thinkpool-pair 0.7.144 → 0.7.146

package/bridge.mjs

@@ -353,6 +353,18 @@ if (!argv[0] || argv[0].startsWith('-')) { const { runAccount } = await import('
 
 const room = (argv[0] || '').toUpperCase().trim()
 if (!room) { console.error('usage: npx thinkpool-pair <ROOM> [--headless] [--continue|--fresh] [-- <command…>]   |   npx thinkpool-pair  (account mode)'); process.exit(1) }
+// Security (audit 2026-07-02): `room` becomes a filesystem path segment under
+// ~/.thinkpool-pair (session-store) AND is interpolated into launchctl/systemd
+// service labels. sessions.id is unconstrained TEXT, so refuse path-unsafe / shell-
+// active characters at the gate instead of trusting the upstream session id.
+// Mirrors service.mjs's ROOM_CODE_RE, broadened for the dash in code_sessions
+// codes and slightly longer ids. Every room-interpolating path is now guarded.
+// NOTE: pure startup gate — runs before any realtime channel exists; does not
+// alter emit topic/event/presence (BR4 surface untouched).
+if (!/^[A-Z0-9_-]{2,32}$/.test(room)) {
+  console.error(`refused: invalid room code ${JSON.stringify(room)} (expected 2–32 alphanumerics, dash, or underscore)`)
+  process.exit(1)
+}
 // ── Supervisor mode (--supervise / --keep-alive): keep the bridge alive across
 // crashes. We re-exec ourselves without the flag and respawn the child on any
 // non-clean exit with exponential backoff. Zero-dependency, cross-platform. With
@@ -1602,6 +1614,41 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
           return okText(`Opened idle agent lane ${newRef}${args?.name ? ` ("${args.name}")` : ''}. Hand it work with post_to_terminal, or a person can type into it.`)
         },
       ),
+      // Research lane — run a REAL multi-source search + adversarial verification and
+      // return sourced, verdict-tagged findings. Calls the verified web backend
+      // (/api/research-run) as the room owner; plan-gated + budget-capped server-side.
+      tool(
+        'research',
+        'Run a REAL multi-source web research + verification on a factual question and surface sourced, verdict-tagged findings to the room. Use when the people would genuinely benefit from looking something up or settling an external-fact question — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over current facts. OFFER it first in plain language ("want me to spawn a research lane on that?") and only call it once they agree — it spends (plan-gated: Free 5 / Plus 100 runs per month) and takes ~1 minute. It searches the web, reads sources, and returns each claim marked HELD or REJECTED with citations. Present the findings clearly and let both people weigh the sources.',
+        {
+          question: z.string().min(4).max(400).describe('the question to research, phrased as a clear factual query'),
+        },
+        async (args) => {
+          const okText = (t) => ({ content: [{ type: 'text', text: t }] })
+          const q = String(args?.question || '').trim()
+          if (q.length < 4) return okText('Give a clearer question to research.')
+          if (!codeAuthToken) return okText('Research needs the room signed in — no auth token available on this bridge.')
+          let data
+          try {
+            const res = await fetch(`${WEB_BASE}/api/research-run`, {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${codeAuthToken}` },
+              body: JSON.stringify({ code: room, question: q }),
+            })
+            if (res.status === 402) { const b = await res.json().catch(() => ({})); return okText(b.hint || 'You have used your research runs for this month.') }
+            if (!res.ok) return okText(`Research could not run (HTTP ${res.status}). Often a transient model spike — offer to retry in a moment.`)
+            data = await res.json()
+          } catch (e) { return okText(`Research failed to run: ${e?.message || e}`) }
+          const claims = Array.isArray(data?.claims) ? data.claims : []
+          const held = claims.filter((c) => c.verdict === 'held').length
+          const lines = claims.map((c) => `[${String(c.verdict || 'rejected').toUpperCase()}] ${c.text}${(c.sources && c.sources.length) ? `\n    sources: ${c.sources.join(', ')}` : ''}`)
+          return okText(
+            `Research complete on "${q}" — ${data.searchCount || 0} searches, ${data.sourceCount || 0} sources, ${held}/${claims.length} claims held${data.capped ? ' (capped)' : ''}.\n\n` +
+            (lines.length ? lines.join('\n\n') : 'No verifiable claims found.') +
+            `\n\nPresent these to the room and let both people weigh the sources — flag which held claims rest on a source they might not trust.`
+          )
+        },
+      ),
       // Tier C+ — CLOSE a lane the caller spawned. Restricted to self-spawned agent
       // lanes (spawnedBy === this id): an agent must never be able to kill a sibling
       // someone else is working in, nor the host/attached terminal. The fan-out

package/claude-session.mjs

@@ -635,6 +635,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
       'CROSS-SESSION AWARENESS: the Ensemble reaches across your SESSIONS, not just the terminals in this room. list_sessions() lists your OTHER ThinkPool Code rooms — both your own rooms running on this machine AND your partner\'s rooms in the same pair, reachable over the per-pair bus (a room on the partner\'s machine shows its host). read_session(session, terminal?) reads recent activity inside one (omit `terminal` to list that room\'s terminals, or pass a ref/name to read that lane). Both are READ-ONLY — they never change another session, and they reach ONLY your own rooms and rooms you share with your partner, never a stranger\'s. Reach for them when work spans rooms — "what\'s the other project up to", "pick up where the other session left off", or to check a long-running task elsewhere before you act here.',
       'CROSS-SESSION HAND-OFF: post_to_session(session, text, terminal?) sends a task or message to an agent in ANOTHER of your rooms — your own, or your partner\'s over the pair bus. Use it sparingly and only when the people clearly want the rooms to coordinate — e.g. hand the API room\'s agent a concrete follow-up once the frontend is ready. It is dual-consent: a person in YOUR room approves sending, and a person in the TARGET room approves receiving, before anything is delivered — so never rely on it for chit-chat or loops, and an agent that was itself reached via a cross-room post cannot post onward to a third room. It spends real model tokens in the other room (maybe on the other person\'s machine), so prefer read_session to understand a room before you ever post into it, and only post one concrete hand-off at a time. All of this works only under the ThinkPool account bridge; a standalone room sees just its own terminals.',
       'SUBAGENT POLICY: in this room, delegated work goes through the Ensemble. When you fan out research, parallel sub-tasks, reviews, or any substantive multi-step delegated work, open spawn_terminal lanes — they are visible in the room, the people can watch and steer them, and every other lane can peer at their work. Do NOT reach for the built-in Task/Agent subagents for that work: an in-process subagent is invisible to the room, cannot be peered at or steered, and its work is lost to the Ensemble. The only exception is a trivial, seconds-scale read-only lookup where a room lane would be pure overhead.',
+      'RESEARCH LANE: you have a `research` tool that runs a REAL multi-source web search + adversarial verification and returns each claim marked HELD or REJECTED with citations. Reach for it when the people would genuinely benefit from looking something external up or settling a question of current fact — pricing, "is X still maintained / deprecated", "is that benchmark real", a debate over facts you are not sure of. Do NOT run it unprompted or for things you already know: first OFFER in plain language ("want me to spawn a research lane on that and check it?"), and only call `research(question)` once they agree — it spends real budget (plan-gated Free 5 / Plus 100 runs a month) and takes ~a minute. When it returns, present the held/rejected findings clearly and invite both people to weigh the sources, flagging any held claim that rests on a source they might not trust — that shared scrutiny is the point.',
       'PEER FIRST: other lanes may be working in the same repo as you, right now. Before starting substantive work — and before any code edit that could overlap another lane — check what the room is doing: the ROOM NOW snapshot appended to your latest turn, or read_terminal for detail; list_sessions/read_session when the question spans your other rooms. If a sibling is touching the same files or branch, coordinate (read its lane, or raise it in chat) instead of colliding.',
       'WORKTREES: parallel lanes share one machine and usually one repo. Run `git worktree list` before your first code edit; if linked worktrees exist, the shared main checkout is contended (and may be guard-blocked) — do your work in your OWN worktree on your OWN branch (`git worktree add <dir> -b <branch>`), and never edit a checkout or ride a branch another lane is using.',
       'REMOTE USER: the people driving this room may be on a phone, with NO terminal and no access to this host. Never ask them to run a local command, open a local file, or "go check" something on the machine — anything that must run on the host, you run yourself and show the output in the room. Only suggest actions they can actually do from the room UI or a browser.',
@@ -1006,7 +1007,18 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   return {
     // A lazy (restored-idle) session cold-boots the query on its first turn. input.push
     // is queue-backed, so the pushed turn buffers and runs once the query is ready.
-    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false; input.push([{ type: 'text', text: String(text) }, { type: 'text', text: roomReminder() }]) } },
+    sendTurn(text) { if (!closed) { if (!started) runQuery(); turnActive = true; sawSuggestion = false; lastTurnText = String(text); if (sugTimer) { clearTimeout(sugTimer); sugTimer = null } lastEvtTs = Date.now(); stalledSent = false;
+      const t = String(text)
+      // SDK 0.3.198 only recognizes a slash command (/compact, /clear, custom /cmds) when the
+      // user message is a SINGLE text block. Appending the per-turn ROOM NOW <system-reminder>
+      // as a 2nd block made 0.3.198 treat /compact as a plain turn → compaction silently
+      // no-op'd (Max, 2026-07-02; 0.3.185 tolerated the extra block, 0.3.198 tightened it —
+      // verified against the SDK: single-block → the compact command RUNS, two-block → not
+      // recognized). So a slash command goes CLEAN; conversational turns keep the reminder.
+      // Normal turns never start with "/" (composeAgentStdin prepends the preamble), and the
+      // web already routes "/"-prefixed input as a command (pane.jsx), so this matches intent.
+      input.push(/^\s*\//.test(t) ? [{ type: 'text', text: t }] : [{ type: 'text', text: t }, { type: 'text', text: roomReminder() }])
+    } },
     // Cold-boot the query WITHOUT sending a turn — the background warmer calls this on
     // lazily-restored idle terminals so they're ready before the user clicks them.
     warm() { if (!started && !closed) runQuery() },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.144",
+  "version": "0.7.146",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/session-store.mjs

@@ -17,7 +17,20 @@ import path from 'node:path'
 // can point each case at a fresh tempdir after importing this module. Production leaves
 // it unset → the real home-dir store.
 const ROOT = () => process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair')
-const dir = (room) => path.join(ROOT(), room || 'default')
+// Security (audit 2026-07-02): `room` is an external value (a session/code id)
+// used as a filesystem path segment. sessions.id is unconstrained TEXT in the
+// DB and client-generated, so a crafted id like '../../foo' would otherwise let
+// a hostile room write session files OUTSIDE ~/.thinkpool-pair. Contain EVERY
+// derived path under ROOT: resolve and refuse if the result escapes. Pair of
+// the bridge.mjs startup format check — belt + suspenders.
+const dir = (room) => {
+  const root = path.resolve(ROOT())
+  const target = path.resolve(root, room || 'default')
+  if (target !== root && !target.startsWith(root + path.sep)) {
+    throw new Error(`refused: room path escapes sandbox: ${JSON.stringify(room)}`)
+  }
+  return target
+}
 const archiveDir = (room) => path.join(dir(room), '.archive')
 // Only resume the live SDK context for recent sessions — an expired session id
 // fails ("No conversation found"); past this window we restore transcript only.