thinkpool-pair 0.7.333 → 0.7.334

package/bridge.mjs

@@ -92,7 +92,7 @@ function stopFlowPreviews (flowId, laneId = null) {
 }
 import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
-import { IMMUTABLE_REVIEW_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
+import { IMMUTABLE_REVIEW_READ_TOOL_EXTRAS, UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
 import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
@@ -3032,13 +3032,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         'Read one regular file from the declared immutable review target. This always reads the target’s pinned Git object, never a live worktree; target and path are validated and the response is byte-bounded.',
         { target: z.string(), path: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await readReviewFile({ target: args?.target, filePath: args?.path, snapshots: entry.flowReviewSnapshots })) }] }),
-        IMMUTABLE_REVIEW_TOOL_EXTRAS,
+        IMMUTABLE_REVIEW_READ_TOOL_EXTRAS,
       ), tool(
         'run_review_check',
-        'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id; it never accepts a shell command, cwd, environment, executable, or arguments. The check runs in a scratch archive, never in a builder worktree.',
+        'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id, but executes target-defined code in a scratch archive that is not an OS filesystem/network sandbox. It can require approval and must be refused by approvalPolicy=never reviewers.',
         { target: z.string(), checkId: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await runReviewCheck({ target: args?.target, checkId: args?.checkId, snapshots: entry.flowReviewSnapshots })) }] }),
-        IMMUTABLE_REVIEW_TOOL_EXTRAS,
+        UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS,
       )] : []),
     ],
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.333",
+  "version": "0.7.334",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/review-check.mjs

@@ -17,13 +17,10 @@ const CHECKS = Object.freeze({
 })
 const OUTPUT_CAP = 512 * 1024
 
-// Codex's native read-only/review mode never raises approval cards. MCP tools
-// without annotations are conservatively treated as approval-requiring, which
-// makes `approvalPolicy: never` auto-decline even our immutable readers before
-// their handlers run. Keep the policy next to the implementation and reuse it
-// for both source reads and fixed scratch checks: neither mutates the reviewed
-// target, neither reaches the open world, and repeating either is safe.
-export const IMMUTABLE_REVIEW_TOOL_EXTRAS = Object.freeze({
+// Codex's native read-only/review mode never raises approval cards. Mark only
+// the pinned Git-blob reader as approval-free: it cannot execute target code,
+// mutate the target, or reach the open world.
+export const IMMUTABLE_REVIEW_READ_TOOL_EXTRAS = Object.freeze({
   annotations: Object.freeze({
     readOnlyHint: true,
     destructiveHint: false,
@@ -32,6 +29,21 @@ export const IMMUTABLE_REVIEW_TOOL_EXTRAS = Object.freeze({
   }),
 })
 
+// Fixed check ids prevent command injection, but the selected check still runs
+// target-defined code. The scratch archive protects the reviewed worktree; it
+// is not an OS filesystem/network sandbox. Advertise that boundary honestly so
+// approvalPolicy=never reviewers refuse execution instead of silently granting
+// host/open-world authority. Sandboxed runners can still expose this behind an
+// explicit approval in runtimes that support one.
+export const UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS = Object.freeze({
+  annotations: Object.freeze({
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+  }),
+})
+
 export function reviewCheckCommand(checkId) {
   if (!Object.hasOwn(CHECKS, checkId)) throw new Error('unapproved review check')
   const [command, args] = CHECKS[checkId]

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 15,
+  "bundleVersion": 16,
   "contracts": [
     {
       "id": "room-coordination",
@@ -130,13 +130,13 @@
     },
     {
       "id": "flow-completion",
-      "version": 1,
+      "version": 2,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and immutable-review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [