thinkpool-pair 0.7.333 → 0.7.335

package/bridge.mjs

@@ -92,7 +92,7 @@ function stopFlowPreviews (flowId, laneId = null) {
 }
 import { FLOW_REVIEWER_PROMPT, FLOW_CODEX_REVIEWER_PROMPT, revertLane, parseReviewVerdict, reviewVerdictToReflection } from './flow-review.mjs'
 import { reviewGateDecision } from './flow-review-gate.mjs'
-import { IMMUTABLE_REVIEW_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
+import { IMMUTABLE_REVIEW_READ_TOOL_EXTRAS, UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS, readReviewFile, runReviewCheck } from './review-check.mjs'
 import { pairAdjudicationPrompt, reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
 import { mergeWorktrees, inlineSingleHtml, initRepo } from './flow-assembly.mjs'
 import { canDispatch, FLOW_LIMITS, makeBudget, recordSpend, killSwitchEnv } from './flow-budget.mjs'
@@ -3032,13 +3032,13 @@ function openStructured({ id, runtime = 'claude', model, models, effort, resume,
         'Read one regular file from the declared immutable review target. This always reads the target’s pinned Git object, never a live worktree; target and path are validated and the response is byte-bounded.',
         { target: z.string(), path: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await readReviewFile({ target: args?.target, filePath: args?.path, snapshots: entry.flowReviewSnapshots })) }] }),
-        IMMUTABLE_REVIEW_TOOL_EXTRAS,
+        IMMUTABLE_REVIEW_READ_TOOL_EXTRAS,
       ), tool(
         'run_review_check',
-        'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id; it never accepts a shell command, cwd, environment, executable, or arguments. The check runs in a scratch archive, never in a builder worktree.',
+        'Run one fixed verification check against an immutable git-archived review target. This accepts only the declared target and a fixed check id, but executes target-defined code in a scratch archive that is not an OS filesystem/network sandbox. It can require approval and must be refused by approvalPolicy=never reviewers.',
         { target: z.string(), checkId: z.string() },
         async (args) => ({ content: [{ type: 'text', text: JSON.stringify(await runReviewCheck({ target: args?.target, checkId: args?.checkId, snapshots: entry.flowReviewSnapshots })) }] }),
-        IMMUTABLE_REVIEW_TOOL_EXTRAS,
+        UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS,
       )] : []),
     ],
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.333",
+  "version": "0.7.335",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -113,6 +113,7 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.198",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@supabase/supabase-js": "^2.45.0",
+    "compromise": "14.16.0",
     "yaml": "2.9.0",
     "zod": "^4.4.3"
   },

package/review-check.mjs

@@ -17,13 +17,10 @@ const CHECKS = Object.freeze({
 })
 const OUTPUT_CAP = 512 * 1024
 
-// Codex's native read-only/review mode never raises approval cards. MCP tools
-// without annotations are conservatively treated as approval-requiring, which
-// makes `approvalPolicy: never` auto-decline even our immutable readers before
-// their handlers run. Keep the policy next to the implementation and reuse it
-// for both source reads and fixed scratch checks: neither mutates the reviewed
-// target, neither reaches the open world, and repeating either is safe.
-export const IMMUTABLE_REVIEW_TOOL_EXTRAS = Object.freeze({
+// Codex's native read-only/review mode never raises approval cards. Mark only
+// the pinned Git-blob reader as approval-free: it cannot execute target code,
+// mutate the target, or reach the open world.
+export const IMMUTABLE_REVIEW_READ_TOOL_EXTRAS = Object.freeze({
   annotations: Object.freeze({
     readOnlyHint: true,
     destructiveHint: false,
@@ -32,6 +29,21 @@ export const IMMUTABLE_REVIEW_TOOL_EXTRAS = Object.freeze({
   }),
 })
 
+// Fixed check ids prevent command injection, but the selected check still runs
+// target-defined code. The scratch archive protects the reviewed worktree; it
+// is not an OS filesystem/network sandbox. Advertise that boundary honestly so
+// approvalPolicy=never reviewers refuse execution instead of silently granting
+// host/open-world authority. Sandboxed runners can still expose this behind an
+// explicit approval in runtimes that support one.
+export const UNSANDBOXED_REVIEW_CHECK_TOOL_EXTRAS = Object.freeze({
+  annotations: Object.freeze({
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+  }),
+})
+
 export function reviewCheckCommand(checkId) {
   if (!Object.hasOwn(CHECKS, checkId)) throw new Error('unapproved review check')
   const [command, args] = CHECKS[checkId]

package/terminal-name.mjs

@@ -1,4 +1,5 @@
 import { nativeClaudeProviderAccessFailed } from './cross-terminal.mjs'
+import nlp from 'compromise/two'
 
 const SKIP = new Set([
   'a', 'an', 'and', 'are', 'at', 'be', 'can', 'could', 'for', 'from', 'how', 'i',
@@ -18,12 +19,66 @@ const NOISE = /^(?:context|background|for reference|here(?:'s| is)|note|current(
 const EXPLANATION = /^(?:because|cause|since|so that|this is because)\b/i
 const CONSTRAINT = /^(?:users? can still|keep|must|never|should|without)\b/i
 const DEPENDENT_FRAGMENT = /^(?:after|before|by|during|for|from|in|instead(?: of)?|on|through|until|with|without)\b/i
-const INFORMATION_REQUEST = /^(?:which|what|who|where|when|why|how)\b/i
-const NEGATIVE_PREFERENCE = /^(?:(?:i|we)\s+)?(?:do not|don't|dont|would not|wouldn't|won't|wont)\s+(?:(?:want|wanna|need)(?:\s+to)?|use|include|choose)\b|^(?:(?:i|we)\s+)?(?:want|wanna|need)(?:\s+to)?\s+avoid\b/i
 const ISSUE = /\b(?:broken|buggy|crash(?:es|ed|ing)?|duplicate|error|fail(?:s|ed|ing|ure)?|flash(?:es|ed|ing)?|missing|no animation|not working|out of (?:scrollable )?view|stuck|wrong)\b/i
 const REQUEST = /^(?:please\s+)?(?:can|could|would|will)\s+(?:we|you)\b|^(?:please\s+)?(?:how about|let's|let us|we need to|i want you to)\b/i
 const SECRET = /(?<![\p{L}\p{N}])(?:sk-(?:proj-)?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|xox[baprs]-[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|glpat-[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|AIza[a-z0-9_-]{8,}|AKIA[A-Z0-9]{12,}|bearer\s+[a-z0-9._-]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,})(?![\p{L}\p{N}])/giu
 const HANDOFF_MARKER = /^---\s*(?:the person's next message|current person request(?:\s*\([^\n]*\))?|side task)\s*---\s*$/gim
+const QUESTION_WORDS = new Set(['how', 'what', 'when', 'where', 'which', 'who', 'whom', 'whose', 'why'])
+const PREFERENCE_WORDS = new Set(['avoid', 'choose', 'include', 'need', 'use', 'want'])
+const PREFERENCE_OBJECT_WORDS = new Set(['avoid', 'choose', 'include', 'use'])
+
+const conceptsForTerm = (term) => new Set(
+  [term?.text, term?.normal, term?.machine, term?.implicit]
+    .map((value) => String(value || '').trim().toLowerCase())
+    .filter(Boolean),
+)
+
+const analyzeGrammar = (value, suppliedTerms = null) => {
+  const text = String(value || '').trim()
+  const terms = suppliedTerms || nlp(text).json({ terms: true }).flatMap((sentence) => sentence.terms || [])
+  const visible = terms
+    .filter((term) => String(term?.text || '').trim())
+    .map((term) => ({ text: term.text, concepts: conceptsForTerm(term), tags: new Set(term.tags || []) }))
+  const hasQuestionWord = visible.some((term) => [...term.concepts].some((word) => QUESTION_WORDS.has(word)))
+  const taggedQuestionWord = visible.some((term) => term.tags.has('QuestionWord'))
+  const negative = terms.some((term) => Array.isArray(term?.tags) && term.tags.includes('Negative'))
+  const preference = terms.some((term) => [...conceptsForTerm(term)].some((word) => PREFERENCE_WORDS.has(word)))
+  return {
+    text,
+    visible,
+    informationRequest: hasQuestionWord && (taggedQuestionWord || /\?\s*$/.test(text)),
+    negativePreference: negative && preference,
+  }
+}
+
+const parsedClauses = (value) => String(value || '')
+  .replace(/,\s*(?:but|however)\s+/gi, '\n')
+  .split(/\n+|;\s*/)
+  .flatMap((part) => {
+    const text = part.trim()
+    if (!text) return []
+    const sentences = nlp(text).json({ terms: true })
+    return sentences.length
+      ? sentences.map((sentence) => analyzeGrammar(sentence.text, sentence.terms || []))
+      : [analyzeGrammar(text)]
+  })
+  .filter((clause) => clause.text)
+
+const questionSubject = (analysis) => {
+  const index = analysis.visible.findIndex((term) => [...term.concepts].some((word) => QUESTION_WORDS.has(word)))
+  return index >= 0 ? analysis.visible.slice(index + 1).map((term) => term.text).join(' ') : analysis.text
+}
+
+const negativePreferenceSubject = (analysis) => {
+  let index = -1
+  for (let i = 0; i < analysis.visible.length; i++) {
+    if ([...analysis.visible[i].concepts].some((word) => PREFERENCE_OBJECT_WORDS.has(word))) index = i
+  }
+  if (index < 0) {
+    index = analysis.visible.findIndex((term) => [...term.concepts].some((word) => word === 'need' || word === 'want'))
+  }
+  return index >= 0 ? analysis.visible.slice(index + 1).map((term) => term.text).join(' ') : analysis.text
+}
 
 const ACTIONS = Object.freeze([
   { title: 'Fix', score: 100, re: /\b(?:fix|fixes|fixed|fixing|repair|repairs|repaired|repairing)\b/i },
@@ -117,35 +172,31 @@ const explicitIntent = (text) => {
 }
 
 const bestIntentClause = (text) => {
-  const clauses = text
-    .replace(/,\s*(?:but|however)\s+/gi, '\n')
-    .split(/\n+|(?<=[.!?;])\s+/)
-    .map((part) => part.trim())
-    .filter(Boolean)
+  const clauses = parsedClauses(text)
   let best = null
-  for (let i = 0; i < clauses.length; i++) {
-    const clause = clauses[i].replace(/^[-*#>\d.)\s]+/, '').trim()
+  for (const parsed of clauses) {
+    const clause = parsed.text.replace(/^[-*#>\d.)\s]+/, '').trim()
     if (!clause || /^(?:https?:\/\/|\/|[A-Za-z]:\\)/.test(clause)) continue
-    const words = clause.match(/[\p{L}\p{N}][\p{L}\p{N}+#.'-]*/gu) || []
+    const grammar = clause === parsed.text ? parsed : analyzeGrammar(clause)
     const action = bestAction(clause)
     let score = action?.score || 0
     if (REQUEST.test(clause)) score += 18
-    if (INFORMATION_REQUEST.test(clause)) score += 36
+    if (grammar.informationRequest) score += 36
     if (ISSUE.test(clause)) score += /\b(?:crash|fail|flash|stuck|wrong)\w*\b/i.test(clause) ? 36 : 26
-    if (words.length >= 3 && words.length <= 24) score += 10
-    else if (words.length > 40) score -= 14
+    if (grammar.visible.length >= 3 && grammar.visible.length <= 24) score += 10
+    else if (grammar.visible.length > 40) score -= 14
     if (NOISE.test(clause)) score -= 30
     if (EXPLANATION.test(clause)) score -= 34
     if (CONSTRAINT.test(clause)) score -= 45
-    if (NEGATIVE_PREFERENCE.test(clause)) score -= 70
+    if (grammar.negativePreference) score -= 70
     // A short dependent tail such as "From ground up" or "On mobile" adds
     // scope to the preceding request; it is not a standalone task. Recency is
     // deliberately not a signal here: the title should represent the main
     // theme, not whichever sentence happened to come last.
-    if (!action && !REQUEST.test(clause) && !INFORMATION_REQUEST.test(clause) && DEPENDENT_FRAGMENT.test(clause)) score -= 24
+    if (!action && !REQUEST.test(clause) && !grammar.informationRequest && DEPENDENT_FRAGMENT.test(clause)) score -= 24
     if (!best || score > best.score) best = { clause, score }
   }
-  return best?.clause || clauses[0] || null
+  return best?.clause || clauses[0]?.text || null
 }
 
 export function extractTerminalTask(value) {
@@ -210,9 +261,13 @@ const taskTitle = (value) => {
     .replace(/^\s*(?:how about|i (?:do not|don't) know|i guess|i want you to|we need to|your task is to|let(?:'s| us))\s+/i, '')
     .trim()
   if (!body) return null
-  if (NEGATIVE_PREFERENCE.test(body)) return null
-  const informationRequest = INFORMATION_REQUEST.test(body)
-  if (informationRequest) body = body.replace(/^\s*(?:which|what)\s+/i, '').trim()
+  const grammar = analyzeGrammar(body)
+  if (grammar.negativePreference) {
+    const subject = contentWords(negativePreferenceSubject(grammar)).slice(0, 4)
+    return subject.length ? cleanTerminalName(['Avoid', ...subject.map(titleWord)].join(' ')) : null
+  }
+  const informationRequest = grammar.informationRequest
+  if (informationRequest) body = questionSubject(grammar).trim()
   const signalText = body
   body = body
     .replace(/\s*,?\s+(?:so (?:that|you|we|it)\b|because\b|cause\b|if you know what i mean\b)[\s\S]*$/i, '')

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 15,
+  "bundleVersion": 16,
   "contracts": [
     {
       "id": "room-coordination",
@@ -130,13 +130,13 @@
     },
     {
       "id": "flow-completion",
-      "version": 1,
+      "version": 2,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and immutable-review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [