Resolve threads and set channel descriptions as the calling seat (#269)

A spawned Claude Code seat could not call `set_channel_description`,
`resolve_thread` or `unresolve_thread`. Each failed with
`UnboundEphemeralSession`.

All three are writes the realm attributes to their actor. Resolving a
topic posts a notice naming who did it, and a description change writes
an audit row. So they already reached the bound credential, like `post`.
But they took no host-supplied session id and sat outside the plugin's
PreToolUse matcher, so no seat identity ever reached them.

This change gives them the same supply as the other identity tools. They
accept the injected `session_id` and `cwd`, and the hook matcher now
stamps them. Each call binds the seat of the conversation making it,
never one an earlier call left bound.

The hooks-manifest test kept these three as a named exception to its
rule that every tool reaching the bound credential receives a session id
and is stamped. The exception list is gone, so the rule now holds
unqualified. The end-to-end deployed-wiring test now checks that each
verb binds the calling conversation's seat, where it used to pin the
refusal.

Author: GraemeF

clients/claude-code/README.md

@@ -148,8 +148,9 @@ matching events to the MCP host. Identity-free tools — `subscribe`,
 `unsubscribe`, `read_channel`, `read_thread`, `message_link`,
 `list_agents`, `list_humans`, `list_channels`, `get_channel_description`,
 `presence`, `resolve`, `current_identity` — run on minter credentials and work
-pre-acquire. `set_channel_description` is a write and needs the bound identity,
-which must have permission to edit the channel.
+pre-acquire. `set_channel_description`, `resolve_thread` and `unresolve_thread`
+are writes the realm attributes to their actor, so they run as the calling
+session's bound identity, which must have permission to edit the channel.
 
 ## Guidance for connected clients
 

clients/claude-code/hooks-manifest.test.ts

@@ -12,16 +12,14 @@ import hooksManifest from './hooks/hooks.json'
  * call sites — a hand-maintained trigger table in the tool layer. That table is
  * gone: the mint decision now lives at the adapter port, where reaching for a
  * bound credential (`boundHttp`) IS the declaration that an identity is needed.
- * So the derivation is traced from there instead, which is also what
- * `comms-tww6` specifies:
+ * So the derivation is traced from there instead:
  *
  *   A TOOL WHOSE ADAPTER PATH REACHES `boundHttp` MUST RECEIVE `session_id`
  *   AND BE IN THE `hooks.json` MATCHER.
  *
  * That is a stronger rule than the old one. The old test could only catch a
  * tool that called the wrapper and was missing from the matcher; it could not
- * see a tool that reached `boundHttp` while appearing in neither set — which is
- * exactly the live P1 that `comms-tww6` is open about.
+ * see a tool that reached `boundHttp` while appearing in neither set.
  *
  * RECEIVES, NOT DECLARES (comms-tg70). The rule used to say DECLARE, and traced
  * a `session_id` property on the tool's advertised `inputSchema`. No tool
@@ -37,24 +35,25 @@ import hooksManifest from './hooks/hooks.json'
  * satisfies all of them by looking at nothing. Pinning the receiving set makes
  * the scan itself the thing under test: rename the marker and the pin fails
  * loudly instead of the suite passing quietly.
- *
- * KNOWN VIOLATIONS ARE NAMED, NOT PAPERED OVER. Three tools violate the rule at
- * HEAD (see `TWW6_EXCEPTIONS`). Fixing them means giving them the host-supplied
- * `session_id`, which is out of scope here. Encoding the real rule with a
- * visible exception list beats asserting a weaker rule that passes: the day
- * `comms-tww6` lands, its author deletes entries from that list and this test
- * proves the fix.
  */
 
 /**
  * Publisher verbs whose adapter implementation reaches `boundHttp`. Pinned
- * rather than parsed: two of them reach it through shared helpers
+ * rather than parsed: three of them reach it through shared helpers
  * (`setThreadResolved`, `setChannelDescription`), which no line-wise scan
  * resolves honestly. `adapterVerbsReachingBoundHttp` below guards the pin, so a
  * verb that joins or leaves the seam fails this suite rather than silently
  * widening the set a tool has to be stamped for.
  */
-const BOUND_VERBS = ['post', 'edit', 'react', 'unreact'] as const
+const BOUND_VERBS = [
+  'post',
+  'edit',
+  'react',
+  'unreact',
+  'resolveThread',
+  'unresolveThread',
+  'setChannelDescription',
+] as const
 
 /**
  * Declarations in `packages/zulip/adapter.ts` that call `boundHttp()`. The two
@@ -131,10 +130,9 @@ const ATTACHMENT_DEP_ADAPTER_MEMBER: Readonly<Record<string, string>> = {
  * Tools that reach `boundHttp` through an inbox verb while sitting outside the
  * matcher, so the hook never stamps them and the bind seam sees no session id.
  *
- * EMPTY, and it has to stay that way. An unstamped inbox verb is not a
- * `comms-tww6`-style attribution accident — it cannot inherit an earlier
- * call's seat, because `boundHttp` consults the binder on every call and
- * refuses outright when the context carries no session id. It simply FAILS.
+ * EMPTY, and it has to stay that way. An unstamped inbox verb cannot inherit an
+ * earlier call's seat, because `boundHttp` consults the binder on every call
+ * and refuses outright when the context carries no session id. It simply FAILS.
  *
  * The matcher was widened to the seven tools that declare `session_id`, which
  * REVERSES commit `0f0e755` (PR #126) — that commit chose id-blind subscribe
@@ -147,18 +145,7 @@ const ATTACHMENT_DEP_ADAPTER_MEMBER: Readonly<Record<string, string>> = {
 const G5ZH3_MATCHER_PENDING = [] as const
 
 /**
- * Tools that reach `boundHttp` while receiving no `session_id` and sitting
- * outside the matcher — the open P1 `comms-tww6`. They run under whatever seat
- * an EARLIER call happened to bind, so their attribution is inherited by
- * accident of ordering rather than established by the call itself.
- *
- * Delete an entry here when that tool gains `session_id`; the assertion below
- * then holds it to the rule.
- */
-const TWW6_EXCEPTIONS = ['resolve_thread', 'set_channel_description', 'unresolve_thread'] as const
-
-/**
- * Every tool that accepts a host-supplied `session_id`. EIGHT, the same eight
+ * Every tool that accepts a host-supplied `session_id`. ELEVEN, the same eleven
  * the PreToolUse matcher stamps today — but the two sets answer different
  * questions and are allowed to diverge again: `subscribe` and `unsubscribe`
  * are here for a non-CC ephemeral host that supplies the UUID itself, and a
@@ -173,8 +160,11 @@ const SESSION_ID_RECEIVING_TOOLS = [
   'edit_message',
   'post',
   'react',
+  'resolve_thread',
+  'set_channel_description',
   'subscribe',
   'unreact',
+  'unresolve_thread',
   'unsubscribe',
   'upload_file',
 ] as const
@@ -340,7 +330,7 @@ test('the set of adapter declarations reaching boundHttp is the pinned one', asy
 // them reads "no tool violates this", which a scan that matches nothing
 // satisfies trivially — so assert first that the scan finds the set it is
 // supposed to find.
-test('the tools accepting a host-supplied session_id are exactly the pinned eight', async () => {
+test('the tools accepting a host-supplied session_id are exactly the pinned eleven', async () => {
   const facts = toolFactsFromToolsSource(await toolsSource())
   const receiving = [...facts]
     .filter(([, f]) => f.receivesSessionId)
@@ -454,18 +444,6 @@ test('the tools that bind via an inbox verb but are unstamped are exactly the re
   expect(unstamped).toEqual([...G5ZH3_MATCHER_PENDING])
 })
 
-// The rule stated over ALL bound verbs, including the two helper-backed ones
-// the tool layer never stamps. This is the assertion `comms-tww6` closes.
-test('comms-tww6: the known unstamped bound-path tools are exactly the recorded exceptions', async () => {
-  const facts = toolFactsFromToolsSource(await toolsSource())
-  const boundHttpVerbs = new Set(['resolveThread', 'unresolveThread', 'setChannelDescription'])
-  const unstamped = [...facts]
-    .filter(([, f]) => [...f.verbs].some((v) => boundHttpVerbs.has(v)) && !f.receivesSessionId)
-    .map(([name]) => name)
-    .sort()
-  expect(unstamped).toEqual([...TWW6_EXCEPTIONS])
-})
-
 test('the matcher carries no tool that never reaches boundHttp and never binds', async () => {
   const facts = toolFactsFromToolsSource(await toolsSource())
   const matched = alternationToolsFromMatcher(injectSessionIdMatcher(hooksManifest))

clients/claude-code/hooks/hooks.json

@@ -2,7 +2,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "mcp__plugin_commy_commy__(post|edit_message|react|unreact|current_identity|subscribe|unsubscribe|upload_file)",
+        "matcher": "mcp__plugin_commy_commy__(post|edit_message|react|unreact|current_identity|subscribe|unsubscribe|upload_file|resolve_thread|unresolve_thread|set_channel_description)",
         "hooks": [
           {
             "type": "command",

packages/mcp/deployed-wiring.test.ts

@@ -412,46 +412,35 @@ test('a fresh conversation gets a fresh seat rather than inheriting the last one
 })
 
 /**
- * The three verbs `comms-tww6` is open about, observed rather than argued
- * about. They reach the substrate's bind seam but sit outside the matcher, so
- * the hook never runs for them and no `session_id` reaches the server. Under
- * the deployed configuration they refuse — a typed refusal, not silent
- * attribution to whatever seat an earlier call happened to bind.
- *
- * This is a characterisation of HEAD, not an endorsement: whether they should
- * instead be stamped is `comms-tww6`'s fork. When that lands, this test is
- * what has to be rewritten, deliberately.
+ * Resolving a thread and describing a channel both publish the actor's name
+ * into the realm, so each must act under the seat of the conversation making
+ * the call. The seed post binds one conversation's seat first; each verb is
+ * then called from a different conversation and has to bind that one, not
+ * inherit the seat already held.
  */
-test('the tww6 verbs are outside the matcher, so the deployed configuration refuses them', async () => {
+test("the thread-resolution and channel-description verbs act under the calling conversation's seat", async () => {
   const cwd = nonRepoCwd()
-  const manifest = await readShippedHooksManifest()
-  const seat = await bootDeployedSeat(manifest)
+  const seat = await bootDeployedSeat(await readShippedHooksManifest())
+  const calls: ReadonlyArray<readonly [string, Record<string, unknown>]> = [
+    ['resolve_thread', { channel_name: 'home', thread: 'a-topic' }],
+    ['unresolve_thread', { channel_name: 'home', thread: 'a-topic' }],
+    ['set_channel_description', { channel_name: 'home', description: 'a new description' }],
+  ]
   try {
-    await seat.callAsClaudeCode(
-      'post',
-      { channel_name: 'home', body: 'seed', thread: 'a-topic' },
-      { sessionId: SID_CONVERSATION, cwd: cwd.path },
-    )
-    for (const tool of ['resolve_thread', 'unresolve_thread'] as const) {
-      const args = await argumentsAfterPreToolUse(manifest, {
-        session_id: SID_CONVERSATION,
+    for (const [tool, args] of calls) {
+      await seat.callAsClaudeCode(
+        'post',
+        { channel_name: 'home', body: 'seed', thread: 'a-topic' },
+        { sessionId: SID_CONVERSATION, cwd: cwd.path },
+      )
+      expect(await seat.boundName()).toBe('cc-aaaaaaaa')
+      const result = await seat.callAsClaudeCode(tool, args, {
+        sessionId: SID_AFTER_CLEAR,
         cwd: cwd.path,
-        tool_name: toolNameAsClaudeCodeSeesIt(tool),
-        tool_input: { channel_name: 'home', thread: 'a-topic' },
       })
-      expect(args).not.toHaveProperty('session_id')
-      const refusal = await refusalMessage(
-        seat.callAsClaudeCode(tool, { channel_name: 'home', thread: 'a-topic' }),
-      )
-      expect(refusal).toContain('UnboundEphemeralSession')
+      expect(result.isError).toBeFalsy()
+      expect(await seat.boundName()).toBe('cc-bbbbbbbb')
     }
-    const description = await refusalMessage(
-      seat.callAsClaudeCode('set_channel_description', {
-        channel_name: 'home',
-        description: 'a new description',
-      }),
-    )
-    expect(description).toContain('UnboundEphemeralSession')
   } finally {
     await seat.shutdown()
     cwd.remove()
@@ -497,13 +486,9 @@ const DEPLOYED_OUTCOMES: Readonly<Record<string, DeployedOutcome>> = {
   unreact: 'usable',
   download_file: 'usable',
   upload_file: 'usable',
-  // The three `comms-tww6` is open about: they reach the substrate's bind seam
-  // but sit outside the PreToolUse matcher, so no session id ever reaches the
-  // server on their behalf. Recorded as observed, not as endorsed — when
-  // `comms-tww6` is decided, these three entries are what changes.
-  resolve_thread: 'refused-for-want-of-identity',
-  unresolve_thread: 'refused-for-want-of-identity',
-  set_channel_description: 'refused-for-want-of-identity',
+  resolve_thread: 'usable',
+  unresolve_thread: 'usable',
+  set_channel_description: 'usable',
 }
 
 test('every shipped tool, driven through the deployed chain, lands where the table says', async () => {

packages/mcp/tools.ts

@@ -509,8 +509,8 @@ const buildToolDefs = (deps: RegisterToolsDeps, cache: InternalCache): ReadonlyA
   const projectForCwd = deps.projectForCwd ?? (() => Effect.succeedNone)
   /**
    * The tools that accept a host-supplied `session_id` (see
-   * {@link ToolDef.hostSuppliedArgs}). EIGHT tools carry it. That is the same
-   * eight Claude Code's PreToolUse matcher stamps today, but the two sets are
+   * {@link ToolDef.hostSuppliedArgs}). ELEVEN tools carry it. That is the same
+   * eleven Claude Code's PreToolUse matcher stamps today, but the two sets are
    * separate questions and are allowed to differ: this one also serves the
    * non-CC ephemeral host that supplies the UUID itself, which is a
    * listen-first seat's only route to an identity. A host stamping the arg on
@@ -1081,10 +1081,12 @@ const buildToolDefs = (deps: RegisterToolsDeps, cache: InternalCache): ReadonlyA
         properties: {
           channel_name: { type: 'string', description: 'Channel the thread lives in' },
           thread: { type: 'string', description: 'Thread / topic name within the channel' },
+          cwd: cwdField,
         },
         required: ['channel_name', 'thread'],
         additionalProperties: false,
       },
+      hostSuppliedArgs: hostSuppliedSessionId,
       handler: async (args) => {
         const run = runFor(args)
         await run(
@@ -1108,10 +1110,12 @@ const buildToolDefs = (deps: RegisterToolsDeps, cache: InternalCache): ReadonlyA
         properties: {
           channel_name: { type: 'string', description: 'Channel the thread lives in' },
           thread: { type: 'string', description: 'Thread / topic name within the channel' },
+          cwd: cwdField,
         },
         required: ['channel_name', 'thread'],
         additionalProperties: false,
       },
+      hostSuppliedArgs: hostSuppliedSessionId,
       handler: async (args) => {
         const run = runFor(args)
         await run(
@@ -1163,10 +1167,12 @@ const buildToolDefs = (deps: RegisterToolsDeps, cache: InternalCache): ReadonlyA
             type: 'string',
             description: "The channel's new description; empty string clears it",
           },
+          cwd: cwdField,
         },
         required: ['channel_name', 'description'],
         additionalProperties: false,
       },
+      hostSuppliedArgs: hostSuppliedSessionId,
       handler: async (args) => {
         const run = runFor(args)
         await run(