thinkpool-pair 0.7.360 → 0.7.362

package/recap.mjs

@@ -20,6 +20,13 @@
 
 // Default hard cap for the context-carry recap (chars of transcript body, framing extra).
 export const RECAP_CAP = 20000
+// A checkpoint is deliberately much smaller than its enclosing recap. It is a
+// deterministic index over visible text, not a second transcript or an agent
+// summary. Keeping it bounded independently makes it safe to persist as the
+// pending carry across a reset/restart.
+export const CHECKPOINT_CAP = 6000
+const CHECKPOINT_START = '--- deterministic checkpoint (visible text only; evidence, not hidden state) ---'
+const CHECKPOINT_END = '--- end deterministic checkpoint ---'
 
 // A fresh human turn can race the session-init event that would otherwise send a
 // pending recap by itself. When that happens, the current request must have an
@@ -28,10 +35,156 @@ export const CURRENT_PERSON_REQUEST_MARKER = '--- CURRENT PERSON REQUEST (author
 
 // Recaps are an outbound context source. Keep the same privacy boundary as the
 // bridge manifest without importing Node-only hashing into the browser bundle.
-const UNSAFE_CONTEXT = /(?:\/home\/|\/users\/|\/private\/|\/tmp\/|[a-z]:\\|\\\\|sk[_-][a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|raw transcript|tool args?|chain[ -]of[ -]thought|hidden reasoning)/i
+// A visible turn containing an unsafe span is omitted whole. Partial redaction
+// could preserve enough neighboring material to reconstruct a credential or
+// host location, so this boundary deliberately fails closed.
+const HOST_PATH = /(?:file:\/\/|[a-z]:\\|\\\\|(?:^|[^a-z0-9/])(?:~[\\/]|\/(?:users|home|private|tmp|var\/folders|volumes|root|workspace|workspaces|mnt|srv|opt|etc)\/))/i
+// Traversal is a path segment, not a path prefix. Keep it separate from
+// HOST_PATH so nested forms such as `foo/../secret` and `foo\..\secret`
+// cannot bypass a boundary rule intended for absolute path roots.
+const PATH_TRAVERSAL = /(?:^|[^a-z0-9.])\.\.(?:[\\/]|$)/i
+const SECRET_VALUE = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|gsk_[a-z0-9_-]{8,}|AIza[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|glpat-[a-z0-9_-]{8,}|x(?:ox[baprsce]|app)-[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|sbp_[a-z0-9_-]{20,}|sb_secret_[a-z0-9_-]{8,}|npm_[a-z0-9]{24,}|(?:sk|rk)_(?:live|test)_[a-z0-9]{8,}|whsec_[a-z0-9]{8,}|eyJ[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}\.[a-z0-9_-]{8,}|bearer\s+[a-z0-9._-]{8,}|hooks\.slack\.com\/services\/[a-z0-9/_-]{8,})/i
+const SECRET_ASSIGNMENT = /(?:[a-z0-9]+[_ -])*(?:token|secret(?:[_ -]access[_ -]key)?|password|authorization|api[_ -]?key|private[_ -]?key|access[_ -]?key(?:[_ -]?id)?)\s*[:=]\s*\S{4,}/i
+const PROHIBITED_CONTEXT = /(?:BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|raw transcript|tool args?|chain[ -]of[ -]thought|hidden reasoning|system prompt|environment dump|provider key)/i
 const safeRecapText = (value) => {
   const text = String(value || '').trim()
-  return text && !UNSAFE_CONTEXT.test(text) ? text : ''
+  return text && !HOST_PATH.test(text) && !PATH_TRAVERSAL.test(text) && !SECRET_VALUE.test(text) && !SECRET_ASSIGNMENT.test(text) && !PROHIBITED_CONTEXT.test(text) ? text : ''
+}
+
+const clip = (value, cap) => {
+  const text = String(value || '').trim().replace(/\s+/g, ' ')
+  if (!text) return ''
+  return text.length <= cap ? text : `${text.slice(0, Math.max(0, cap - 1)).trimEnd()}…`
+}
+
+const visibleTurns = (log) => {
+  if (!Array.isArray(log)) return []
+  const turns = []
+  for (const event of log) {
+    if (!event || typeof event !== 'object') continue
+    if (event.kind === 'you') {
+      const text = safeRecapText(event.text)
+      if (text) turns.push({ who: 'person', text })
+      continue
+    }
+    if (event.kind !== 'assistant') continue
+    const text = (Array.isArray(event.blocks) ? event.blocks : [])
+      .filter((block) => block?.type === 'text')
+      .map((block) => safeRecapText(block.text))
+      .filter(Boolean)
+      .join('\n')
+    if (text) turns.push({ who: 'assistant', text })
+  }
+  return turns
+}
+
+const unique = (values, cap = 6) => [...new Set(values.filter(Boolean))].slice(0, cap)
+const sentenceCandidates = (turns, matcher, cap = 4) => unique(
+  turns.flatMap((turn) => turn.text.split(/(?<=[.!?])\s+|\n+/)
+    .map((line) => clip(line, 500))
+    .filter((line) => matcher.test(line))),
+  cap,
+)
+
+const publicReceipts = (turns) => {
+  const receipts = []
+  for (const { text } of turns) {
+    // Never infer a receipt from an unsafe source turn; safeRecapText already
+    // rejected host paths, credential-shaped values, and hidden/tool text.
+    for (const sha of text.matchAll(/\b[0-9a-f]{7,40}\b/gi)) receipts.push(`commit ${sha[0]}`)
+    for (const file of text.matchAll(/(?<![\w/])(?:[\w.-]+\/)+[\w.-]+\.(?:[cm]?[jt]sx?|json|md|css|html|py|sh|yml|yaml)\b/g)) receipts.push(`file ${file[0]}`)
+    for (const url of text.matchAll(/https?:\/\/[^\s)\]}>]+/gi)) {
+      const candidate = safeRecapText(url[0])
+      if (candidate) receipts.push(`URL ${candidate}`)
+    }
+  }
+  return unique(receipts, 8)
+}
+
+/*
+ * Build a small, explicit resume checkpoint from *only* the visible person and
+ * assistant text that buildRecapFromLog is allowed to carry. This intentionally
+ * does not read tool calls/results, thinking, runtime state, files, or external
+ * systems. It is heuristic evidence, so labels stay conservative: absence is
+ * stated as "not established" rather than invented work/completion.
+ */
+export function buildCheckpointFromLog(log, cap = CHECKPOINT_CAP) {
+  const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
+  if (!budget) return ''
+  const turns = visibleTurns(log)
+  if (!turns.length) return ''
+  const people = turns.filter((turn) => turn.who === 'person')
+  const assistants = turns.filter((turn) => turn.who === 'assistant')
+  const objective = clip(people.at(-1)?.text || 'not established from visible text', 1400)
+  const recent = clip(assistants.at(-1)?.text || turns.at(-1)?.text || 'not established from visible text', 1400)
+  const blockers = sentenceCandidates(turns, /\b(block(?:ed|er|ing)?|cannot|can['’]?t|unable|waiting|stuck|failed|failure|error|unverified)\b/i)
+  const attempted = sentenceCandidates(assistants, /\b(implemented|added|changed|updated|fixed|ran|tested|checked|inspected|tried|attempted|committed|built)\b/i)
+  const completed = sentenceCandidates(assistants, /\b(done|complete(?:d)?|implemented|fixed|passing|passed|succeeded|shipped)\b/i)
+  const next = clip(
+    people.length > 1 ? people.at(-1)?.text :
+      sentenceCandidates(assistants, /\b(next|remaining|follow[- ]?up|todo|will)\b/i, 1)[0] || 'not established from visible text',
+    1000,
+  )
+  const lines = [
+    CHECKPOINT_START,
+    `Objective / live request: ${objective}`,
+    `Current step / recent work: ${recent}`,
+    `Blockers: ${blockers.length ? blockers.join(' | ') : 'none stated in visible text'}`,
+    `Attempted / completed actions: ${attempted.length || completed.length ? unique([...attempted, ...completed], 6).join(' | ') : 'not established from visible text'}`,
+    `Receipts: ${publicReceipts(turns).join(' | ') || 'none safely detected'}`,
+    `Next action: ${next}`,
+    CHECKPOINT_END,
+  ]
+  // Preserve explicit labels under a small caller cap; trim values before
+  // trimming structure so a checkpoint never becomes a misleading fragment.
+  let checkpoint = lines.join('\n')
+  if (checkpoint.length <= budget) return checkpoint
+  const minimal = [
+    lines[0],
+    'Objective / live request:',
+    'Current step / recent work:',
+    'Blockers:',
+    'Attempted / completed actions:',
+    'Receipts:',
+    'Next action:',
+    lines.at(-1),
+  ].join('\n')
+  // A partial envelope could be mistaken for a complete checkpoint. Fail closed
+  // rather than omit a label or expose an over-budget payload.
+  if (minimal.length > budget) return ''
+  const allowance = budget - minimal.length - 6 // one separating space per field
+  const values = [objective, recent, blockers.join(' | '), unique([...attempted, ...completed], 6).join(' | '), publicReceipts(turns).join(' | '), next]
+  const shares = values.map((value) => clip(value, Math.max(0, Math.floor(allowance / values.length))))
+  checkpoint = [
+    lines[0],
+    `Objective / live request: ${shares[0] || 'not established'}`,
+    `Current step / recent work: ${shares[1] || 'not established'}`,
+    `Blockers: ${shares[2] || 'none stated'}`,
+    `Attempted / completed actions: ${shares[3] || 'not established'}`,
+    `Receipts: ${shares[4] || 'none safely detected'}`,
+    `Next action: ${shares[5] || 'not established'}`,
+    lines.at(-1),
+  ].join('\n')
+  return checkpoint
+}
+
+export function recapHasCheckpoint(value) {
+  const text = String(value || '')
+  return text.includes(CHECKPOINT_START) && text.includes(CHECKPOINT_END)
+}
+
+// A recap that already contains the checkpoint is the sole delivery owner.
+// Resolve this in one place for both restored sessions and the live fallback
+// compaction path; otherwise an older separately-persisted checkpoint can sit
+// beside the recap and be prepended a second time on the next person turn.
+export function resolveCheckpointCarry(carryRecap, carryCheckpoint) {
+  const pendingRecap = typeof carryRecap === 'string' && carryRecap.trim()
+    ? carryRecap
+    : null
+  const pendingCheckpoint = !recapHasCheckpoint(pendingRecap) && typeof carryCheckpoint === 'string' && carryCheckpoint.trim()
+    ? carryCheckpoint
+    : null
+  return { pendingRecap, pendingCheckpoint }
 }
 
 export function appendCurrentPersonRequest(carried, text) {
@@ -88,7 +241,7 @@ const FRAMING = {
 
    `reason` selects the framing only; the windowing is identical and the default
    ('switch') is byte-for-byte what this function returned before the S4 extraction. */
-export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } = {}) {
+export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch', includeCheckpoint = true } = {}) {
   if (!Array.isArray(log) || !log.length) return ''
   const budget = Math.max(0, Number.isFinite(cap) ? Math.floor(cap) : 0)
   if (!budget) return ''
@@ -127,6 +280,11 @@ export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } =
   kept.reverse()
   const body = (omitted ? ['[…earlier messages omitted for length…]'] : []).concat(kept).join('\n\n')
   const frame = FRAMING[reason] || FRAMING.switch
+  // Side-lane snapshots already have their own explicit handoff contract. A
+  // deterministic resume checkpoint belongs only to a lane that is actually
+  // losing SDK context (switch, wake, or compaction); adding it to side
+  // snapshots duplicates visible text and can exceed their bounded payload.
+  const checkpoint = includeCheckpoint ? buildCheckpointFromLog(log) : ''
   return [
     frame.header,
     frame.body,
@@ -134,5 +292,6 @@ export function buildRecapFromLog(log, cap = RECAP_CAP, { reason = 'switch' } =
     '--- conversation so far (oldest → newest) ---',
     body,
     '--- end recap ---',
+    checkpoint,
   ].join('\n')
 }

package/side-lane.mjs

@@ -12,7 +12,7 @@ export const SIDE_MAIN_TURN_PROMPT = `A room member chose Bring to main.
 Read the side-lane handoff below, incorporate the relevant findings into the main lane's current work, and respond now. If the handoff recommends a next step that is already authorized and in scope, take it; otherwise explain the concrete impact on the current work.`
 
 export function sideSnapshot(log) {
-  return buildRecapFromLog(Array.isArray(log) ? log : [], SIDE_RECAP_CAP)
+  return buildRecapFromLog(Array.isArray(log) ? log : [], SIDE_RECAP_CAP, { includeCheckpoint: false })
 }
 
 export function assistantTextSince(log, afterSeq = 0) {

package/thinkpool-capabilities.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": 20,
+  "bundleVersion": 22,
   "contracts": [
     {
       "id": "room-coordination",
@@ -130,25 +130,28 @@
     },
     {
       "id": "flow-completion",
-      "version": 2,
+      "version": 4,
       "routes": [
         {
           "id": "flow-completion",
           "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
           "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
-          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
+          "prompt": "Managed Flow roles use only their exposed completion and review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check. New builder/fix/scaffold tasks must carry a bounded gate-first contract: observable acceptance, explicit non-goals, and a real pre-edit failure/absence gate. Approval seals that acceptance pack with a stable digest; completion supplies observed baseline evidence without changing the digest, and the exact dependent reviewer inherits it. A conclusive pass binds one bounded terminal receipt to the exact reviewed candidate SHA and acceptance digest; missing proof holds the Flow instead of completing it. When a bounded detail is ambiguous or the user is unsure, choose the least-invasive reversible default, state the assumption, and continue; ask only when the choice would materially expand scope or authority. read_review_file is approval-free pinned-source access. run_review_check executes target-defined code without OS filesystem or network isolation and therefore remains subject to the runtime's normal approval boundary; approvalPolicy=never reviewers must not call it and must report the skipped check."
         }
       ],
       "impact": [
         {"path": "bridge/bridge.mjs", "diffPattern": "submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check"},
         {"path": "bridge/flow-review.mjs"},
+        {"path": "bridge/flow-receipt.mjs"},
         {"path": "bridge/flow-review-gate.mjs"},
         {"path": "bridge/flow-task-graph.mjs"}
       ],
       "evidence": [
         {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_plan'"},
         {"path": "bridge/bridge.mjs", "pattern": "'mark_flow_done'"},
-        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"}
+        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"},
+        {"path": "bridge/flow-task-graph.mjs", "pattern": "acceptancePackDigest"},
+        {"path": "bridge/flow-receipt.mjs", "pattern": "Passing flow review receipt requires an exact candidate and acceptance digest"}
       ]
     },
     {