thinkpool-pair 0.7.109 → 0.7.111

package/account.mjs

@@ -13,7 +13,7 @@ import path from 'node:path'
 import fs from 'node:fs'
 import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
-import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed } from './auth-store.mjs'
+import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
@@ -226,7 +226,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const svcHint = process.env.THINKPOOL_PAIR_AUTOUPDATE === '1'
     ? '    (auto-updating background service — survives reboot, tracks @latest)\n'
     : '    (run hands-off + auto-updating: npx thinkpool-pair install-service)\n'
-  process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    Auto-serving your sessions from ${DEFAULT_DIR}\n    (point one at another repo: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
+  const _effDefault = loadDefaultDir() || claudeRecentProjectDir() || DEFAULT_DIR
+  process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: npx thinkpool-pair set-default-dir <dir>  ·  one room: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
   const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
@@ -255,6 +256,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
   const warned = new Set()
+  const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
 
   // Account presence — so the web dashboard can show "● Bridge active" for this
   // account without per-room probing. We TRACK this machine (name + served room
@@ -262,6 +264,20 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const machine = os.hostname().replace(/\.local$/, '')
   const acct = sb.channel(`tpacct:${session.user.id}`, { config: { presence: { key: machine }, broadcast: { self: false } } })
   let restarting = false   // set by the "restart" broadcast → stop() exits non-zero so a supervisor respawns us
+  // Web "attach this session" card → bind an unbound/new room to a local dir (and
+  // optionally set it as the account default) so it serves WITHOUT a terminal command.
+  // Rides tpacct (keyed to the owner's uid); the dir must exist on THIS machine.
+  acct.on('broadcast', { event: 'bind-room' }, ({ payload }) => {
+    const code = String(payload?.code || '').toUpperCase().trim()
+    let dir = String(payload?.dir || '').trim()
+    if (dir.startsWith('~')) dir = path.join(os.homedir(), dir.slice(1))
+    if (!code || !dir) return
+    if (!fs.existsSync(dir)) { process.stderr.write(`\n  ◇ bind ${code}: directory not found (${dir}) — ignored.\n`); return }
+    bindDir(code, dir)
+    if (payload?.setDefault) { saveDefaultDir(dir); process.stderr.write(`\n  ◆ default project dir set → ${dir}\n`) }
+    process.stderr.write(`\n  ◆ ${code} bound → ${dir} (from the web). Serving…\n`)
+    try { tick() } catch { /* the periodic tick will serve it next cycle */ }
+  })
   // Dashboard "Disconnect" → broadcast shutdown → clean exit (presence leaves, bar flips live).
   // If we're the auto-restarting background service (launchd KeepAlive / systemd
   // Restart=always sets AUTOUPDATE=1), a bare exit would be respawned ~2s later —
@@ -324,7 +340,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
   // terminal. THINKPOOL_PAIR_AUTOUPDATE=1 is set ONLY by the install-service plist/unit
   // (service.mjs), so it's the reliable proxy for "running as the managed service".
-  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], service: process.env.THINKPOOL_PAIR_AUTOUPDATE === '1', ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: process.env.THINKPOOL_PAIR_AUTOUPDATE === '1', ts: Date.now() })
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
@@ -491,18 +507,26 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // participant's bridge is duplication the UI never even looks at.
       const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,participants').eq('owner_id', session.user.id).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
+      // Prune refused entries for rooms we no longer own (only on a SUCCESSFUL fetch,
+      // so a transient query error never wipes the set).
+      const ownedCodes = new Set(rooms.map((r) => r.code))
+      for (const c of [...refused.keys()]) if (!ownedCodes.has(c)) refused.delete(c)
     } catch { /* transient — keep existing children, retry next tick */ }
     const dirs = loadDirs()
     const served = loadServed()
     for (const r of rooms) {
       const room = r.code
-      if (!room || children.has(room)) continue
+      if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
       if (r.owner_id && r.owner_id !== session.user.id) continue   // never serve a room we don't own (defense-in-depth behind the .eq above)
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
       // to auto-serve an unbound room from $HOME — that strips the agent's resume context
       // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).
-      const choice = resolveServeDir({ bound: dirs[room], remembered: served[room], defaultDir: DEFAULT_DIR, home: os.homedir() })
+      // Default-dir precedence for an unbound room: explicit user default > Claude Code's
+      // most-recent project dir (zero-config — where you actually code) > launch cwd ($HOME,
+      // which then gets refused). So a new session auto-attaches to your active repo with no setup.
+      const choice = resolveServeDir({ bound: dirs[room], remembered: served[room], defaultDir: loadDefaultDir() || claudeRecentProjectDir() || DEFAULT_DIR, home: os.homedir() })
       if (choice.refuse) {
+        refused.set(room, choice.reason)
         if (!warned.has(room)) {
           warned.add(room)
           const why = choice.reason === 'home'
@@ -514,10 +538,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       }
       const dir = choice.dir
       if (!fs.existsSync(dir)) {
+        refused.set(room, 'dir-gone')
         if (!warned.has(room)) { warned.add(room); process.stderr.write(`\n  ◇ ${room}: bound directory is gone (${dir}) — re-bind it.\n`) }
         continue
       }
       warned.delete(room)
+      refused.delete(room)   // about to serve → clear any prior refusal
       // Learn this room → dir so a later relaunch from $HOME resumes it HERE (the real
       // repo) instead of the home-dir fallback. Only the auto path is remembered; an
       // explicit bind already persists in dirs.json.

package/auth-store.mjs

@@ -58,3 +58,31 @@ export function rememberServed(room, dir) {
   try { fs.writeFileSync(SERVED, JSON.stringify(d, null, 2)) } catch { /* noop */ }
   return d
 }
+
+// Account-wide DEFAULT serve directory: new/unbound rooms auto-serve HERE instead of
+// being refused from $HOME. Set once (CLI `set-default-dir <dir>`, or the web attach
+// card). One dir for the common "I mostly work in one repo" case; per-room binds still
+// override it. Stored as a plain path in ~/.thinkpool-pair/default-dir.
+const DEFAULTDIR = path.join(DIR, 'default-dir')
+export function loadDefaultDir() { try { const d = fs.readFileSync(DEFAULTDIR, 'utf8').trim(); return d || null } catch { return null } }
+export function saveDefaultDir(dir) { ensureDir(); try { fs.writeFileSync(DEFAULTDIR, String(dir || '')) } catch { /* noop */ } return dir }
+export function clearDefaultDir() { try { fs.unlinkSync(DEFAULTDIR) } catch { /* noop */ } }
+
+// Zero-config default: Claude Code tracks every project directory you've worked in
+// (~/.claude.json `projects`, with per-project session history under
+// ~/.claude/projects/<path-with-slashes-as-dashes>). The MOST-RECENTLY-used real project
+// dir is where you actually code — a great default for a new/unbound room, no setup. Skips
+// $HOME, tmp, and worktree paths; ranks by the session-dir mtime (encode path forward only,
+// never decode — the dash encoding is lossy for paths containing '-').
+export function claudeRecentProjectDir() {
+  try {
+    const home = os.homedir()
+    const conf = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf8'))
+    const projRoot = path.join(home, '.claude', 'projects')
+    const best = Object.keys(conf.projects || {})
+      .filter((p) => p && p !== home && !p.startsWith('/private/tmp') && !p.startsWith('/tmp') && !p.includes('/.claude/') && fs.existsSync(p))
+      .map((p) => { let mt = 0; try { mt = fs.statSync(path.join(projRoot, p.replace(/\//g, '-'))).mtimeMs } catch { /* no session dir */ } return { p, mt } })
+      .sort((a, b) => b.mt - a.mt)[0]
+    return best?.p || null
+  } catch { return null }
+}

package/bridge.mjs

@@ -202,6 +202,14 @@ const PROVIDER_INFO = applyProviderEnv()
 
 if (argv[0] === 'login') { const { runLogin } = await import('./account.mjs'); await runLogin(SUPABASE_URL, SUPABASE_ANON, WEB_BASE) }
 if (argv[0] === 'bind')  { const { runBind }  = await import('./account.mjs'); runBind(argv[1], argv[2]) }
+if (argv[0] === 'set-default-dir') {
+  const { saveDefaultDir } = await import('./auth-store.mjs')
+  let d = (argv[1] || '').trim(); if (d.startsWith('~')) d = d.replace(/^~/, os.homedir())
+  if (!d) { console.error('  usage: npx thinkpool-pair set-default-dir <dir>'); process.exit(1) }
+  saveDefaultDir(d)
+  console.log(`  ◆ default project dir set → ${d}\n    New/unbound sessions auto-serve from here — no per-session bind. Takes effect next serve tick.`)
+  process.exit(0)
+}
 if (argv[0] === 'provider') { const { runProvider } = await import('./provider.mjs'); await runProvider(argv.slice(1)); process.exit(0) }
 
 // One-command launcher: a bare invocation on a TTY (or the `setup` alias) opens the

package/flow-review-gate.mjs

@@ -0,0 +1,302 @@
+// Thinkpool Flow — S5 adversarial reviewer tool-call gate.
+//
+// Pure decision function: given a reviewer lane's tool call, decide whether to allow or
+// deny it. No fs side-effects except realpathSync (injectable via _realpath for tests).
+//
+// Spec: docs/specs/2026-06-30-flow-build-s5-reviewer-writeblock.md (S5, slice 1).
+//
+// Rules:
+//   READ-ONLY tools (Read, Grep, Glob, LS, …) → ALLOW (always)
+//   Edit / Write / NotebookEdit → structural path check against sliceRoot:
+//     • file_path resolves under sliceRoot AND is NOT verdictFile → DENY
+//     • file_path IS verdictFile (FLOW_REVIEW.json) → ALLOW (unless it symlinks into slice)
+//   Bash → ALLOW by default (reviewer MUST run tests); DENY on write-to-slice heuristics
+//   Unknown tools → DENY (conservative; add to READ_ONLY_TOOLS if truly non-mutating)
+//
+// Path-robustness:
+//   • '..' traversal: caught by path.resolve() normalization.
+//   • Absolute-escape: caught by path.resolve() normalization.
+//   • Symlink escape: caught by realpathSync() (injectable for tests). A write whose REAL
+//     resolved path lands under sliceRoot is denied even through a symlink.
+//   • Symlinked verdictFile pointing into the slice is denied.
+//   • Both canonical (realpathSync) and input (path.resolve) forms of sliceRoot are checked
+//     to handle cases where sliceRoot itself is a symlink (e.g. macOS /tmp → /private/tmp).
+//
+// BASH LIMITATION: Bash write-detection is HEURISTIC (best-effort pattern matching), unlike
+// Edit/Write/NotebookEdit which have a structural file_path field. Shell quoting, variable
+// expansion, heredocs, subshells, and aliases can bypass these patterns. The reviewer prompt
+// already instructs it not to modify the slice; this gate is a structural backstop for the
+// common cases, not a complete shell parser. If precise Bash blocking is required, use a
+// wrapper that translates shell commands into structured tool calls.
+//
+// ACCEPTED LIMITATIONS (do not add fragile parsers for these):
+//   • python3 -c '...' / node -e '...' inline scripts: scripted writes embedded in string
+//     literals are not parsed — detecting them reliably requires a full language parser.
+//   • bare `git commit` / `git add .` with no explicit slice path: the gate detects git
+//     mutations only when sliceRoot appears literally in the command (via -C flag or path
+//     arg). A bare git command that relies on cwd is NOT caught by this heuristic.
+//   REAL MITIGATION: the reviewer lane runs in its OWN git worktree (not the slice's).
+//   Bare cwd-relative git mutations and inline scripted writes therefore affect the
+//   reviewer's worktree, not the slice. The wiring layer that provisions the reviewer lane
+//   MUST guarantee this worktree isolation — this gate cannot substitute for it.
+
+import { realpathSync as nodeRealpathSync } from 'node:fs'
+import path from 'node:path'
+
+// ── Tool classification ───────────────────────────────────────────────────────
+
+// Tools that cannot mutate files — always allowed for a reviewer.
+const READ_ONLY_TOOLS = new Set([
+  'Read', 'Grep', 'Glob', 'LS',
+  // Other non-mutating Claude Code tools:
+  'WebFetch', 'WebSearch', 'Search', 'TodoRead', 'Explore',
+])
+
+// Tools that write files — must have file_path checked before allowing.
+const FILE_WRITE_TOOLS = new Set(['Edit', 'Write', 'NotebookEdit'])
+
+// Git subcommands that mutate the working tree.
+const GIT_MUTATING_RE = /\b(?:add|commit|apply|checkout|reset|revert|rm|clean|merge|rebase|cherry-pick|stash)\b/
+
+// Shell commands that write to a path positional argument (HEURISTIC — see BASH LIMITATION).
+// cp and mv are handled separately via CP_MV_RE — only their DESTINATION is checked,
+// so that reading FROM the slice (e.g. cp /slice/f /tmp/x) is allowed.
+const BASH_WRITE_CMD_RE = /\b(?:rm|tee|truncate|dd|install)\b/
+
+// cp/mv require destination-aware analysis — see _assessBashCommand.
+const CP_MV_RE = /\b(?:cp|mv)\b/
+
+// sed in-place edit.
+const SED_INPLACE_RE = /\bsed\b[^|;]*-i\b/
+
+// ── reviewGateDecision ────────────────────────────────────────────────────────
+
+/**
+ * Decide whether a reviewer lane's tool call is allowed.
+ *
+ * @param {object} opts
+ * @param {string}   opts.toolName     Tool name ('Read', 'Write', 'Bash', …).
+ * @param {object}  [opts.input]       Tool input (e.g. { file_path } or { command }).
+ * @param {string}   opts.sliceRoot    Absolute path of the directory tree under review.
+ * @param {string}  [opts.verdictFile] Absolute path where reviewer writes FLOW_REVIEW.json.
+ *                                     Writes to this exact path are ALLOWED unless it
+ *                                     symlinks back into sliceRoot.
+ * @param {function}[opts._realpath]   Injectable realpathSync (default: node:fs realpathSync).
+ * @returns {{ allow: boolean, reason: string }}
+ */
+export function reviewGateDecision ({
+  toolName,
+  input = {},
+  sliceRoot,
+  verdictFile,
+  _realpath = nodeRealpathSync,
+}) {
+  if (!sliceRoot) {
+    return { allow: false, reason: 'sliceRoot not provided — gate cannot assess containment; denied' }
+  }
+
+  // Resolve both forms of sliceRoot so comparisons work whether or not sliceRoot is
+  // itself a symlink (e.g. macOS /tmp → /private/tmp).
+  const inputSliceRoot = path.resolve(sliceRoot)
+  let canonicalSliceRoot
+  try {
+    canonicalSliceRoot = _realpath(sliceRoot)
+  } catch {
+    canonicalSliceRoot = inputSliceRoot
+  }
+
+  // ── READ-ONLY TOOLS ───────────────────────────────────────────────────
+  if (READ_ONLY_TOOLS.has(toolName)) {
+    return { allow: true, reason: `${toolName} is a read-only tool — allowed` }
+  }
+
+  // ── FILE WRITE TOOLS ──────────────────────────────────────────────────
+  if (FILE_WRITE_TOOLS.has(toolName)) {
+    const filePath = input.file_path
+    if (!filePath) {
+      return {
+        allow: false,
+        reason: `${toolName} has no file_path — cannot assess containment; denied conservatively`,
+      }
+    }
+    return _assessFilePath({
+      filePath, toolName,
+      inputSliceRoot, canonicalSliceRoot,
+      verdictFile, _realpath,
+    })
+  }
+
+  // ── BASH ──────────────────────────────────────────────────────────────
+  if (toolName === 'Bash') {
+    const cmd = typeof input.command === 'string' ? input.command : ''
+    return _assessBashCommand({ cmd, inputSliceRoot, canonicalSliceRoot })
+  }
+
+  // ── UNKNOWN TOOLS ─────────────────────────────────────────────────────
+  // Conservative default: deny unknown tools — they may be mutating.
+  // To allow a new read-only tool, add it to READ_ONLY_TOOLS above.
+  return {
+    allow: false,
+    reason: `Unknown tool "${toolName}" — denied by default (not in READ_ONLY_TOOLS; add if truly read-only)`,
+  }
+}
+
+// ── _assessFilePath ───────────────────────────────────────────────────────────
+
+function _assessFilePath ({
+  filePath, toolName,
+  inputSliceRoot, canonicalSliceRoot,
+  verdictFile, _realpath,
+}) {
+  const resolved = path.resolve(filePath)
+
+  // Is this a write to the verdictFile (FLOW_REVIEW.json)?
+  if (verdictFile) {
+    const resolvedVerdict = path.resolve(verdictFile)
+    if (resolved === resolvedVerdict) {
+      // B4 fix: check resolved path FIRST — before any symlink/realpath logic.
+      // If verdictFile's resolved path is inside sliceRoot, deny regardless of whether
+      // the file exists yet. The old ENOENT catch path ("no symlink possible; allow")
+      // was the hole: a non-existent verdictFile inside sliceRoot slipped through.
+      if (_isUnder(resolvedVerdict, canonicalSliceRoot) || _isUnder(resolvedVerdict, inputSliceRoot)) {
+        return {
+          allow: false,
+          reason: `verdictFile "${verdictFile}" resolves inside sliceRoot — denied`,
+        }
+      }
+      // Secondary check: deny if an existing verdictFile is a symlink INTO the slice.
+      // (Handles indirect containment via symlinks that point inside sliceRoot.)
+      try {
+        const realVerdict = _realpath(verdictFile)
+        if (_isUnder(realVerdict, canonicalSliceRoot) || _isUnder(realVerdict, inputSliceRoot)) {
+          return {
+            allow: false,
+            reason: `verdictFile "${verdictFile}" is a symlink resolving to "${realVerdict}" inside sliceRoot — denied`,
+          }
+        }
+      } catch {
+        // verdictFile doesn't exist yet — no symlink possible; allow.
+      }
+      return { allow: true, reason: `write to verdictFile (${path.basename(verdictFile)}) — allowed` }
+    }
+  }
+
+  // Not the verdictFile. Check whether the write target lands inside the slice.
+
+  // 1. String-level check — catches '..' traversal and absolute paths into sliceRoot.
+  if (_isUnder(resolved, canonicalSliceRoot) || _isUnder(resolved, inputSliceRoot)) {
+    return {
+      allow: false,
+      reason: `${toolName} to "${filePath}" (resolved: "${resolved}") is inside sliceRoot — denied`,
+    }
+  }
+
+  // 2. Realpath check — catches symlinks whose TARGET is inside sliceRoot.
+  try {
+    const real = _realpath(filePath)
+    if (_isUnder(real, canonicalSliceRoot) || _isUnder(real, inputSliceRoot)) {
+      return {
+        allow: false,
+        reason: `${toolName} to "${filePath}" symlinks to "${real}" inside sliceRoot — denied`,
+      }
+    }
+  } catch {
+    // ENOENT or other — step 1 already handled the in-slice case.
+  }
+
+  return { allow: true, reason: `${toolName} to "${filePath}" is outside sliceRoot — allowed` }
+}
+
+// ── _assessBashCommand ────────────────────────────────────────────────────────
+// HEURISTIC — see BASH LIMITATION comment at top of file.
+
+function _assessBashCommand ({ cmd, inputSliceRoot, canonicalSliceRoot }) {
+  // Returns true if `str` (a path extracted from the command) resolves under sliceRoot.
+  function inSlice (str) {
+    if (!str) return false
+    const abs = path.isAbsolute(str) ? str : path.resolve(str)
+    return _isUnder(abs, canonicalSliceRoot) || _isUnder(abs, inputSliceRoot)
+  }
+
+  // Returns true if either form of sliceRoot appears literally in the command string.
+  // Used for commands that embed the target path as a positional argument.
+  function cmdContainsSlice () {
+    return cmd.includes(canonicalSliceRoot) || cmd.includes(inputSliceRoot)
+  }
+
+  // ── Output redirection (> or >>) into sliceRoot ───────────────────────
+  // HEURISTIC: misses paths with spaces and shell variable expansion.
+  // Negative lookbehind excludes '<' so '<<' (heredoc) and '<>' (r/w) are not
+  // misread as write redirections.
+  // Group 1: optional surrounding quote char; group 2: the path (stripped of quotes).
+  // This catches both `> /slice/f` (unquoted) and `> "/slice/f"` / `> '/slice/f'` (D1/D2).
+  const redirRe = /(?<![<])>+\s*(['"]?)([^\s;|&'"]+)\1/g
+  let m
+  while ((m = redirRe.exec(cmd)) !== null) {
+    if (inSlice(m[2])) {
+      return {
+        allow: false,
+        reason: `Bash output redirection to "${m[2]}" targets sliceRoot — denied`,
+      }
+    }
+  }
+
+  // ── git mutating commands targeting sliceRoot ─────────────────────────
+  if (/\bgit\b/.test(cmd) && GIT_MUTATING_RE.test(cmd)) {
+    // Explicit -C flag: `git -C <dir> <verb>`
+    const cwdMatch = cmd.match(/-C\s+(['"]?)([^\s'"]+)\1/)
+    if (cwdMatch) {
+      const cwdArg = cwdMatch[2]
+      if (inSlice(cwdArg)) {
+        return {
+          allow: false,
+          reason: `Bash "git -C ${cwdArg} ..." targets sliceRoot — denied`,
+        }
+      }
+    }
+    // Fallback: sliceRoot path appears anywhere in a mutating git command.
+    if (cmdContainsSlice()) {
+      return { allow: false, reason: 'Bash git mutating command references sliceRoot — denied' }
+    }
+  }
+
+  // ── cp/mv: only deny when DESTINATION (last positional arg) is inside sliceRoot ──
+  // C5 fix: the old approach (cmdContainsSlice) wrongly denied `cp /slice/f /tmp/x`
+  // because sliceRoot appeared as the SOURCE. Only the destination can cause a write.
+  if (CP_MV_RE.test(cmd)) {
+    const tokens = cmd.trim().split(/\s+/)
+    // Skip the verb (i=0) and option flags; remaining tokens are positional path args.
+    const pathArgs = tokens.filter((t, i) => i > 0 && !t.startsWith('-'))
+    const dest = pathArgs[pathArgs.length - 1]
+    if (dest && inSlice(dest)) {
+      const verb = (cmd.match(CP_MV_RE) || [''])[0]
+      return {
+        allow: false,
+        reason: `Bash "${verb}" destination "${dest}" targets sliceRoot — denied`,
+      }
+    }
+  }
+
+  // ── rm / tee / truncate / dd / install targeting sliceRoot ──
+  if (BASH_WRITE_CMD_RE.test(cmd) && cmdContainsSlice()) {
+    const verb = (cmd.match(BASH_WRITE_CMD_RE) || [''])[0]
+    return {
+      allow: false,
+      reason: `Bash write command "${verb}" references sliceRoot — denied`,
+    }
+  }
+
+  // ── sed -i targeting sliceRoot ────────────────────────────────────────
+  if (SED_INPLACE_RE.test(cmd) && cmdContainsSlice()) {
+    return { allow: false, reason: 'Bash "sed -i" references sliceRoot — denied' }
+  }
+
+  return { allow: true, reason: 'Bash command allowed (no write-to-slice pattern detected)' }
+}
+
+// ── helpers ───────────────────────────────────────────────────────────────────
+
+// Returns true if `filePath` equals `dir` OR is strictly inside it.
+function _isUnder (filePath, dir) {
+  return filePath === dir || filePath.startsWith(dir + path.sep)
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.109",
+  "version": "0.7.111",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -21,6 +21,7 @@
     "flow-task-graph.mjs",
     "flow-preview.mjs",
     "flow-review.mjs",
+    "flow-review-gate.mjs",
     "flow-assembly.mjs",
     "flow-budget.mjs",
     "serve-dir.mjs",

package/transcript-sanitize.mjs

@@ -50,6 +50,7 @@ const ANTHROPIC_SERVER_TOOLS = new Set([
 
 const STU_MARKER = '"server_tool_use"'
 const TR_MARKER = '"tool_result"'
+const TU_MARKER = '"tool_use"' // matches "type":"tool_use" but NOT "server_tool_use" or "tool_use_id"
 
 /**
  * Resolve a session's transcript path the same way Claude Code names it:
@@ -105,9 +106,107 @@ function fixToolResultInAssistant(content) {
   return { removed: before - next.length, content: next }
 }
 
+/* ─────────────────────────────────────────────────────────────
+   THIRD HEAL — dangling tool_use (S4 clean-redispatch, 2026-06-30):
+   a lane force-killed mid-tool-call leaves an assistant message with a
+   tool_use block that has NO matching tool_result anywhere in the
+   transcript. On the next SDK replay Anthropic 400s:
+     "tool_use ids were found without tool_result blocks"
+   and the lane cannot resume.
+
+   THE FIX: cross-row scan — collect every tool_use id and every
+   tool_result tool_use_id across the whole transcript; any tool_use id
+   with no matching tool_result is "dangling". For each assistant message
+   that holds dangling calls, inject a synthetic user message immediately
+   after it carrying one tool_result per dangling id:
+     { type:'tool_result', tool_use_id:<id>, content:'[interrupted]', is_error:true }
+   This is the minimal valid placeholder that unblocks the next turn.
+
+   Idempotent: a tool_use already paired with a tool_result is untouched.
+   A second pass over the same (now-healed) transcript is a no-op because
+   the synthetic results are part of the file and pair the calls.
+   ───────────────────────────────────────────────────────────── */
+
+// Return all tool_use ids from a parsed row (checks .message.content AND top-level .content).
+function getToolUseIds(obj) {
+  const ids = []
+  const scan = (content) => {
+    if (!Array.isArray(content)) return
+    for (const b of content) { if (b && b.type === 'tool_use' && b.id) ids.push(b.id) }
+  }
+  if (obj.message) scan(obj.message.content)
+  scan(obj.content)
+  return ids
+}
+
+// Collect all tool_result tool_use_ids from a parsed row into a Set.
+function collectToolResultIds(obj, into) {
+  const scan = (content) => {
+    if (!Array.isArray(content)) return
+    for (const b of content) { if (b && b.type === 'tool_result' && b.tool_use_id) into.add(b.tool_use_id) }
+  }
+  if (obj.message) scan(obj.message.content)
+  scan(obj.content)
+}
+
+// Return the role of a parsed row ('assistant' | 'user' | null).
+function getRole(obj) {
+  if (!obj) return null
+  if (obj.message && obj.message.role) return obj.message.role
+  if (obj.type === 'assistant') return 'assistant'
+  if (obj.type === 'user') return 'user'
+  return null
+}
+
+/**
+ * Heal 3: scan parsed objects for dangling tool_use ids; insert synthetic
+ * user rows immediately after the assistant rows that own them.
+ * @param {string[]} rows  — string rows (already updated by Heals 1+2)
+ * @param {(object|null)[]} parsed — objects (mutated in-place by Heals 1+2)
+ * @returns {{ rows: string[], injected: number }}
+ */
+function fixDanglingToolUse(rows, parsed) {
+  // Full-transcript scan: collect every tool_result tool_use_id (= paired ids).
+  const pairedIds = new Set()
+  for (const obj of parsed) {
+    if (obj) collectToolResultIds(obj, pairedIds)
+  }
+
+  let injected = 0
+  const out = []
+  for (let i = 0; i < rows.length; i++) {
+    out.push(rows[i])
+    const obj = parsed[i]
+    if (!obj || getRole(obj) !== 'assistant') continue
+
+    const dangling = getToolUseIds(obj).filter(id => !pairedIds.has(id))
+    if (!dangling.length) continue
+
+    // Inject synthetic user row with one tool_result per dangling call.
+    const synRow = {
+      type: 'user',
+      message: {
+        role: 'user',
+        content: dangling.map(id => ({
+          type: 'tool_result',
+          tool_use_id: id,
+          content: '[interrupted]',
+          is_error: true,
+        })),
+      },
+    }
+    out.push(JSON.stringify(synRow))
+    // Mark injected ids as paired so a second pass treats them as clean (idempotency).
+    for (const id of dangling) pairedIds.add(id)
+    injected += dangling.length
+  }
+
+  return { rows: out, injected }
+}
+
 /**
  * Sanitize one transcript file in place. Returns { lines, blocks } counting the
- * transcript lines rewritten and the individual blocks flipped. A missing,
+ * transcript lines rewritten and the individual blocks healed/injected. A missing,
  * unreadable, or already-clean file is a silent no-op ({ lines: 0, blocks: 0 }).
  */
 export function sanitizeTranscript(file) {
@@ -119,23 +218,29 @@ export function sanitizeTranscript(file) {
   }
   const fileHasStu = raw.includes(STU_MARKER)
   const fileHasTr = raw.includes(TR_MARKER)
-  if (!fileHasStu && !fileHasTr) return { lines: 0, blocks: 0 } // fast path: nothing illegal possible
+  const fileHasTu = raw.includes(TU_MARKER)
+  if (!fileHasStu && !fileHasTr && !fileHasTu) return { lines: 0, blocks: 0 } // fast path: nothing illegal possible
 
   const rows = raw.split('\n')
   let lines = 0
   let blocks = 0
+
+  // Pre-parse ALL rows so Heal 3 can do cross-row analysis.
+  // Heals 1+2 mutate these objects in-place, so parsed[i] always reflects the
+  // post-heal state when Heal 3 runs. Unparseable lines → null (left byte-identical).
+  const parsed = rows.map(row => {
+    if (!row) return null
+    try { return JSON.parse(row) } catch { return null }
+  })
+
   for (let i = 0; i < rows.length; i++) {
     const row = rows[i]
     if (!row) continue
     const rowHasStu = row.includes(STU_MARKER)
     const rowHasTr = row.includes(TR_MARKER)
     if (!rowHasStu && !rowHasTr) continue
-    let obj
-    try {
-      obj = JSON.parse(row)
-    } catch {
-      continue // never touch a line we can't parse — leave it byte-identical
-    }
+    const obj = parsed[i]
+    if (!obj) continue // unparseable — already null, leave byte-identical
     let n = 0
     // Pass 1 — foreign server_tool_use → tool_use (any message).
     if (rowHasStu) {
@@ -160,11 +265,30 @@ export function sanitizeTranscript(file) {
     }
   }
 
-  if (!blocks) return { lines: 0, blocks: 0 } // every server_tool_use was already a legal Anthropic one
+  // Heal 3 — dangling tool_use: cross-row scan + synthetic row insertion.
+  // Runs after Heals 1+2 so parsed objects already reflect those fixes.
+  //
+  // Gate: run whenever the fast-path was NOT taken — i.e., always here.
+  // The old `if (fileHasTu)` guard was wrong for a heal that depends on Heal 1's
+  // output: Heal 1 can create NEW tool_use blocks by flipping server_tool_use, but
+  // the raw `"server_tool_use"` string does NOT contain the `"tool_use"` substring
+  // (the `server_` prefix + underscore break the literal match), so fileHasTu=false
+  // and Heal 3 was skipped — leaving the now-dangling call unhealed (bug C9).
+  // The fast-path early-return above is the real no-op gate for truly-clean files.
+  let outRows = rows
+  {
+    const h3 = fixDanglingToolUse(rows, parsed)
+    if (h3.injected) {
+      outRows = h3.rows
+      blocks += h3.injected
+    }
+  }
+
+  if (!blocks) return { lines: 0, blocks: 0 } // nothing was changed by any heal
 
   // Atomic write — a crash mid-write must never leave a truncated transcript.
   const tmp = `${file}.tp-sanitize.tmp`
-  fs.writeFileSync(tmp, rows.join('\n'))
+  fs.writeFileSync(tmp, outRows.join('\n'))
   fs.renameSync(tmp, file)
   return { lines, blocks }
 }