thinkpool-pair 0.7.144 → 0.7.145

package/bridge.mjs

@@ -353,6 +353,18 @@ if (!argv[0] || argv[0].startsWith('-')) { const { runAccount } = await import('
 
 const room = (argv[0] || '').toUpperCase().trim()
 if (!room) { console.error('usage: npx thinkpool-pair <ROOM> [--headless] [--continue|--fresh] [-- <command…>]   |   npx thinkpool-pair  (account mode)'); process.exit(1) }
+// Security (audit 2026-07-02): `room` becomes a filesystem path segment under
+// ~/.thinkpool-pair (session-store) AND is interpolated into launchctl/systemd
+// service labels. sessions.id is unconstrained TEXT, so refuse path-unsafe / shell-
+// active characters at the gate instead of trusting the upstream session id.
+// Mirrors service.mjs's ROOM_CODE_RE, broadened for the dash in code_sessions
+// codes and slightly longer ids. Every room-interpolating path is now guarded.
+// NOTE: pure startup gate — runs before any realtime channel exists; does not
+// alter emit topic/event/presence (BR4 surface untouched).
+if (!/^[A-Z0-9_-]{2,32}$/.test(room)) {
+  console.error(`refused: invalid room code ${JSON.stringify(room)} (expected 2–32 alphanumerics, dash, or underscore)`)
+  process.exit(1)
+}
 // ── Supervisor mode (--supervise / --keep-alive): keep the bridge alive across
 // crashes. We re-exec ourselves without the flag and respawn the child on any
 // non-clean exit with exponential backoff. Zero-dependency, cross-platform. With

package/claude-session.mjs

@@ -1006,7 +1006,18 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   return {
     // A lazy (restored-idle) session cold-boots the query on its first turn. input.push
     // is queue-backed, so the pushed turn buffers and runs once the query is ready.
-    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; input.push([{ type: 'text', text: String(text) }, { type: 'text', text: roomReminder() }]) } },
+    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false;
+      const t = String(text)
+      // SDK 0.3.198 only recognizes a slash command (/compact, /clear, custom /cmds) when the
+      // user message is a SINGLE text block. Appending the per-turn ROOM NOW <system-reminder>
+      // as a 2nd block made 0.3.198 treat /compact as a plain turn → compaction silently
+      // no-op'd (Max, 2026-07-02; 0.3.185 tolerated the extra block, 0.3.198 tightened it —
+      // verified against the SDK: single-block → the compact command RUNS, two-block → not
+      // recognized). So a slash command goes CLEAN; conversational turns keep the reminder.
+      // Normal turns never start with "/" (composeAgentStdin prepends the preamble), and the
+      // web already routes "/"-prefixed input as a command (pane.jsx), so this matches intent.
+      input.push(/^\s*\//.test(t) ? [{ type: 'text', text: t }] : [{ type: 'text', text: t }, { type: 'text', text: roomReminder() }])
+    } },
     // Cold-boot the query WITHOUT sending a turn — the background warmer calls this on
     // lazily-restored idle terminals so they're ready before the user clicks them.
     warm() { if (!started && !closed) runQuery() },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.144",
+  "version": "0.7.145",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -17,7 +17,20 @@ import path from 'node:path'
 // can point each case at a fresh tempdir after importing this module. Production leaves
 // it unset → the real home-dir store.
 const ROOT = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
-const dir = (room) => path.join(ROOT(), room || 'default')
+// Security (audit 2026-07-02): `room` is an external value (a session/code id)
+// used as a filesystem path segment. sessions.id is unconstrained TEXT in the
+// DB and client-generated, so a crafted id like '../../foo' would otherwise let
+// a hostile room write session files OUTSIDE ~/.thinkpool-pair. Contain EVERY
+// derived path under ROOT: resolve and refuse if the result escapes. Pair of
+// the bridge.mjs startup format check — belt + suspenders.
+const dir = (room) => {
+  const root = path.resolve(ROOT())
+  const target = path.resolve(root, room || 'default')
+  if (target !== root && !target.startsWith(root + path.sep)) {
+    throw new Error(`refused: room path escapes sandbox: ${JSON.stringify(room)}`)
+  }
+  return target
+}
 const archiveDir = (room) => path.join(dir(room), '.archive')
 // Only resume the live SDK context for recent sessions — an expired session id
 // fails ("No conversation found"); past this window we restore transcript only.