limits, the kill-switch, and isolated linked worktrees. Wait for ROOM NOW or a completion signal instead of polling; after a worker finishes, collect it with one targeted read_terminal call and close_terminal immediately. Main terminals are independent, keep their requested permission mode, and are not owned/closed through Ensemble.',
-      'CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner\'s rooms in the same pair, reachable over the per-pair bus (a room on the partner\'s machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room\'s terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger\'s. Reach for them when work spans rooms — "what\'s the other project up to", "pick up where the other session left off", or to check a long-running task elsewhere before you act here.',
-      'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. Outbound list/read/post tools need the ThinkPool account bridge; a standalone owner room can still receive a paired hand-off directly and will always raise its own approval card before delivery.',
-      'SUBAGENT POLICY: in this room, a main terminal delegates worker slices through visible spawn_terminal Ensemble lanes. A person-requested new or separate terminal is created with open_main_terminal, never Ensemble. Worker, leaf, Side, and managed Flow lanes do their assigned work directly. Do NOT reach for built-in Task/Agent subagents: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble.',
-      'RESEARCH LANE: you have a `research` tool that runs a REAL multi-source web search + adversarial verification and returns each claim marked HELD or REJECTED with citations. Reach for it when the people would genuinely benefit from looking something external up or settling a question of current fact — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over facts you are not sure of. Do NOT run it unprompted or for things you already know: first OFFER in plain language ("want me to spawn a research lane on that and check it?"), and only call `research(question)` once they agree — it spends real budget (plan-gated Free 5 / Plus 100 runs a month) and takes ~a minute. When it returns, present the held/rejected findings clearly and invite both people to weigh the sources, flagging any held claim that rests on a source they might not trust — that shared scrutiny is the point.',
-      'WORKTREES: parallel lanes share one machine and usually one repo. Run `git worktree list` before your first code edit; if linked worktrees exist, the shared main checkout is contended (and may be guard-blocked) — do your work in your OWN worktree on your OWN branch (`git worktree add <dir> -b <branch>`), and never edit a checkout or ride a branch another lane is using.',
-      'WRITE PLANS INTO THE CHAT: whenever you form or revise a plan — because the room is in Plan mode, or because someone asked you to plan, design, or think it through first — write the actual plan out as a normal message in the room as you develop it: the approach, the concrete steps, the files you will touch, the open questions. The room does NOT surface plan files at all, and the plan-approval card does not reliably carry the plan text, so a plan that lives only in a plan file or only inside ExitPlanMode is INVISIBLE to the people you are working with — they just see "plan ready" with no content. The chat is the canonical place your plan lives; put it there so the room can read and react to it before you proceed.',
-    ].join(' '),
-    // Needed for live thinking-token progress (SDKThinkingTokensMessage) to
-    // flow during a turn. We ignore the fine-grained stream_event partials in
-    // the loop; only the coarse thinking_tokens system message is surfaced.
-    includePartialMessages: true,
-    // Claude Code's own "predicted next prompt" — the SDK emits at most one
-    // `prompt_suggestion` per turn, AFTER the `result` message, suppressed on the
-    // first turn / after API errors / in plan mode, and it piggybacks the parent's
-    // prompt cache (nearly free). We surface it verbatim to the room composer as a
-    // ghost-text chip; nothing is generated on our side. The loop keeps iterating
-    // past `result`, so the post-result suggestion is received. Global off switch:
-    // CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false.
-    promptSuggestions: true,
-  }
-  // Measurement lever (default OFF — no behavior change). TP_MCP_STRICT=1 makes the
-  // room session skip booting the host's filesystem-configured MCP servers
-  // (strictMcpConfig + empty mcpServers map), isolating the MCP share of cold-start
-  // in the spawn→ready log below. settingSources still loads slash commands /
-  // CLAUDE.md / agents either way — strict only governs MCP server sourcing. Flip
-  // this to the default (or curate a slim allowlist) once the numbers justify it.
-  if (process.env.TP_MCP_STRICT === '1') { opts.strictMcpConfig = true; opts.mcpServers = {} }
-  // In-process ThinkPool tools (B2 read_terminal) — MERGED with the host's
-  // filesystem MCP (non-strict), or the sole servers under TP_MCP_STRICT. The SDK
-  // namespaces these as mcp__<key>__<tool>; the PreToolUse gate auto-allows them.
-  if (mcpServers && Object.keys(mcpServers).length) opts.mcpServers = { ...(opts.mcpServers || {}), ...mcpServers }
-  if (cwd) opts.cwd = cwd
-  if (model) opts.model = model
-  opts.effort = effort
-  // NB: resume is NOT baked into opts — runQuery sets it per-run from the live `sessionId`
-  // (seeded from `resume`). That makes the resume target controllable: a re-create can point
-  // it at persistedSessionId, and the "No conversation found" recovery can DROP it (clearing
-  // sessionId) to re-run fresh. If it were in opts, the {...opts} spread would keep resuming
-  // the dead id even after we cleared sessionId (Max 2026-07-02 recovery loop).
-  // Force-enable Claude Code's predicted-next-prompt. `promptSuggestions: true`
-  // alone defers to the server-side `tengu_prompt_suggestion` feature gate, which
-  // Anthropic flips on/off during rollout — so the ghost-text chip silently died
-  // mid-day with NO change on our side. CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION is the
-  // documented override. opts.env REPLACES the child env, so spread the inherited one.
-  opts.env = { ...(env || process.env), CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: '1' }
-
-  // Transcript healing lives at the TRUE resume point — see runQuery, right before
-  // query() is (re)built. The old factory-time heal was gated on the closure constant
-  // `resume`, so it ran only on the first open; a `/model` switch or a restart re-points
-  // the live `sessionId` and re-enters runQuery, resuming a transcript that was never
-  // re-healed (finding FBL-1). Healing inside runQuery covers EVERY resume path.
-
-  // One-shot Haiku fallback suggestion. Runs on the SAME subscription auth as the room
-  // (opts.env carries the OAuth — no API key needed), but as a BARE model call: no
-  // settingSources, no MCP, no tools — so it's a fast cold call, not a full session boot.
-  // Fed only `lastAssistantText` (trimmed). Never blocks a turn; any failure is silent.
-  //
-  // BUILT-IN ANTHROPIC PATH ONLY (`suggest`). On a lane running a registered custom
-  // provider, opts.env carries that provider's ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN —
-  // so this hardcoded `claude-haiku-4-5` call would spend the USER'S OWN BYOK credit on a
-  // composer prefill they never asked for, at whatever (wrong, flagship) model the endpoint
-  // maps the unknown id to. z.ai silently serves glm for any `claude-*` id, which is exactly
-  // why this went unnoticed; a stricter provider 400s. This is an Anthropic-subscription
-  // freebie — it does not get a per-provider small model, it gets switched off.
-  const haikuSuggest = async () => {
-    if (!suggest) return
-    const seed = (lastAssistantText || '').trim().slice(-1500)
-    if (!seed || closed) return
-    try {
-      let out = await claudeOneShot({
-        prompt: `You are predicting the user's NEXT chat message in a live coding session, to prefill their composer. Given the assistant's latest reply below, output the single most likely next user message — short and natural (often just "proceed", "go with option A", "yes do that", or a brief follow-up). One line, <=12 words, imperative, no preamble, no quotes, no markdown.\n\nAssistant's latest reply:\n"""\n${seed}\n"""\n\nNext user message:`,
-        model: 'claude-haiku-4-5', cwd, env: opts.env, timeoutMs: 8000,
-      })
-      out = out.trim().split('\n')[0].replace(/^["'`]+|["'`]+$/g, '').trim().slice(0, 140)
-      if (out && !sawSuggestion && !closed && !/^(sure|of course|certainly|let me know|i can help|happy to)\b/i.test(out)) {
-        emit({ kind: 'suggestion', text: out, source: 'haiku' })
-        process.stderr.write(`  ◆ [suggestion] haiku fallback: ${JSON.stringify(out)}\n`)
-      }
-    } catch { /* fallback failed (rate limit / abort / model error) — silent */ }
-  }
-
-  const admitColdStart = () => {
-    const gate = typeof admitStart === 'function' ? admitStart() : { ok: true }
-    if (gate?.ok !== false) return true
-    emit({ kind: 'error', message: gate.reason || 'Host memory is critically low. This agent runtime was not started.', recoverable: true })
-    return false
-  }
-
-  const runQuery = async ({ admitted = false } = {}) => {
-    if (!started && !admitted && !admitColdStart()) return false
-    if (spawnT0 == null) spawnT0 = Date.now()
-    started = true
-    // Per-query AbortController (child of the session `ac`): lets a model switch kill
-    // just this query. Resolve the previous qDone in case it's still pending.
-    if (qDoneResolve) { try { qDoneResolve() } catch { /* noop */ } }
-    qDone = new Promise((res) => { qDoneResolve = res })
-    const myAc = new AbortController()
-    qAc = myAc
-    const onParentAbort = () => { try { myAc.abort() } catch { /* noop */ } }
-    ac.signal.addEventListener('abort', onParentAbort, { once: true })
-    try {
-      // Heal the transcript we're about to REPLAY — at the true resume point, keyed on the
-      // LIVE `sessionId` (not the factory-time `resume` constant). `sessionId` mutates:
-      // recreateForSwitch re-points it to persistedSessionId and the restart / bad-resume
-      // forks re-point it too, each re-entering runQuery. A `/model` switch (or restart) that
-      // resumed a corrupted transcript — a dangling tool_use / tool_result-in-assistant left
-      // by an aborted mid-tool turn — used to hit an Anthropic 400 (H42 class) and wedge the
-      // lane on every send (finding FBL-1). sanitizeSession is idempotent + a no-op on clean
-      // transcripts, so healing before EVERY resume is free. See transcript-sanitize.mjs.
-      if (sessionId) {
-        const healed = sanitizeSession(cwd || process.cwd(), sessionId)
-        if (healed.blocks) process.stderr.write(`\n  ◆ healed ${healed.blocks} malformed tool block(s) in the transcript before resume.\n`)
-      }
-      q = query({ prompt: input.stream, options: { ...opts, abortController: myAc, ...(sessionId ? { resume: sessionId } : {}) } })
-      for await (const m of q) {
-        if (closed) break
-        switch (m.type) {
-          case 'system':
-            // Live thinking-token progress — the running estimate while the
-            // model reasons, surfaced as the indicator's ↓ N tokens. Coarse,
-            // emitted during extended thinking; not a per-token stream.
-            if (m.subtype === 'thinking_tokens') {
-              // The reasoning-phase estimate (smooth, but approximate). Only
-              // surface it BEFORE real output streams — once message_delta gives
-              // us authoritative output_tokens (which already include thinking),
-              // that supersedes the estimate so the count never jumps backwards.
-              if (turnBaseOut + curMsgOut === 0) emit({ kind: 'thinking_tokens', tokens: m.estimated_tokens, delta: m.estimated_tokens_delta })
-              break
-            }
-            // compact_boundary — the authoritative compaction event (replaces the
-            // old heuristic): trigger ('manual' for /compact vs 'auto') + the token
-            // count before compaction. Emit a real recap card the room can pin.
-            if (m.subtype === 'compact_boundary') {
-              forceFullReminder = true
-              emit({ kind: 'compaction', trigger: m.compact_metadata?.trigger || 'auto', preTokens: m.compact_metadata?.pre_tokens ?? null })
-              // Refresh the ctx% meter RIGHT AFTER compaction — it otherwise only updates at
-              // turn-end, so the mode row kept showing the stale PRE-compaction window
-              // ("ctx 90% even though we just compacted", Max 2026-07-02). Re-query the live
-              // context usage so the meter drops to the compacted size immediately.
-              ;(async () => {
-                try {
-                  const c = await q?.getContextUsage?.()
-                  if (c) { emit({ kind: 'usage', ctx: correctContext({ used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }) }); if (c.model) curModel = c.model }
-                } catch { /* control req may be unavailable */ }
-              })()
-              break
-            }
-            if (m.session_id) sessionId = m.session_id
-            // Cold-start timing — the init system message is when the terminal is
-            // usable, so spawn→here IS the latency the user waits on. One line per
-            // open. Compare a normal open vs one with TP_MCP_STRICT=1 to read off how
-            // many ms the host MCP servers cost. (each resume also pays a sanitizeSession heal — see runQuery.)
-            if (!readyLogged) {
-              readyLogged = true
-              process.stderr.write(`\n  ◆ session ready in ${Date.now() - spawnT0}ms — MCP ${process.env.TP_MCP_STRICT === '1' ? 'OFF' : 'on'}${resume ? ', resume' : ', fresh'}.\n`)
-            }
-            // The init advertises both real Skills and Claude Code's TUI/profile
-            // palette.  Normalise it to the structured room contract: supported
-            // bridge controls plus installed Skills, never unsafe interactive or
-            // profile-global commands (see claude-command-catalog.mjs).
-            // Prefer the INTENDED model (opts.model — set at open and on every /model switch)
-            // over the message's own `m.model`. A RESUMED session REPLAYS the transcript's old
-            // init messages, all carrying the PRE-switch model, and each one used to reset the
-            // displayed model back (Max 2026-07-02: switch to Fable, then 24 replayed
-            // "init model=claude-opus-4-8" dragged the chip back to Opus with no result yet to
-            // correct it). opts.model reflects what the session will actually run, so trust it.
-            curModel = opts.model || m.model || model || curModel
-            emit({ kind: 'system', sessionId, model: opts.model || m.model || model || null, commands: normalizeClaudeCommandCatalog({ slashCommands: m.slash_commands, skills: m.skills }) })
-            // AskUserQuestion regression guard — the init message carries the session's
-            // real tool list. If a caret SDK bump silently dropped AskUserQuestion from
-            // it (the 2026-07-08 outage), surface it loudly instead of a dead card. One-
-            // shot per session (resumed sessions replay init messages). Fails open when
-            // the message shape carries no tools[].
-            if (!sdkToolsChecked && Array.isArray(m.tools)) {
-              sdkToolsChecked = true
-              const regression = askUserQuestionRegression(m.tools, SDK_VERSION)
-              if (regression) {
-                process.stderr.write(`\n  ⚠⚠ ${regression}\n`)
-                emit({ kind: 'error', message: regression })
-              }
-            }
-            // Dynamic model list — ask the SDK for its OWN supported models and surface
-            // them to the room so the /model picker renders live options (incl. new
-            // models like Fable) instead of a hardcoded three-item list. Fire-and-forget:
-            // older rooms just never receive it and keep their static fallback; a query
-            // that lacks supportedModels() (old SDK) silently no-ops. One-shot per session.
-            if (!modelsSent) {
-              modelsSent = true
-              Promise.resolve(q?.supportedModels?.()).then((ms) => {
-                const models = (ms || [])
-                  .map((x) => ({ value: x?.value, displayName: x?.displayName, description: x?.description }))
-                  .filter((x) => x.value)
-                if (models.length) emit({ kind: 'models', models })
-              }).catch(() => { /* no list available — room keeps its fallback */ })
-            }
-            break
-          case 'assistant':
-            clearResilienceDeadline()
-            // Any assistant block (including a tool_use) has crossed the replay
-            // boundary. A same-target retry is only safe before visible output.
-            turnResilience?.visibleOutput()
-            // Stamp tool-call start times so tool_result can report a duration.
-            for (const b of (m.message?.content || [])) {
-              if (b?.type === 'tool_use' && b.id) toolStart.set(b.id, { at: Date.now(), name: b.name, input: b.input })
-            }
-            // parentToolUseId: non-null when this assistant message comes from a
-            // sub-agent (Task tool) — the universal nesting spine. Thread it so the
-            // room can group sub-agent activity under its parent Task card.
-            // Capture the latest assistant prose — the only context the Haiku fallback needs.
-            { const txt = (m.message?.content || []).filter((b) => b?.type === 'text').map((b) => b.text).join('\n').trim(); if (txt) lastAssistantText = txt }
-            emit({ kind: 'assistant', blocks: simplifyBlocks(m.message?.content), parentToolUseId: m.parent_tool_use_id || null })
-            break
-          case 'user':
-            // tool_result blocks arrive on the user-role echo
-            for (const b of (m.message?.content || [])) {
-              if (b?.type === 'tool_result') {
-                clearResilienceDeadline()
-                turnResilience?.visibleOutput({ tool: true })
-                const start = toolStart.get(b.tool_use_id)
-                if (start != null) toolStart.delete(b.tool_use_id)
-                const evidence = evidenceForToolResult(start?.name, b.content)
-                emit({ kind: 'tool_result', toolUseId: b.tool_use_id, content: b.content, ...(evidence ? { evidence } : {}), isError: !!b.is_error, durationMs: start?.at != null ? Date.now() - start.at : undefined, parentToolUseId: m.parent_tool_use_id || null })
-              }
-            }
-            break
-          case 'stream_event': {
-            // Live output-token progress for the thinking indicator. message_delta
-            // carries the running output_tokens for the current assistant message;
-            // message_start opens a new one (fold the finished message into the
-            // turn base first). Authoritative + monotonic within a turn.
-            const ev = m.event
-            if (ev?.type === 'message_start') {
-              turnBaseOut += curMsgOut
-              curMsgOut = ev.message?.usage?.output_tokens || 0
-              emit({ kind: 'thinking_tokens', tokens: turnBaseOut + curMsgOut })
-            } else if (ev?.type === 'message_delta' && ev.usage) {
-              curMsgOut = ev.usage.output_tokens ?? curMsgOut
-              emit({ kind: 'thinking_tokens', tokens: turnBaseOut + curMsgOut })
-            }
-            break
-          }
-          case 'result':
-            clearResilienceDeadline()
-            if (m.session_id) sessionId = m.session_id
-            // Bad resume target: the CLI can't find the session we tried to resume — a forked
-            // id that was never persisted, or a pruned transcript. It surfaces as an is_error
-            // RESULT (subtype error_during_execution), NOT a thrown error, so it bypasses the
-            // catch below and used to loop forever on the dead id (Max 2026-07-02, sid 6db6c1e3
-            // stuck across restarts + model switches). Drop the resume for good, re-run FRESH
-            // on the current model, and re-deliver the in-flight turn so nothing is lost.
-            if (m.is_error && Array.isArray(m.errors) && m.errors.some((x) => /no conversation found/i.test(String(x))) && (sessionId || persistedSessionId) && restartCount < RESTART_MAX) {
-              restartCount++
-              const wasActive = turnActive
-              turnActive = false
-              sessionId = null; persistedSessionId = null   // never resume the dead id again
-              emit({ kind: 'note', text: 'previous session not found — continuing on a fresh one' })
-              const oldInput = input
-              input = makeInputStream()
-              try { oldInput.end() } catch { /* noop */ }
-              const replay = wasActive ? lastTurnText : null
-              restartTimer = setTimeout(() => {
-                restartTimer = null
-                if (closed) return
-                runQuery()
-                if (replay != null) { turnActive = true; lastEvtTs = Date.now(); stalledSent = false; input.push([{ type: 'text', text: replay }, { type: 'text', text: lastTurnReminder || roomReminder(replay, { forceFull: true }) }]) }
-              }, 300)
-              break
-            }
-            // Swallow the interrupt's redundant teardown results (see `interrupting` above):
-            // abort() already emitted the one canonical aborted boundary. `success` (and any
-            // non-teardown subtype) always emits; only the aborted/error_during_execution pair
-            // the interrupt churns out is dropped, and only inside the timer-bounded window.
-            // This guard MUST precede resilient `is_error` handling: the second teardown echo
-            // is itself an is_error result and may arrive after the next turn has installed a
-            // new controller. Letting it reach that controller would retry the wrong prompt.
-            if (interrupting && (m.subtype === 'aborted' || m.subtype === 'error_during_execution')) {
-              // A late teardown echo from the stopped turn may arrive after the
-              // next turn is accepted. Swallow the echo, but only mutate liveness
-              // while the stopped revision still owns the lane.
-              if (resilienceTurnRevision === interruptingRevision) turnActive = false
-              break
-            }
-            // Some SDK transport failures arrive as an error result instead of a
-            // thrown iterator error. Treat them identically, without serializing
-            // `m.errors` or `m.result` into the room event stream.
-            if (m.is_error && turnResilience) {
-              if (resilienceRetryPending) break
-              turnResilience.failure({ message: Array.isArray(m.errors) ? m.errors.join(' ') : m.result, status: m.status ?? m.statusCode, code: m.code })
-              turnActive = false
-              retryResilientTurn()
-              break
-            }
-            turnBaseOut = 0; curMsgOut = 0   // reset the live token count for the next turn
-            turnActive = false               // turn settled → stall watchdog stands down
-            // A model switch requested mid-turn was deferred — apply it now the turn is done.
-            // Defer to the next tick so recreateForSwitch (which awaits THIS loop's qDone)
-            // doesn't await itself; the setTimeout runs after this iterator yields.
-            if (pendingSwitch) { pendingSwitch = false; setTimeout(() => { if (!closed) recreateForSwitch() }, 0) }
-            if (m.subtype === 'success') { restartCount = 0; if (sessionId) persistedSessionId = sessionId }   // ONLY a real success refills the
-            if (m.subtype === 'success') { turnResilience?.success(); turnResilience = null }
-            // auto-restart budget (else a flapping connection that lands one aborted turn between
-            // drops refills every cycle past RESTART_MAX) — and marks this session id durably
-            // persisted so a later model-switch re-create can safely resume it.
-            forceStopped = false
-            stallRetried = false   // a turn settled → the next turn gets a fresh auto-retry budget
-            // Ground-truth the model from THIS turn's modelUsage (the models actually billed
-            // this turn), not the init/system messages — a RESUMED session REPLAYS the prior
-            // transcript's init messages, so curModel got polluted back to the pre-switch model
-            // even though the turn really ran on the switched one (Max 2026-07-02: chip showed
-            // Opus while inference was Fable). Pick the model that did the most generating.
-            if (m.modelUsage && typeof m.modelUsage === 'object') {
-              let best = null, bestOut = -1
-              for (const [mid, u] of Object.entries(m.modelUsage)) {
-                const out = (u?.outputTokens ?? 0)
-                if (out > bestOut) { bestOut = out; best = mid }
-              }
-              if (best) curModel = best
-            }
-            // resultText: the SDK's final assistant text, clipped. The bridge folds it
-            // into the `turn-done` push body ("<lane> — done: <summary>") so a banner
-            // says what happened, not just that something did. Clipped + whitespace-
-            // collapsed here so neither the broadcast frame nor the persisted log grows
-            // by a full turn's prose. Absent on aborted/error results — nothing to say.
-            { const rt = typeof m.result === 'string' ? m.result.replace(/\s+/g, ' ').trim().slice(0, 200) : ''
-              emit({ kind: 'result', subtype: m.subtype, sessionId, model: curModel, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0, resultText: rt || null }) }
-            // Arm the Haiku fallback: if Claude's own prompt_suggestion doesn't arrive within
-            // the window, generate one from the last assistant reply. (Skip aborted turns.)
-            if (sugTimer) clearTimeout(sugTimer)
-            if (m.subtype !== 'aborted') sugTimer = setTimeout(() => { sugTimer = null; if (!sawSuggestion && !closed) haikuSuggest() }, SUGGEST_FALLBACK_MS)
-            // Surface a usage/context meter (chrome, not a transcript line). The
-            // context window % comes from the control request; cost is cumulative.
-            ;(async () => {
-              let ctx = null
-              try {
-                const c = await q?.getContextUsage?.()
-                if (c) { ctx = correctContext({ used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }); if (c.model) curModel = c.model }
-              } catch { /* control req may be unavailable */ }
-              const u = m.usage || {}
-              emit({ kind: 'usage', costUsd: m.total_cost_usd ?? null, tokens: (u.input_tokens || 0) + (u.output_tokens || 0), ctx })
-            })()
-            break
-          case 'prompt_suggestion':
-            // Claude Code's own predicted next prompt (promptSuggestions opt-in).
-            // Arrives once per turn AFTER `result`; surfaced verbatim as ephemeral
-            // chrome (a ghost-text chip in the room composer), never persisted.
-            if (sugTimer) { clearTimeout(sugTimer); sugTimer = null }   // built-in won — cancel the Haiku fallback
-            if (m.suggestion) { sawSuggestion = true; emit({ kind: 'suggestion', text: m.suggestion }) }
-            break
-          default:
-            break
-        }
-      }
-    } catch (e) {
-      clearResilienceDeadline()
-      if (closed) return
-      // This query was intentionally aborted (a model switch superseded it, or the
-      // session is ending) — not a real error. Stay silent; the re-create owns what's next.
-      if (myAc.signal.aborted) return
-      const msg = e?.message || String(e)
-      // Enabled custom-provider turns have a strict, per-turn controller. It
-      // classifies the raw transport error locally, then either admits one exact
-      // replay before any output or terminates without putting provider details in
-      // the room. The legacy path below is intentionally untouched when disabled.
-      if (turnResilience && turnActive) {
-        turnResilience.failure({ message: msg, status: e?.status ?? e?.statusCode, code: e?.code })
-        turnActive = false
-        retryResilientTurn()
-        return
-      }
-      // onEvent is also the bridge's synchronous busy-edge sampling point. The
-      // query has already ended here, so publish the failure only after clearing
-      // the turn. Otherwise a non-recoverable SDK error leaves the roster on its
-      // last `busy: true` announce until a tab refocus asks for fresh state.
-      turnActive = false
-      emit({ kind: 'error', message: msg })
-      // Auto-restart a transient upstream stream drop: re-run query() with
-      // resume so the conversation continues. Bounded by RESTART_MAX (reset on
-      // each successful result) so a persistent outage can't loop forever; a
-      // fresh input stream is needed because the throw killed the old iterator.
-      if (RECOVERABLE.test(msg) && restartCount < RESTART_MAX) {
-        restartCount++
-        observeRecovery('stream_reconnect', { failureClass: 'network' })
-        emit({ kind: 'note', text: `connection dropped — reconnecting (${restartCount}/${RESTART_MAX})` })
-        // End the OLD input stream before swapping — else its generator leaks
-        // (suspended forever) and a turn pushed into it after the throw is silently
-        // lost (push returns false on an ended stream, so sendTurn can surface it).
-        const oldInput = input
-        input = makeInputStream()
-        try { oldInput.end() } catch { /* noop */ }
-        // Track the timer so end() can cancel it, and re-check `closed` at fire time
-        // so a session torn down during the backoff doesn't spawn a zombie SDK child.
-        restartTimer = setTimeout(() => { restartTimer = null; if (!closed) runQuery() }, Math.min(1000 * restartCount, 4000))   // 1s, 2s, 4s backoff
-        return
-      }
-      // Resume target vanished (a forked session id that was never persisted, or a pruned
-      // transcript): drop the resume and re-run FRESH so the turn/switch still lands instead
-      // of hard-failing. Bounded by RESTART_MAX. Loses only the resumed history, not the turn.
-      if (/no conversation found/i.test(msg) && sessionId && restartCount < RESTART_MAX) {
-        restartCount++
-        sessionId = null; persistedSessionId = null
-        const oldInput = input
-        input = makeInputStream()
-        try { oldInput.end() } catch { /* noop */ }
-        restartTimer = setTimeout(() => { restartTimer = null; if (!closed) runQuery() }, 300)
-        return
-      }
-      // Non-recoverable, or budget exhausted: mark done so sendTurn stops
-      // silently queuing into a dead stream. The bridge's onEvent self-heal
-      // still fires for "No conversation found" (it reopens fresh).
-      closed = true
-    } finally {
-      ac.signal.removeEventListener('abort', onParentAbort)
-      if (qAc === myAc) qAc = null
-      // Await the SDK query's disposal so the underlying CLI PROCESS is actually dead
-      // before qDone resolves — otherwise a model-switch re-create races the dying process
-      // on the session file lock and the resumed query keeps the OLD model (proven 2026-07-02;
-      // q.return() waits on the transport exit, bounded internally to ~2s).
-      try { await q?.return?.() } catch { /* already disposed */ }
-      if (qDoneResolve) { qDoneResolve(); qDoneResolve = null }
-    }
-  }
-  // Re-create the query resuming the SAME session on the switched model (opts.model).
-  // Used when a live setModel isn't possible (resumed session). Tears the current query
-  // fully down and AWAITS its exit before re-running, so the two processes never race on
-  // the session file lock (a concurrent re-create keeps the OLD model — proven 2026-07-02).
-  const recreateForSwitch = async () => {
-    if (closed || !started) return
-    const dying = qDone
-    const oldInput = input
-    input = makeInputStream()          // fresh stream for the re-created query
-    if (qAc) { try { qAc.abort() } catch { /* noop */ } }   // kill the current query's process
-    try { oldInput.end() } catch { /* noop */ }
-    try { await dying } catch { /* noop */ }               // wait until it's actually dead
-    await sleep(300)                                        // brief lock-release margin
-    // Resume the last DURABLY-PERSISTED session, not the live one: the aborted query may
-    // have forked to a session id that was never written to disk, and resuming that fails
-    // with "No conversation found" (Max 2026-07-02, sid 6db6c1e3). persistedSessionId is
-    // always resumable (the restore id, advanced on each success).
-    sessionId = persistedSessionId
-    if (!closed) runQuery()                                 // relaunch on opts.model + resume
-  }
-  // Abort a wedged turn (no event, no throw — the SDK's `for await` blocked inside an
-  // internal retry, e.g. an Anthropic 529-overload window) and re-run it ONCE, preserving
-  // the prompt. Mirrors recreateForSwitch's teardown-then-relaunch (abort qAc → swap the
-  // input stream → await the dying query's disposal so the two processes never race on the
-  // session file lock → resume the durable id) and then RE-PUSHES lastTurnText so the turn
-  // continues instead of being lost. The stall error was already surfaced by the watchdog
-  // (emitRaw of stallEvent('retry', …)); this adds a 'note' once the fresh turn is armed.
-  // Bounded to one call per turn by stallRetried (set in the interval before we're called).
-  const retryStalledTurn = async (quietMs) => {
-    if (closed) return
-    stallRetried = true
-    const wasActive = turnActive
-    // NEVER replay a `/compact`. The abort below is what cancels an in-flight compaction, and
-    // re-pushing the command just feeds the next abort. stallDecision already stands down while
-    // `compacting` is armed, so this is the belt for the window where the flag was cleared by a
-    // mid-compaction error but lastTurnText is still the command.
-    const replay = wasActive && !isCompactTurn(lastTurnText) ? lastTurnText : null
-    turnActive = false                                     // unblock between-turns updates while we tear down
-    const dying = qDone
-    const oldInput = input
-    input = makeInputStream()                              // fresh stream for the relaunched query
-    if (qAc) { try { qAc.abort() } catch { /* noop */ } }  // unblock the wedged for-await → its catch disposes the process
-    try { oldInput.end() } catch { /* noop */ }
-    try { await dying } catch { /* noop */ }               // wait until the old query is actually dead (avoids the lock race)
-    await sleep(300)                                       // brief lock-release margin
-    sessionId = persistedSessionId                         // resume the durably-persisted id (recreateForSwitch invariant)
-    if (closed) return
-    runQuery()
-    if (replay != null) {
-      turnActive = true; lastEvtTs = Date.now(); stalledSent = false   // re-arm liveness for the retried turn
-      // Match sendTurn's block shape: a slash command goes clean; a normal turn keeps the reminder.
-      input.push(/^\s*\//.test(replay) ? [{ type: 'text', text: replay }] : [{ type: 'text', text: replay }, { type: 'text', text: lastTurnReminder || roomReminder(replay, { forceFull: true }) }])
-      emitRaw({ kind: 'note', text: 'retrying the stalled turn on a fresh connection' })
-    }
-  }
-  // A resilience retry has to wait for the failed Query's disposal: otherwise the
-  // replay races its session-file lock. Admission is deliberately before runQuery(),
-  // so a refused cap/circuit sends no second provider submission.
-  const retryResilientTurn = () => {
-    if (closed || abortPending || resilienceRetryPending) return
-    const retryingTurn = turnResilience
-    const retryingRevision = resilienceTurnRevision
-    const retryingBlocks = lastTurnBlocks
-    resilienceRetryPending = true
-    const dying = qDone
-    const oldInput = input
-    input = makeInputStream()
-    try { oldInput.end() } catch { /* noop */ }
-    restartTimer = setTimeout(async () => {
-      restartTimer = null
-      try { await dying } catch { /* disposal failure still fails closed below */ }
-      if (closed || !resilienceRetryPending || turnResilience !== retryingTurn || resilienceTurnRevision !== retryingRevision) return
-      if (!(await admitResilientSubmission())) {
-        resilienceRetryPending = false
-        finishResilientFailure()
-        return
-      }
-      if (closed || !resilienceRetryPending || turnResilience !== retryingTurn || resilienceTurnRevision !== retryingRevision) return
-      resilienceRetryPending = false
-      turnActive = true
-      lastEvtTs = Date.now()
-      stalledSent = false
-      runQuery()
-      // This is the exact previously accepted prompt block array, not a rebuilt
-      // string/reminder. It is only reached before assistant or tool output.
-      if (retryingBlocks) input.push(retryingBlocks)
-      armResilienceDeadline()
-    }, 0)
-  }
-  const finishResilientFailure = () => {
-    clearResilienceDeadline()
-    turnActive = false
-    turnResilience = null
-    // The failed Query is gone, but the lane remains recoverable for a later
-    // human turn. `started=false` ensures that turn creates a fresh Query rather
-    // than pushing into the ended stream.
-    started = false
-    emit({
-      kind: 'error',
-      message: 'The configured provider could not complete this turn. Nothing else was sent.',
-      recoverable: true,
-    })
-  }
-  // A custom resilient session defers its otherwise-eager query creation until a
-  // turn clears the injected admission gate. Disabled and built-in sessions retain
-  // their existing eager start and RESTART_MAX behavior.
-  if (!lazy && !resilienceEnabled) runQuery()
-
-  return {
-    // A lazy (restored-idle) session cold-boots the query on its first turn. input.push
-    // is queue-backed, so the pushed turn buffers and runs once the query is ready.
-    sendTurn(text) { if (closed || abortPending || resilienceRetryPending) return false; if (!started && !admitColdStart()) return false; if (!started && prepareCwd) { try { const next = prepareCwd(); if (next) { cwd = next; opts.cwd = next } } catch { /* keep original cwd */ } } turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; stallRetried = false; forceStopped = false;
-      const t = String(text)
-      const promptIndex = userPromptNo++
-      const thisTurnForceFull = forceFullReminder
-      forceFullReminder = /^\s*\/(?:compact|clear|reset)\b/i.test(t)
-      lastTurnReminder = /^\s*\//.test(t) ? null : roomReminder(t, { promptIndex, forceFull: thisTurnForceFull })
-      // Arm the compaction window BEFORE the push: from here until the `compaction` milestone
-      // (or the turn's result) the SDK is allowed to be silent for minutes without the stall
-      // watchdog aborting it. See turn-stall.mjs — aborting a compaction is what produced
-      // `AbortError: Compaction canceled.` in the room.
-      compacting = isCompactTurn(t)
-      // SDK 0.3.198 only recognizes a slash command (/compact, /clear, custom /cmds) when the
-      // user message is a SINGLE text block. Appending the per-turn ROOM NOW <system-reminder>
-      // as a 2nd block made 0.3.198 treat /compact as a plain turn → compaction silently
-      // no-op'd (Max, 2026-07-02; 0.3.185 tolerated the extra block, 0.3.198 tightened it —
-      // verified against the SDK: single-block → the compact command RUNS, two-block → not
-      // recognized). So a slash command goes CLEAN; conversational turns keep the reminder.
-      // Normal turns never start with "/" (composeAgentStdin prepends the preamble), and the
-      // web already routes "/"-prefixed input as a command (pane.jsx), so this matches intent.
-      lastTurnBlocks = /^\s*\//.test(t) ? [{ type: 'text', text: t }] : [{ type: 'text', text: t }, { type: 'text', text: lastTurnReminder }]
-      resilienceTurnRevision++
-      turnResilience = createTurnResilience()
-      if (turnResilience) {
-        const submittingTurn = turnResilience
-        const submittingRevision = resilienceTurnRevision
-        const submittingBlocks = lastTurnBlocks
-        // Keep the public sendTurn edge synchronous. The prompt is held locally until
-        // the asynchronous bridge cap admits it; a rejection never reaches the SDK.
-        void admitResilientSubmission().then((admitted) => {
-          // Stop or a newer human turn can land while cap admission is pending.
-          // In either case this exact turn no longer owns the submission edge.
-          if (closed || !turnActive || turnResilience !== submittingTurn || resilienceTurnRevision !== submittingRevision) return
-          if (!admitted) { finishResilientFailure(); return }
-          if (!started) runQuery({ admitted: true })
-          input.push(submittingBlocks)
-          armResilienceDeadline()
-        }).catch(() => {
-          if (!closed && turnActive && turnResilience === submittingTurn && resilienceTurnRevision === submittingRevision) finishResilientFailure()
-        })
-      } else {
-        if (!started) runQuery({ admitted: true })
-        input.push(lastTurnBlocks)
-      }
-    },
-    // Cold-boot the query WITHOUT sending a turn — the background warmer calls this on
-    // lazily-restored idle terminals so they're ready before the user clicks them.
-    warm() { if (!resilienceEnabled && !started && !closed) runQuery() },
-    get started() { return started },
-    // Set the permission mode — Claude Code's ⇧⇥ cycle. setPermissionMode is a
-    // streaming control request (drives plan-mode behaviour SDK-side); the local
-    // `mode` drives our PreToolUse auto-approve policy. Echo so the room syncs.
-    async setMode(m) {
-      if (!MODES.has(m) || closed) return
-      mode = m              // gate is authoritative immediately
-      scheduleSdkMode(m)    // defer the SDK control request — a mode toggle can
-                            // land while a perm card is pending (hook in flight),
-                            // which is exactly the re-entrancy that jams it.
-      emit({ kind: 'mode', mode })
-    },
-    // /model is disabled in headless SDK — switch via the setModel control
-    // instead, and echo a note line so both drivers see the change.
-    async setModel(m) {
-      // Pin the switch into opts + curModel so every subsequent query re-run (auto-restart
-      // OR the re-create below) carries it.
-      opts.model = m
-      curModel = m
-      emit({ kind: 'note', text: `model → ${m}` })
-      if (!started || closed) return   // not launched yet → the first runQuery uses opts.model
-      // Do NOT trust the live q.setModel: on a RESUMED streaming session it RESOLVES without
-      // error but is a silent no-op (the turn keeps running the old model — Max 2026-07-02).
-      // The only reliable switch is to RE-CREATE the query resuming the same session on the
-      // new model (query({resume, model}) honours it — proven). Defer a mid-turn switch to
-      // turn-end so we don't rip out an in-flight turn.
-      if (turnActive) { pendingSwitch = true; return }
-      await recreateForSwitch()
-    },
-    async setEffort(level) {
-      if (!effortLevels.has(level) || closed) return false
-      effort = level
-      opts.effort = level
-      emit({ kind: 'effort', level })
-      if (!started) return true
-      if (turnActive) { pendingSwitch = true; return true }
-      await recreateForSwitch()
-      return true
-    },
-    async listModels() {
-      try {
-        const ms = await q?.supportedModels?.()
-        const models = (ms || [])
-          .map((x) => ({ value: x?.value, displayName: x?.displayName, description: x?.description }))
-          .filter((x) => x.value)
-        // Structured event drives the picker; the note is a human-readable echo for the log.
-        if (models.length) emit({ kind: 'models', models })
-        emit({ kind: 'note', text: models.length ? `models: ${models.map((x) => x.value).join(', ')}` : 'no model list available' })
-      } catch { emit({ kind: 'note', text: 'usage: /model <name>' }) }
-    },
-    // Graceful interrupt (Esc / Stop) — stops the current turn but keeps the
-    // session alive for the next one. ac.abort() is teardown only (end()).
-    async abort() {
-      if (abortPending) return
-      abortPending = true
-      try {
-      // Swallow the SDK's redundant interrupt teardown (aborted + error_during_execution +
-      // re-init) — we emit the one canonical boundary below. Set BEFORE interrupt so the
-      // teardown results, which arrive async on the query loop, are caught; the timer bounds
-      // the window so a genuine later turn failure still surfaces.
-      const retryWasPending = resilienceRetryPending
-      const retryDisposal = retryWasPending ? qDone : null
-      if (turnActive || retryWasPending) {
-        resilienceTurnRevision++
-        // Keep the retry-pending ingress guard armed while Stop awaits the old
-        // process. The revision invalidates the retry itself; the flag prevents
-        // a new human turn from entering its reader-less replacement stream.
-        if (!retryWasPending) resilienceRetryPending = false
-        clearResilienceDeadline()
-        turnResilience?.failure({ aborted: true })
-        if (retryWasPending) {
-          clearTimeout(restartTimer)
-          restartTimer = null
-          started = false
-        }
-        interrupting = true
-        interruptingRevision = resilienceTurnRevision
-        clearTimeout(interruptTimer)
-        interruptTimer = setTimeout(() => { interrupting = false; interruptingRevision = null }, INTERRUPT_SWALLOW_MS)
-      }
-      try { await q?.interrupt?.() } catch { /* noop */ }
-      // A failed query may already be inside its bounded disposal while its
-      // retry owns no live SDK turn. Keep Stop's barrier open until that process
-      // is actually gone so a later human turn cannot race its session lock.
-      if (retryDisposal) { try { await retryDisposal } catch { /* already disposed */ } }
-      if (retryWasPending) resilienceRetryPending = false
-      // interrupt() stops the turn but emits NO terminal message. Without one the
-      // struct stream ends on a non-terminal event, so on resume the SDK treats the
-      // turn as INCOMPLETE and auto-continues it — the 2026-06-22 "zombie turn that
-      // resumes itself" storm. Emit a terminal result so the turn is marked DONE +
-      // persists across refresh. Guarded on turnActive to avoid a double-emit if the
-      // SDK already surfaced one for the interrupt. (restored from 0.7.49)
-      if (turnActive || retryWasPending) { turnActive = false; emit({ kind: 'result', subtype: 'aborted', sessionId }) }
-      } finally {
-        abortPending = false
-      }
-    },
-    end() { closed = true; clearResilienceDeadline(); clearInterval(stallTimer); clearTimeout(interruptTimer); clearTimeout(restartTimer); if (sugTimer) clearTimeout(sugTimer); input.end(); try { ac.abort() } catch { /* noop */ } },
-    get sessionId() { return sessionId },
-    get mode() { return mode },
-    get turnActive() { return turnActive },   // a turn is in flight (gates between-turns update restart — Slice 3 Contract #1)
-  }
-}
+import{randomUUID as e}from"node:crypto";import{createRequire as t}from"node:module";import{readFileSync as o}from"node:fs";import{dirname as n,join as s}from"node:path";import{query as r}from"@anthropic-ai/claude-agent-sdk";import{sanitizeSession as i}from"./transcript-sanitize.mjs";import{reviewGatePreToolDecision as a}from"./flow-review-gate.mjs";import{crossPostNeedsCard as l}from"./cross-terminal.mjs";import{correctContext as c}from"./context-windows.mjs";import{normalizeClaudeCommandCatalog as d}from"./claude-command-catalog.mjs";import{evidenceForToolResult as u}from"./evidence-citations.mjs";import{THINKPOOL_CASCADE_RULE as p,THINKPOOL_REMOTE_DELIVERY_RULES as m,THINKPOOL_RUNTIME_AUTHORITY_RULE as h,THINKPOOL_RUNTIME_TURN_REMINDER as f,buildThinkPoolTurnGuidance as y,createRoomContextSelector as k,usesFullThinkPoolReminder as g}from"./thinkpool-room-prompt.mjs";import{stallDecision as w,stallEvent as b,isCompactTurn as v}from"./turn-stall.mjs";import{createSameTargetResilienceController as _,formatResilienceTrace as T}from"./provider-resilience.mjs";const S=t(import.meta.url);export async function claudeOneShot({prompt:e,model:t="claude-haiku-4-5",cwd:o,env:n,timeoutMs:s=8e3}={}){const i=new AbortController,a=setTimeout(()=>{try{i.abort()}catch{}},s);try{const s=r({prompt:e,options:{model:t,...o?{cwd:o}:{},env:n,maxTurns:1,permissionMode:"bypassPermissions",settingSources:[],strictMcpConfig:!0,mcpServers:{},abortController:i}});let a="";for await(const e of s){if("assistant"===e.type)for(const t of e.message?.content||[])"text"===t.type&&(a+=t.text);if("result"===e.type)break}return a.trim()}finally{clearTimeout(a)}}const E=(()=>{try{let e=n(S.resolve("@anthropic-ai/claude-agent-sdk"));for(let t=0;t<8;t++){try{const t=JSON.parse(o(s(e,"package.json"),"utf8"));if("@anthropic-ai/claude-agent-sdk"===t.name)return t.version}catch{}const t=n(e);if(t===e)break;e=t}}catch{}return"unknown"})(),N=/\brm\s+\S|\brmdir\s+\S|\bgit\s+(push\s+(-f|--force)|reset\s+--hard|clean\s+-[a-z]*f)|\bdrop\s+(table|database)\b|\b(mkfs|dd)\b|\bsudo\b|>\s*\/dev\/|\bchmod\s+-R|\bchown\s+-R|\bkillall\b|\btruncate\b/i,O=new Set(["Read","Grep","Glob","NotebookRead","TodoRead","LS"]),P=new Set(["WebFetch","WebSearch"]),R=new Set(["Edit","Write","MultiEdit","NotebookEdit","TodoWrite"]);export function classifyRisk(e,t){if("Bash"===e){const e=t&&(t.command??t.cmd)||"";return N.test(e)?"high":"medium"}return O.has(e)?"low":P.has(e)?"network":(R.has(e),"medium")}const A=/(^|\/)\.claude\/SESSIONS\/|(^|\/)CLAUDE\.md$/;export function isSafeDocWrite(e,t){if(!R.has(e))return!1;const o=t&&(t.file_path||t.notebook_path)||"";return A.test(o)}export function autoAllow({toolName:e,input:t,mode:o="default",alwaysAllow:n=new Set}){const s=classifyRisk(e,t);return"low"===s||"bypassPermissions"===o||"acceptEdits"===o&&R.has(e)&&"high"!==s||isSafeDocWrite(e,t)||n.has(`${e}:${s}`)}export function askUserQuestionHookOutput(e){const t=e&&"object"==typeof e?e.decision:e,o="string"==typeof t&&t.startsWith("answer:")?t.slice(7):"",n=e&&"object"==typeof e?e.responder:null,s="string"==typeof n?.name&&n.name.trim()?n.name.trim():"string"==typeof n?.id&&n.id?`room member ${n.id}`:"The user";return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:o?`${s} answered in the ThinkPool room — ${o}. Treat this as their selection and continue; do not call AskUserQuestion again for the same question.`:"The user dismissed the question in the ThinkPool room without selecting. Ask in plain prose, or proceed with a sensible default."}}}export function askUserQuestionRegression(e,t){return Array.isArray(e)?e.includes("AskUserQuestion")?null:`[SDK-REGRESSION] agent SDK v${t||"unknown"} init tools[] is missing 'AskUserQuestion' — the multiple-choice question card is disabled. A caret SDK bump likely changed the canUseTool gate; pin a known-good SDK in bridge/package.json + republish.`:null}function D(){const e=[];let t=null,o=!1;return{stream:async function*(){for(;!o;)e.length?yield e.shift():await new Promise(e=>{t=e})}(),push:n=>!o&&(e.push({type:"user",message:{role:"user",content:n}}),t&&(t(),t=null),!0),end(){o=!0,t&&(t(),t=null)}}}const x=(e=[])=>e.map(e=>"text"===e.type?{type:"text",text:e.text}:"thinking"===e.type?{type:"thinking",text:e.thinking||"",reasoningKind:"thought"}:"tool_use"===e.type?{type:"tool_use",id:e.id,name:e.name,input:e.input}:{type:e.type}).filter(Boolean),I=new Set(["default","acceptEdits","plan","bypassPermissions"]),M=["You are Claude in a ThinkPool Code room, driven live from a phone or browser — NOT a local terminal. Keep using the room's features.",f,"TERMINAL HIERARCHY: obey your authoritative TERMINAL ROLE. A person-authored request to open, launch, start, spawn, or create a new, separate, independent, top-level, or main terminal uses open_main_terminal — NEVER spawn_terminal — even for ordinary work or a handoff. If the wording includes new or separate terminal, main-terminal routing wins. Use spawn_terminal only for agent-decided bounded worker slices or when the person explicitly asks for a worker, sub-terminal, Ensemble lane, or delegated slice. If open_main_terminal is unavailable, say so; never substitute an Ensemble child. Leaf, worker, Side, and managed Flow lanes work directly. Never use built-in invisible Task/Agent subagents or hijack a busy sibling.","WORKTREES: parallel lanes share one repo — before code edits run `git worktree list`; if linked worktrees exist, take your OWN worktree + branch, never the shared checkout or a branch another lane is on.","BUILD WORKFLOW (default, no magic word): right-size within your TERMINAL ROLE — a trivial ask or delegated slice you just do; a conductor-capable role with a genuinely decomposable build FIRST writes a short plan in chat, THEN fans worker slices into visible spawn_terminal lanes and verifies them. Worker/leaf/Side/managed Flow roles do not fan out. A person-requested new or separate terminal uses open_main_terminal. Never plan-mode/ExitPlanMode; plans live in chat and lanes in the existing list."].join(" ");export function startClaudeSession({cwd:t,model:o,effort:n="high",resume:s,env:f,mode:S="default",onEvent:N,requestPermission:O,mcpServers:P,crossPostGate:R,crossRoomPostGate:A,didSpawnTarget:U=null,terminalRolePrompt:C,rolePrompt:L,blockSubagents:W=!1,onSubmitPlan:F=null,onLaneDone:$=null,onReviewVerdict:j=null,reviewGate:q=null,lazy:G=!1,roomContext:B=null,suggest:H=!0,prepareCwd:K=null,admitStart:Q=null,resilienceObserver:Y=null,resilience:z=null}){const J=k(B);let V=0,X=!0;const Z=(e,{promptIndex:t=0,forceFull:o=!1}={})=>{const n=g({promptIndex:t,forceFull:o}),s=J({force:n}),r=String(C||"").trim();return`<system-reminder>\n${n&&r?`${r}\n\n`:""}${n?M:y({text:e,promptIndex:t,forceFull:o})}${s?`\n\n${s}`:""}\n</system-reminder>`},ee=new AbortController;let te=D(),oe=s||null,ne=s||null,se=null,re=null,ie=null,ae=!1,le=!1,ce=null,de=!1,ue=!1,pe=!1,me=null,he=I.has(S)?S:"default";const fe=new Set,ye=new Map,ke=new Set(["low","medium","high","xhigh","max"]);let ge=ke.has(n)?n:"high",we=0,be=0,ve=o||null,_e=null,Te=null,Se=Promise.resolve(),Ee=!1;const Ne=e=>new Promise(t=>setTimeout(t,e)),Oe=Math.max(3e4,parseInt(process.env.TP_STALL_MS,10)||9e4);let Pe=!1,Re=Date.now(),Ae=!1;const De=/connection closed|connection reset|econnreset|etimedout|socket hang up|fetch failed|network error|socket destroyed/i;let xe=0;const Ie=(e,t={})=>{try{Y?.({reason:e,restartCount:xe,...t})}catch{}},Me=!(!z?.policy?.enabled||!z?.providerId||"anthropic"===z.providerId);let Ue=null,Ce=null,Le=!1,We=0,Fe=!1,$e=null;const je=Math.max(3*Oe,parseInt(process.env.TP_FORCE_STOP_MS,10)||3e5);let qe=!1,Ge=!1;const Be=Math.max(je,parseInt(process.env.TP_COMPACT_FORCE_STOP_MS,10)||12e5);let He=!1,Ke=0;const Qe=O;O=async e=>{Ke++;try{return await(Qe?.(e))}finally{Ke=Math.max(0,Ke-1),Re=Date.now()}};let Ye=!1,ze=null,Je=null,Ve=!1,Xe="",Ze=null;const et=Math.max(1200,parseInt(process.env.TP_SUGGEST_FALLBACK_MS,10)||2500),tt=e=>{try{N?.(e)}catch{}},ot=e=>{Re=Date.now(),e&&"stalled"!==e.kind&&(Ae=!1),!e||"compaction"!==e.kind&&"result"!==e.kind&&"error"!==e.kind||(He=!1),tt(e)},nt=e=>{try{z?.onRecord?.(e)}catch{}"retrying"!==e?.outcome&&"cap_blocked"!==e?.outcome&&"circuit_open"!==e?.outcome||ot({kind:"note",text:T(e)})},st=()=>{if(null!=Ce){try{(z?.clearTimer||clearTimeout)(Ce)}catch{}Ce=null}},rt=()=>{if(st(),!Ue)return;const e=Number(z?.policy?.timeoutMs);if(!Number.isFinite(e)||e<=0)return;const t=z?.setTimer||setTimeout;Ce=t(()=>{if(Ce=null,!ae&&Ue&&Pe){Ue.failure({message:"timeout"}),Pe=!1;try{_e?.abort()}catch{}ft()}},e)},it=async()=>{if(!Ue)return!0;let e=null;try{e=await Ue.preflight()}catch{return!1}return!0===e?.admitted},at=setInterval(()=>{const e=Date.now()-Re,t=w({turnActive:Pe,awaitingUser:Ke,quietMs:e,stallMs:Oe,forceStopMs:je,stalledSent:Ae,stallRetried:Ge,compacting:He,compactForceStopMs:Be});if("none"===t)return;const o=b(t,e);if(o&&tt(o),"status"!==t){if("retry"===t){if(qe=!0,Ue){Ie("resilience_stall",{quietMs:e}),Ue.failure({message:"timeout"}),Pe=!1;try{_e?.abort()}catch{}return void ft()}return Ie("stall_replay",{quietMs:e}),void ht(e)}qe=!0,Pe=!1}else Ae=!0},5e3);at.unref?.();const lt=e=>{setTimeout(()=>{Promise.resolve(me?.setPermissionMode?.(e)).catch(t=>console.error(`[claude-session] setPermissionMode(${e}) failed:`,t?.message||t))},0)},ct={abortController:ee,permissionMode:he,hooks:{PreToolUse:[{hooks:[async t=>{const o=t.tool_name,n=t.tool_input,s=t.effort?.level;s&&s!==ge&&(ge=s,ot({kind:"effort",level:ge}));const r="Write"===o||"Edit"===o||"MultiEdit"===o||"NotebookEdit"===o;if(W&&r&&/(?:^|[/\\])FLOW_PLAN\.json$/i.test(n?.file_path||n?.notebook_path||"")){const e=n?.content??n?.new_string??"";let t={ok:!1,message:"Plan submission is not wired for this session."};try{t=F&&await F(e)||t}catch(e){t={ok:!1,message:`Plan submission failed: ${e?.message||e}`}}return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:t.message}}}if(W&&("Task"===o||"Agent"===o||"Bash"===o||r))return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:"Bash"===o?"Flow conductors do NOT run Bash — it pops a permission card and stalls the flow. Use the Grep tool (not `grep`/`rg`), the Glob tool (not `find`/`ls`), and Read (not `cat`/`head`) — those run with no prompt. Then DECOMPOSE and submit by Writing your task-graph JSON to the file FLOW_PLAN.json.":r?'Flow conductors do NOT write project or plan-document files. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). To SUBMIT your decomposition, use the Write tool with file_path "FLOW_PLAN.json" and content = your task-graph JSON ({"summary":"…","tasks":[…]}). That single Write IS how you submit — the room ingests it directly. Do not write any other file.':"Flow conductors do NOT spawn subagents — it stalls the flow on a permission card. Inspect the codebase yourself with Read/Grep/Glob (no prompt). Then DECOMPOSE and submit by Writing your task-graph JSON to the file FLOW_PLAN.json. Do not call Task/Agent again."}};if(j&&("Write"===o||"Edit"===o)&&/(?:^|[/\\])FLOW_REVIEW(\.[a-zA-Z0-9]+)?$/.test(n?.file_path||"")){let e={ok:!1,message:"verdict signal failed"};try{e=await j(n?.content??n?.new_string??"")||e}catch(t){e={ok:!1,message:`verdict signal failed: ${t?.message||t}`}}return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:e.message}}}if($&&("Write"===o||"Edit"===o)&&/(?:^|[/\\])FLOW_DONE(\.[a-zA-Z0-9]+)?$/.test(n?.file_path||"")){let e={ok:!1,message:"done signal failed"};try{e=await $(n?.content??n?.new_string??"")||e}catch(t){e={ok:!1,message:`done signal failed: ${t?.message||t}`}}return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:e.message}}}const i=a({reviewGate:q,toolName:o,toolInput:n});if(i)return i;if("mcp__thinkpool__read_terminal"===o)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved (read-only ThinkPool cross-terminal read)."}};if(/^mcp__thinkpool__preview_(start|capture|inspect|stop)$/.test(o))return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved (contained bridge-owned viewport preview)."}};if("mcp__thinkpool__submit_flow_plan"===o)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved (Flow plan submission — broadcasts the task-graph for human approval)."}};if("mcp__thinkpool__list_sessions"===o||"mcp__thinkpool__read_session"===o)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved (read-only ThinkPool cross-session read — your own rooms)."}};if("mcp__thinkpool__close_terminal"===o)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved (ThinkPool cross-terminal close — only self-spawned lanes)."}};if("mcp__thinkpool__spawn_terminal"===o)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Auto-approved (autonomous ThinkPool worker; bounded by room caps and isolated in its own worktree)."}};if("mcp__thinkpool__open_main_terminal"===o){const t=n?.mode||he;if("bypassPermissions"!==t||"bypassPermissions"===he)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:`Auto-approved (open a fresh ThinkPool terminal in ${t} mode — inherited, no escalation; bounded by room caps).`}};let s="deny";try{s=await(O?.({id:e(),toolName:o,input:{...n,mode:t},risk:"high"}))??"deny"}catch{s="deny"}const r="allow"===s;return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:r?"allow":"deny",permissionDecisionReason:r?"Bypass terminal creation approved in the ThinkPool room — the new terminal runs autonomously.":"Bypass terminal creation denied in the room — do not retry as bypass; open it without mode:bypassPermissions or ask what to do."}}}if("mcp__thinkpool__post_to_terminal"===o){const t=R?R():{ok:!0};if(!t.ok)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:t.reason||"Cross-terminal post not allowed right now."}};const s=!!U&&!!U(n?.terminal);if(!l({mode:he,spawnedByMe:s}))return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"bypassPermissions"===he?"Auto-approved (cross-terminal post in bypassPermissions mode — bypass means bypass).":"Auto-approved (cross-terminal post into a lane you spawned — parent→child orchestration, no per-post tap)."}};let r="deny";try{r=await(O?.({id:e(),toolName:o,input:n,risk:"high"}))??"deny"}catch{r="deny"}const i="allow"===r;return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:i?"allow":"deny",permissionDecisionReason:i?"Cross-terminal post approved in the ThinkPool room.":"Cross-terminal post denied in the room — do not retry; ask what to do instead."}}}if("mcp__thinkpool__post_to_session"===o){const t=A?A():{ok:!0};if(!t.ok)return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:t.reason||"Cross-room post not allowed right now."}};let s="deny";try{s=await(O?.({id:e(),toolName:o,input:n,risk:"high"}))??"deny"}catch{s="deny"}const r="allow"===s;return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:r?"allow":"deny",permissionDecisionReason:r?"Cross-room post approved in the sending room — the target room will be asked to accept it.":"Cross-room post denied in the room — do not retry; ask what to do instead."}}}if("ExitPlanMode"===o){if("plan"!==he)return lt(he),ot({kind:"mode",mode:he}),{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:`The ThinkPool room is in ${he} mode, not Plan — the user did not ask for a plan. Do NOT call ExitPlanMode; proceed and make the changes directly. Only present a plan if the user switches the room to Plan mode or explicitly asks.`}};let t="keep";try{t=await(O?.({id:e(),toolName:o,input:n,risk:"plan",plan:n?.plan||""}))??"keep"}catch{t="keep"}if("run"===t||"accept"===t){const e="accept"===t?"acceptEdits":"default";return he=e,lt(e),ot({kind:"mode",mode:e}),{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:`Plan approved in the ThinkPool room — proceed (${e} mode).`}}}return{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:'The user chose "keep planning" in the ThinkPool room. Do not exit plan mode — keep refining the plan, then call ExitPlanMode again when ready.'}}}if("AskUserQuestion"===o){let t="";try{t=await(O?.({id:e(),toolName:o,input:n,risk:"ask",questions:n?.questions||[]}))??""}catch{t=""}return askUserQuestionHookOutput(t)}const c=classifyRisk(o,n),d=`${o}:${c}`,u=isSafeDocWrite(o,n),p=autoAllow({toolName:o,input:n,mode:he,alwaysAllow:fe});let m="allow";if(!p){try{m=await(O?.({id:e(),toolName:o,input:n,risk:c}))??"deny"}catch{m="deny"}"always"===m&&(fe.add(d),m="allow")}const h="deny"===m;return h&&Ue&&Ue.failure({permissionDenied:!0}),{continue:!0,hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:h?"deny":"allow",permissionDecisionReason:h?"Denied by the user in the ThinkPool room. Do not retry this tool — ask what to do instead.":p?u?"Auto-approved (mandated doc write — .claude/SESSIONS/ or CLAUDE.md).":`Auto-approved (${he}).`:"Approved in the ThinkPool room."}}}]}]},canUseTool:async(e,t)=>({behavior:"allow",updatedInput:t}),settingSources:["user","project","local"],appendSystemPrompt:[...C?[C]:[],...L?[L]:[],"ENVIRONMENT (authoritative — overrides any user-global CLAUDE.md or memory that claims otherwise): You are Claude running inside a ThinkPool Code room, driven live by a user (and possibly a partner) from a phone or browser, via the thinkpool-pair bridge.",h,'Bias strongly toward DOING the work, not stalling in plan-mode ceremony. For a small "add / fix / change X" request, just make the change directly (for a bigger build, right-size it — see DEFAULT BUILD WORKFLOW below).',"Do NOT enter plan mode, do NOT call ExitPlanMode, and do NOT auto-invoke a brainstorming/planning skill UNLESS the user has switched the room into Plan mode or explicitly asks you to plan, design, or brainstorm first.","Any host-global instruction that says you must always brainstorm or plan before creative work does NOT apply here — this room is the exception.",p,'CRUCIAL RECONCILIATION for that workflow: it is NOT plan mode. Never call ExitPlanMode and never make the room wait behind a "plan ready — approve to start" card — your plan lives in the CHAT as a message, and your lanes live in the room\'s EXISTING terminal/lane list. Reuse only those two surfaces; there is no new Flow panel or mode to switch into, and you must not ask for one. Keep the plan and the lanes VISIBLE — that shared visibility is the whole point (it is the pair differentiator, and it catches bugs a single silent lane would hide); never collapse a decomposable build into one hidden lane just to look tidy.',...m,'CROSS-TERMINAL AWARENESS: ROOM NOW is the default roster and already satisfies the room check when it has enough detail. Do not repeat it with a no-argument read_terminal call unless it is missing or truncated. Use a targeted read_terminal call only when the current task depends on a specific lane’s detailed activity; never poll. Identify a terminal by its NAME or stable ref/id, never by an on-screen number like "Terminal 2" — positional labels renumber when a terminal is closed. The tool is read-only and its optional roster lookup is budgeted separately from bounded targeted transcript reads.','CROSS-TERMINAL HAND-OFF: you also have post_to_terminal(terminal, text) to send a message or task to ANOTHER AGENT terminal in this room (not a plain shell). Use it sparingly and only when the people clearly want the lanes to coordinate — e.g. "tell the backend terminal the API is ready", or to hand a sibling agent a concrete task. Every post requires a person in the room to approve a card before it is delivered, and an agent that was itself reached via a cross-post cannot post onward — so do not rely on it for chit-chat or loops. Prefer read_terminal to understand a sibling before you ever post to it.',"TERMINAL CREATION CONTRACT: main terminals and workers use different tools. A person-authored request to open, launch, start, spawn, or create a new, separate, independent, top-level, or main terminal uses open_main_terminal(name?, task?, model?) — even for ordinary work or a handoff and even without the words Cascade or conductor. If the wording includes new or separate terminal, main-terminal routing wins. Never use spawn_terminal for that request, and if open_main_terminal is unavailable say so instead of substituting. Use spawn_terminal(name?, task?, model?, sliceType?) only for agent-decided bounded WORKER SUB-TERMINALS or when the person explicitly asks for a worker, sub-terminal, Ensemble lane, or delegated slice. Workers never receive the creation tools and never conduct. Do not dump work into busy siblings. Spawned workers are always autonomous in bypassPermissions and never ask the room for an approval card; the bridge still enforces room caps, hop limits, the kill-switch, and isolated linked worktrees. Wait for ROOM NOW or a completion signal instead of polling; after a worker finishes, collect it with one targeted read_terminal call and close_terminal immediately. Main terminals are independent, keep their requested permission mode, and are not owned/closed through Ensemble.","CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner's rooms in the same pair, reachable over the per-pair bus (a room on the partner's machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room's terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger's. Reach for them when work spans rooms — \"what's the other project up to\", \"pick up where the other session left off\", or to check a long-running task elsewhere before you act here.","CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner's over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room's agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person's machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. Outbound list/read/post tools need the ThinkPool account bridge; a standalone owner room can still receive a paired hand-off directly and will always raise its own approval card before delivery.","SUBAGENT POLICY: in this room, a main terminal delegates worker slices through visible spawn_terminal Ensemble lanes. A person-requested new or separate terminal is created with open_main_terminal, never Ensemble. Worker, leaf, Side, and managed Flow lanes do their assigned work directly. Do NOT reach for built-in Task/Agent subagents: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble.",'RESEARCH LANE: you have a `research` tool that runs a REAL multi-source web search + adversarial verification and returns each claim marked HELD or REJECTED with citations. Reach for it when the people would genuinely benefit from looking something external up or settling a question of current fact — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over facts you are not sure of. Do NOT run it unprompted or for things you already know: first OFFER in plain language ("want me to spawn a research lane on that and check it?"), and only call `research(question)` once they agree — it spends real budget (plan-gated Free 5 / Plus 100 runs a month) and takes ~a minute. When it returns, present the held/rejected findings clearly and invite both people to weigh the sources, flagging any held claim that rests on a source they might not trust — that shared scrutiny is the point.',"WORKTREES: parallel lanes share one machine and usually one repo. Run `git worktree list` before your first code edit; if linked worktrees exist, the shared main checkout is contended (and may be guard-blocked) — do your work in your OWN worktree on your OWN branch (`git worktree add <dir> -b <branch>`), and never edit a checkout or ride a branch another lane is using.",'WRITE PLANS INTO THE CHAT: whenever you form or revise a plan — because the room is in Plan mode, or because someone asked you to plan, design, or think it through first — write the actual plan out as a normal message in the room as you develop it: the approach, the concrete steps, the files you will touch, the open questions. The room does NOT surface plan files at all, and the plan-approval card does not reliably carry the plan text, so a plan that lives only in a plan file or only inside ExitPlanMode is INVISIBLE to the people you are working with — they just see "plan ready" with no content. The chat is the canonical place your plan lives; put it there so the room can read and react to it before you proceed.'].join(" "),includePartialMessages:!0,promptSuggestions:!0};"1"===process.env.TP_MCP_STRICT&&(ct.strictMcpConfig=!0,ct.mcpServers={}),P&&Object.keys(P).length&&(ct.mcpServers={...ct.mcpServers||{},...P}),t&&(ct.cwd=t),o&&(ct.model=o),ct.effort=ge,ct.env={...f||process.env,CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION:"1"};const dt=async()=>{if(!H)return;const e=(Xe||"").trim().slice(-1500);if(e&&!ae)try{let o=await claudeOneShot({prompt:`You are predicting the user's NEXT chat message in a live coding session, to prefill their composer. Given the assistant's latest reply below, output the single most likely next user message — short and natural (often just "proceed", "go with option A", "yes do that", or a brief follow-up). One line, <=12 words, imperative, no preamble, no quotes, no markdown.\n\nAssistant's latest reply:\n"""\n${e}\n"""\n\nNext user message:`,model:"claude-haiku-4-5",cwd:t,env:ct.env,timeoutMs:8e3});o=o.trim().split("\n")[0].replace(/^["'`]+|["'`]+$/g,"").trim().slice(0,140),!o||Ve||ae||/^(sure|of course|certainly|let me know|i can help|happy to)\b/i.test(o)||(ot({kind:"suggestion",text:o,source:"haiku"}),process.stderr.write(`  ◆ [suggestion] haiku fallback: ${JSON.stringify(o)}\n`))}catch{}},ut=()=>{const e="function"==typeof Q?Q():{ok:!0};return!1!==e?.ok||(ot({kind:"error",message:e.reason||"Host memory is critically low. This agent runtime was not started.",recoverable:!0}),!1)},pt=async({admitted:e=!1}={})=>{if(!le&&!e&&!ut())return!1;if(null==ce&&(ce=Date.now()),le=!0,Te)try{Te()}catch{}Se=new Promise(e=>{Te=e});const n=new AbortController;_e=n;const a=()=>{try{n.abort()}catch{}};ee.signal.addEventListener("abort",a,{once:!0});try{if(oe){const e=i(t||process.cwd(),oe);e.blocks&&process.stderr.write(`\n  ◆ healed ${e.blocks} malformed tool block(s) in the transcript before resume.\n`)}me=r({prompt:te.stream,options:{...ct,abortController:n,...oe?{resume:oe}:{}}});for await(const e of me){if(ae)break;switch(e.type){case"system":if("thinking_tokens"===e.subtype){we+be===0&&ot({kind:"thinking_tokens",tokens:e.estimated_tokens,delta:e.estimated_tokens_delta});break}if("compact_boundary"===e.subtype){X=!0,ot({kind:"compaction",trigger:e.compact_metadata?.trigger||"auto",preTokens:e.compact_metadata?.pre_tokens??null}),(async()=>{try{const e=await(me?.getContextUsage?.());e&&(ot({kind:"usage",ctx:c({used:e.totalTokens,max:e.maxTokens,pct:Math.round(e.percentage),model:e.model})}),e.model&&(ve=e.model))}catch{}})();break}if(e.session_id&&(oe=e.session_id),de||(de=!0,process.stderr.write(`\n  ◆ session ready in ${Date.now()-ce}ms — MCP ${"1"===process.env.TP_MCP_STRICT?"OFF":"on"}${s?", resume":", fresh"}.\n`)),ve=ct.model||e.model||o||ve,ot({kind:"system",sessionId:oe,model:ct.model||e.model||o||null,commands:d({slashCommands:e.slash_commands,skills:e.skills})}),!pe&&Array.isArray(e.tools)){pe=!0;const t=askUserQuestionRegression(e.tools,E);t&&(process.stderr.write(`\n  ⚠⚠ ${t}\n`),ot({kind:"error",message:t}))}ue||(ue=!0,Promise.resolve(me?.supportedModels?.()).then(e=>{const t=(e||[]).map(e=>({value:e?.value,displayName:e?.displayName,description:e?.description})).filter(e=>e.value);t.length&&ot({kind:"models",models:t})}).catch(()=>{}));break;case"assistant":st(),Ue?.visibleOutput();for(const t of e.message?.content||[])"tool_use"===t?.type&&t.id&&ye.set(t.id,{at:Date.now(),name:t.name,input:t.input});{const t=(e.message?.content||[]).filter(e=>"text"===e?.type).map(e=>e.text).join("\n").trim();t&&(Xe=t)}ot({kind:"assistant",blocks:x(e.message?.content),parentToolUseId:e.parent_tool_use_id||null});break;case"user":for(const t of e.message?.content||[])if("tool_result"===t?.type){st(),Ue?.visibleOutput({tool:!0});const o=ye.get(t.tool_use_id);null!=o&&ye.delete(t.tool_use_id);const n=u(o?.name,t.content);ot({kind:"tool_result",toolUseId:t.tool_use_id,content:t.content,...n?{evidence:n}:{},isError:!!t.is_error,durationMs:null!=o?.at?Date.now()-o.at:void 0,parentToolUseId:e.parent_tool_use_id||null})}break;case"stream_event":{const t=e.event;"message_start"===t?.type?(we+=be,be=t.message?.usage?.output_tokens||0,ot({kind:"thinking_tokens",tokens:we+be})):"message_delta"===t?.type&&t.usage&&(be=t.usage.output_tokens??be,ot({kind:"thinking_tokens",tokens:we+be}));break}case"result":if(st(),e.session_id&&(oe=e.session_id),e.is_error&&Array.isArray(e.errors)&&e.errors.some(e=>/no conversation found/i.test(String(e)))&&(oe||ne)&&xe<3){xe++;const e=Pe;Pe=!1,oe=null,ne=null,ot({kind:"note",text:"previous session not found — continuing on a fresh one"});const t=te;te=D();try{t.end()}catch{}const o=e?se:null;$e=setTimeout(()=>{$e=null,ae||(pt(),null!=o&&(Pe=!0,Re=Date.now(),Ae=!1,te.push([{type:"text",text:o},{type:"text",text:re||Z(o,{forceFull:!0})}])))},300);break}if(Ye&&("aborted"===e.subtype||"error_during_execution"===e.subtype)){We===ze&&(Pe=!1);break}if(e.is_error&&Ue){if(Le)break;Ue.failure({message:Array.isArray(e.errors)?e.errors.join(" "):e.result,status:e.status??e.statusCode,code:e.code}),Pe=!1,ft();break}if(we=0,be=0,Pe=!1,Ee&&(Ee=!1,setTimeout(()=>{ae||mt()},0)),"success"===e.subtype&&(xe=0,oe&&(ne=oe)),"success"===e.subtype&&(Ue?.success(),Ue=null),qe=!1,Ge=!1,e.modelUsage&&"object"==typeof e.modelUsage){let t=null,o=-1;for(const[n,s]of Object.entries(e.modelUsage)){const e=s?.outputTokens??0;e>o&&(o=e,t=n)}t&&(ve=t)}{const t="string"==typeof e.result?e.result.replace(/\s+/g," ").trim().slice(0,200):"";ot({kind:"result",subtype:e.subtype,sessionId:oe,model:ve,costUsd:e.total_cost_usd,usage:e.usage,numTurns:e.num_turns,durationMs:e.duration_ms??null,denials:Array.isArray(e.permission_denials)?e.permission_denials.length:0,resultText:t||null})}Ze&&clearTimeout(Ze),"aborted"!==e.subtype&&(Ze=setTimeout(()=>{Ze=null,Ve||ae||dt()},et)),(async()=>{let t=null;try{const e=await(me?.getContextUsage?.());e&&(t=c({used:e.totalTokens,max:e.maxTokens,pct:Math.round(e.percentage),model:e.model}),e.model&&(ve=e.model))}catch{}const o=e.usage||{};ot({kind:"usage",costUsd:e.total_cost_usd??null,tokens:(o.input_tokens||0)+(o.output_tokens||0),ctx:t})})();break;case"prompt_suggestion":Ze&&(clearTimeout(Ze),Ze=null),e.suggestion&&(Ve=!0,ot({kind:"suggestion",text:e.suggestion}))}}}catch(e){if(st(),ae)return;if(n.signal.aborted)return;const t=e?.message||String(e);if(Ue&&Pe)return Ue.failure({message:t,status:e?.status??e?.statusCode,code:e?.code}),Pe=!1,void ft();if(Pe=!1,ot({kind:"error",message:t}),De.test(t)&&xe<3){xe++,Ie("stream_reconnect",{failureClass:"network"}),ot({kind:"note",text:`connection dropped — reconnecting (${xe}/3)`});const e=te;te=D();try{e.end()}catch{}return void($e=setTimeout(()=>{$e=null,ae||pt()},Math.min(1e3*xe,4e3)))}if(/no conversation found/i.test(t)&&oe&&xe<3){xe++,oe=null,ne=null;const e=te;te=D();try{e.end()}catch{}return void($e=setTimeout(()=>{$e=null,ae||pt()},300))}ae=!0}finally{ee.signal.removeEventListener("abort",a),_e===n&&(_e=null);try{await(me?.return?.())}catch{}Te&&(Te(),Te=null)}},mt=async()=>{if(ae||!le)return;const e=Se,t=te;if(te=D(),_e)try{_e.abort()}catch{}try{t.end()}catch{}try{await e}catch{}await Ne(300),oe=ne,ae||pt()},ht=async e=>{if(ae)return;Ge=!0;const t=Pe&&!v(se)?se:null;Pe=!1;const o=Se,n=te;if(te=D(),_e)try{_e.abort()}catch{}try{n.end()}catch{}try{await o}catch{}await Ne(300),oe=ne,ae||(pt(),null!=t&&(Pe=!0,Re=Date.now(),Ae=!1,te.push(/^\s*\//.test(t)?[{type:"text",text:t}]:[{type:"text",text:t},{type:"text",text:re||Z(t,{forceFull:!0})}]),tt({kind:"note",text:"retrying the stalled turn on a fresh connection"})))},ft=()=>{if(ae||Fe||Le)return;const e=Ue,t=We,o=ie;Le=!0;const n=Se,s=te;te=D();try{s.end()}catch{}$e=setTimeout(async()=>{$e=null;try{await n}catch{}if(!ae&&Le&&Ue===e&&We===t)return await it()?void(!ae&&Le&&Ue===e&&We===t&&(Le=!1,Pe=!0,Re=Date.now(),Ae=!1,pt(),o&&te.push(o),rt())):(Le=!1,void yt())},0)},yt=()=>{st(),Pe=!1,Ue=null,le=!1,ot({kind:"error",message:"The configured provider could not complete this turn. Nothing else was sent.",recoverable:!0})};return G||Me||pt(),{sendTurn(e){if(ae||Fe||Le)return!1;if(!le&&!ut())return!1;if(!le&&K)try{const e=K();e&&(t=e,ct.cwd=e)}catch{}Pe=!0,Ve=!1,se=String(e),Ze&&(clearTimeout(Ze),Ze=null),Re=Date.now(),Ae=!1,Ge=!1,qe=!1;const n=String(e),s=V++,r=X;if(X=/^\s*\/(?:compact|clear|reset)\b/i.test(n),re=/^\s*\//.test(n)?null:Z(n,{promptIndex:s,forceFull:r}),He=v(n),ie=/^\s*\//.test(n)?[{type:"text",text:n}]:[{type:"text",text:n},{type:"text",text:re}],We++,Ue=(()=>{if(!Me)return null;try{const e=_({runtime:"claude",providers:z.providers||[],providerId:z.providerId,model:z.model||ct.model||o,requestedModel:z.requestedModel||z.model||ct.model||o,policy:z.policy,bridgeHostId:z.bridgeHostId,circuit:z.circuit,capGate:z.capGate,traceId:z.traceId,turnRev:"function"==typeof z.turnRev?z.turnRev():z.turnRev,onRecord:nt});return e.start(),e}catch{return null}})(),Ue){const e=Ue,t=We,o=ie;it().then(n=>{!ae&&Pe&&Ue===e&&We===t&&(n?(le||pt({admitted:!0}),te.push(o),rt()):yt())}).catch(()=>{!ae&&Pe&&Ue===e&&We===t&&yt()})}else le||pt({admitted:!0}),te.push(ie)},warm(){Me||le||ae||pt()},get started(){return le},async setMode(e){I.has(e)&&!ae&&(he=e,lt(e),ot({kind:"mode",mode:he}))},async setModel(e){ct.model=e,ve=e,ot({kind:"note",text:`model → ${e}`}),le&&!ae&&(Pe?Ee=!0:await mt())},setEffort:async e=>!(!ke.has(e)||ae||(ge=e,ct.effort=e,ot({kind:"effort",level:e}),le&&(Pe?(Ee=!0,0):(await mt(),0)))),async listModels(){try{const e=(await(me?.supportedModels?.())||[]).map(e=>({value:e?.value,displayName:e?.displayName,description:e?.description})).filter(e=>e.value);e.length&&ot({kind:"models",models:e}),ot({kind:"note",text:e.length?`models: ${e.map(e=>e.value).join(", ")}`:"no model list available"})}catch{ot({kind:"note",text:"usage: /model <name>"})}},async abort(){if(!Fe){Fe=!0;try{const e=Le,t=e?Se:null;(Pe||e)&&(We++,e||(Le=!1),st(),Ue?.failure({aborted:!0}),e&&(clearTimeout($e),$e=null,le=!1),Ye=!0,ze=We,clearTimeout(Je),Je=setTimeout(()=>{Ye=!1,ze=null},6e3));try{await(me?.interrupt?.())}catch{}if(t)try{await t}catch{}e&&(Le=!1),(Pe||e)&&(Pe=!1,ot({kind:"result",subtype:"aborted",sessionId:oe}))}finally{Fe=!1}}},end(){ae=!0,st(),clearInterval(at),clearTimeout(Je),clearTimeout($e),Ze&&clearTimeout(Ze),te.end();try{ee.abort()}catch{}},get sessionId(){return oe},get mode(){return he},get turnActive(){return Pe}}}