thinkpool-pair 0.7.332 → 0.7.334

package/bridge.mjs

@@ -92,7 +92,7 @@ function stopFlowPreviews (flowId, laneId = null) {
 }
 import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
-import { readReviewFile, runReviewCheck } from './review-check.mjs'
+import { IMMUTABLE_REVIEW_READ_TOOL_EXTRAS, UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
 import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
@@ -117,7 +117,7 @@ const flowRedispatch = new Map()
 // wave BEFORE overrun. Lives bridge-side because waves dispatch across separate
 // broadcasts; without persistent state the cap can never bite.
 const flowBudgets = new Map()
-import { formatPeek, PEEK, readTerminalBudgetDecision, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneBusyOf, laneStatusOf, settleLaneBusy, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
+import { formatPeek, PEEK, readTerminalTurnBudgetDecision, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, CROSSROOM_BUS, formatPairRoster, crossRoomPostDecision, formatRoomNow, formatClosableHint, closeLaneDecision, laneBusyOf, laneStatusOf, settleLaneBusy, nativeClaudeFallbackHint, buildDispatchPreview, authorizeDirectDispatch } from './cross-terminal.mjs'
 import { createStandalonePairResponder, standalonePairIdentity } from './direct-pair-room.mjs'
 import { dispatchPendingRecap, recoverInterruptedTurn, recoverMissingResumeOnce, sendInterruptedContinue, shouldAttemptNativeResume, supersedeInterruptedResume } from './interrupted-resume.mjs'
 import { supersedeDispatchLease } from './dispatch-lease.mjs'
@@ -2596,13 +2596,16 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
           if (args?.terminal && !target) {
             return { content: [{ type: 'text', text: formatPeek({ selfId: id, sessions, terms, names: termNames, terminal: args.terminal, lines: args?.lines }) }] }
           }
-          const budget = readTerminalBudgetDecision({
+          const budget = readTerminalTurnBudgetDecision({
             targeted: !!args?.terminal,
             targetedCount: entry.peekCount,
             rosterCount: entry.peekRosterCount,
+            budgetTurnRev: entry.peekBudgetTurnRev,
+            currentTurnRev: entry._turnRev,
           })
           entry.peekCount = budget.targetedCount
           entry.peekRosterCount = budget.rosterCount
+          entry.peekBudgetTurnRev = budget.budgetTurnRev
           if (!budget.ok) return { content: [{ type: 'text', text: budget.reason }] }
           const targetEntry = target?.kind === 'agent' ? sessions.get(target.id) : null
           const text = formatPeek({ selfId: id, sessions, terms, names: termNames, terminal: args?.terminal, lines: args?.lines })
@@ -3029,11 +3032,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         'Read one regular file from the declared immutable review target. This always reads the target’s pinned Git object, never a live worktree; target and path are validated and the response is byte-bounded.',
         { target: z.string(), path: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await readReviewFile({ target: args?.target, filePath: args?.path, snapshots: entry.flowReviewSnapshots })) }] }),
+        IMMUTABLE_REVIEW_READ_TOOL_EXTRAS,
       ), tool(
         'run_review_check',
-        'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id; it never accepts a shell command, cwd, environment, executable, or arguments. The check runs in a scratch archive, never in a builder worktree.',
+        'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id, but executes target-defined code in a scratch archive that is not an OS filesystem/network sandbox. It can require approval and must be refused by approvalPolicy=never reviewers.',
         { target: z.string(), checkId: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await runReviewCheck({ target: args?.target, checkId: args?.checkId, snapshots: entry.flowReviewSnapshots })) }] }),
+        UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS,
       )] : []),
     ],
   })

package/cross-terminal.mjs

@@ -18,7 +18,7 @@ export const PEEK = {
   // explicitly when a diagnosis genuinely needs deeper sibling history.
   defaultLines: 20,
   maxLines: 200,
-  perTurnCap: 10,     // targeted transcript reads allowed per user turn (bridge resets it)
+  perTurnCap: 10,     // targeted transcript reads allowed per accepted room turn
   rosterPerTurnCap: 1, // no-argument roster reads use a separate allowance; ROOM NOW is default
   lineCap: 200,       // per-line truncation
   rosterPreview: 100, // last-line preview length in the roster listing
@@ -37,7 +37,7 @@ export const readTerminalBudgetDecision = ({ targeted = false, targetedCount = 0
       ok: false,
       targetedCount: nextTargeted,
       rosterCount: nextRoster,
-      reason: `Cross-terminal transcript read limit reached for this turn (${limits.perTurnCap}). Stop polling and continue with the worker results already collected; a new person-authored turn resets the allowance.`,
+      reason: `Cross-terminal transcript read limit reached for this turn (${limits.perTurnCap}). Stop polling and continue with the worker results already collected; a fresh accepted room turn resets the allowance.`,
     }
     return { ok: true, targetedCount: nextTargeted + 1, rosterCount: nextRoster }
   }
@@ -50,6 +50,34 @@ export const readTerminalBudgetDecision = ({ targeted = false, targetedCount = 0
   return { ok: true, targetedCount: nextTargeted, rosterCount: nextRoster + 1 }
 }
 
+// Provider/model reconstruction can deliver a fresh accepted agent turn without
+// another browser `code-turn` frame (context-carry and interrupted-resume paths).
+// Key read allowances to the bridge-owned turn revision as a second reset seam,
+// so a reconstructed runtime never inherits ten reads spent by the old model.
+// This intentionally resets only read allowances; hop/post/spawn loop breakers
+// remain tied to real person ingress and cannot be escaped by reconstruction.
+export const readTerminalTurnBudgetDecision = ({
+  targeted = false,
+  targetedCount = 0,
+  rosterCount = 0,
+  budgetTurnRev = null,
+  currentTurnRev = 0,
+} = {}, limits = PEEK) => {
+  const current = Math.max(0, Number(currentTurnRev) || 0)
+  const previous = budgetTurnRev == null
+    ? null
+    : Number.isFinite(Number(budgetTurnRev)) ? Number(budgetTurnRev) : null
+  const sameTurn = previous === current
+  return {
+    ...readTerminalBudgetDecision({
+      targeted,
+      targetedCount: sameTurn ? targetedCount : 0,
+      rosterCount: sameTurn ? rosterCount : 0,
+    }, limits),
+    budgetTurnRev: current,
+  }
+}
+
 // One shared lane-status classifier for every roster consumer: the bridge wire,
 // read_terminal, and ROOM NOW. Timestamps stay absolute on the wire so clients can
 // keep the displayed age current without a broadcast every second.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.332",
+  "version": "0.7.334",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/review-check.mjs

@@ -17,6 +17,33 @@ const CHECKS = Object.freeze({
 })
 const OUTPUT_CAP = 512 * 1024
 
+// Codex's native read-only/review mode never raises approval cards. Mark only
+// the pinned Git-blob reader as approval-free: it cannot execute target code,
+// mutate the target, or reach the open world.
+export const IMMUTABLE_REVIEW_READ_TOOL_EXTRAS = Object.freeze({
+  annotations: Object.freeze({
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+  }),
+})
+
+// Fixed check ids prevent command injection, but the selected check still runs
+// target-defined code. The scratch archive protects the reviewed worktree; it
+// is not an OS filesystem/network sandbox. Advertise that boundary honestly so
+// approvalPolicy=never reviewers refuse execution instead of silently granting
+// host/open-world authority. Sandboxed runners can still expose this behind an
+// explicit approval in runtimes that support one.
+export const UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS = Object.freeze({
+  annotations: Object.freeze({
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+  }),
+})
+
 export function reviewCheckCommand(checkId) {
   if (!Object.hasOwn(CHECKS, checkId)) throw new Error('unapproved review check')
   const [command, args] = CHECKS[checkId]

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 15,
+  "bundleVersion": 16,
   "contracts": [
     {
       "id": "room-coordination",
@@ -130,13 +130,13 @@
     },
     {
       "id": "flow-completion",
-      "version": 1,
+      "version": 2,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and immutable-review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [