thinkpool-pair 0.7.364 → 0.7.366

package/flow-assembly.mjs

@@ -1,196 +1 @@
-// Thinkpool Flow — Step 7: assembly + delivery.
-//
-// Lanes each built a DISJOINT slice in its own git worktree (flow-worktree.mjs).
-// Assembly collects those slices into one final app, then delivers it. The MVP
-// artifact ("BLEAK SWORD") is a SINGLE self-contained index.html — no build step,
-// no external assets — but lanes own separate module files (audio.js, sprites.js,
-// combat.js, render.js + an index.html shell that imports them). So assembly must
-// INLINE those modules back into one index.html.
-//
-// Export-destination decision (locked with the spec): a finished Flow ships as a
-// per-Flow git repo (initRepo) + a zip Buffer (zipDir) + an OPTIONAL best-effort
-// GitHub push (pushToGithub). The git repo is the source of truth; zip is the
-// download; GitHub push is opt-in and never blocks delivery.
-//
-// Node built-ins ONLY (fs, path, child_process, zlib) — bridge ships as npm
-// thinkpool-pair with no new deps. Pure over injected fs/git/gh/readFile so the
-// whole step is unit-testable against temp dirs.
-// Spec: docs/specs/2026-06-29-thinkpool-flow.md (Step 7).
-
-import { readFileSync as fsReadFile } from 'node:fs'
-import nodeFs from 'node:fs'
-import path from 'node:path'
-import { execFileSync } from 'node:child_process'
-
-// ── inlineSingleHtml ─────────────────────────────────────────────────────────
-// Read an index.html and fold its LOCAL relative deps into the document:
-//   <script type="module" src="./x.js"> / <script src="./x.js">  → <script>…</script>
-//   <link rel="stylesheet" href="./x.css">                       → <style>…</style>
-// Only local relative refs are inlined; http(s):// and protocol-relative (//) are
-// left alone. readFile is injected for testability.
-//
-// LIMITATION (documented, on purpose): this is NOT a real ES-module bundler — no
-// dependency resolution, no tree-shaking, no scope isolation. If any inlined script
-// uses `import `/`export `, we concatenate ALL module scripts, in document order,
-// into ONE <script type="module"> block. That only works because Flow's single-file
-// artifacts are written to be concatenation-safe (no cross-file import statements
-// between the lanes' own modules — each lane writes a self-contained module; shared
-// symbols are globals on window, not imported). Bare specifiers / npm imports are
-// out of scope for the single-file deliverable.
-export function inlineSingleHtml ({ htmlPath, root, readFile = fsReadFile }) {
-  const baseDir = root || path.dirname(htmlPath)
-  let html = String(readFile(htmlPath, 'utf8'))
-
-  const isLocal = (ref) => ref && !/^[a-z]+:\/\//i.test(ref) && !ref.startsWith('//')
-  // CONTAIN to baseDir — a lane-authored index.html could reference `../../etc/passwd`
-  // or an absolute path; without this the bridge would read arbitrary host files and
-  // inline them into the served preview (path traversal). Mirrors resolveUnderRoot in
-  // flow-preview.mjs: resolve, then reject anything that escapes baseDir. Returns null on
-  // an out-of-root / absolute ref so callers leave the tag untouched (never read it).
-  const resolve = (ref) => {
-    if (!ref || path.isAbsolute(ref)) return null
-    const abs = path.resolve(baseDir, ref.replace(/^\.\//, ''))
-    const rel = path.relative(baseDir, abs)
-    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) return rel === '' ? abs : null
-    return abs
-  }
-
-  // Collected module-script bodies (import/export users) get merged into one block.
-  const moduleBodies = []
-
-  // <link rel="stylesheet" href="…"> → <style>…</style>
-  html = html.replace(
-    /<link\b[^>]*\brel=["']stylesheet["'][^>]*>/gi,
-    (tag) => {
-      const m = tag.match(/\bhref=["']([^"']+)["']/i)
-      if (!m || !isLocal(m[1])) return tag
-      const p = resolve(m[1]); if (!p) return tag   // out-of-root ref → leave the tag as-is
-      const css = String(readFile(p, 'utf8'))
-      return `<style>\n${css}\n</style>`
-    }
-  )
-
-  // <script … src="…"></script> → inline. Module scripts that import/export are
-  // deferred into moduleBodies; everything else inlines in place.
-  html = html.replace(
-    /<script\b([^>]*)\bsrc=["']([^"']+)["']([^>]*)>\s*<\/script>/gi,
-    (tag, pre, src, post) => {
-      if (!isLocal(src)) return tag
-      const p = resolve(src); if (!p) return tag   // out-of-root ref → leave the tag as-is
-      const attrs = `${pre} ${post}`
-      const isModule = /\btype=["']module["']/i.test(attrs)
-      const body = String(readFile(p, 'utf8'))
-      const usesEsm = /(^|[\s;{(])(import|export)\s/.test(body)
-      if (isModule && usesEsm) {
-        moduleBodies.push(`/* inlined: ${src} */\n${body}`)
-        return ''   // collected; emitted as one merged module block below
-      }
-      // Plain script (or module with no import/export): inline directly. Drop
-      // type=module when it carries no ESM syntax — a bare inline module is fine
-      // either way, but stripping keeps the single file maximally portable.
-      return `<script>\n${body}\n</script>`
-    }
-  )
-
-  if (moduleBodies.length) {
-    const merged = `<script type="module">\n${moduleBodies.join('\n')}\n</script>`
-    // Re-attach the merged block where the </body> is (or append if no body tag).
-    if (/<\/body>/i.test(html)) html = html.replace(/<\/body>/i, `${merged}\n</body>`)
-    else html += `\n${merged}\n`
-  }
-
-  return html
-}
-
-// ── mergeWorktrees ───────────────────────────────────────────────────────────
-// Union the files from each lane worktree dir into outDir. Later dirs win on a
-// path conflict (and every conflict is logged). Skips .git, node_modules, .claude.
-// Returns { files, conflicts } — both arrays of outDir-relative paths.
-export function mergeWorktrees ({ dirs, outDir, fs = nodeFs }) {
-  const SKIP = new Set(['.git', 'node_modules', '.claude'])
-  const seen = new Set()
-  const files = []
-  const conflicts = []
-
-  fs.mkdirSync(outDir, { recursive: true })
-
-  const walk = (srcRoot, rel = '') => {
-    const abs = path.join(srcRoot, rel)
-    for (const ent of fs.readdirSync(abs, { withFileTypes: true })) {
-      if (SKIP.has(ent.name)) continue
-      const childRel = rel ? path.join(rel, ent.name) : ent.name
-      if (ent.isDirectory()) {
-        walk(srcRoot, childRel)
-      } else if (ent.isFile()) {
-        const dest = path.join(outDir, childRel)
-        if (seen.has(childRel)) conflicts.push(childRel)
-        else { seen.add(childRel); files.push(childRel) }
-        fs.mkdirSync(path.dirname(dest), { recursive: true })
-        fs.copyFileSync(path.join(srcRoot, childRel), dest)   // later dir wins
-      }
-    }
-  }
-
-  for (const d of dirs) walk(d)
-  return { files, conflicts }
-}
-
-// ── zipDir ───────────────────────────────────────────────────────────────────
-// Produce a zip Buffer of dir. PATH USED: shells out to the system `zip` via
-// child_process (`zip -q -r - .` from inside dir → captured to a Buffer) — robust,
-// produces a standards-compliant archive, no hand-rolled ZIP central directory.
-// We do NOT hand-build a zlib-deflate container: a correct ZIP needs the local
-// headers + central directory + CRC32 + end-of-central-directory record, which is
-// a lot of fiddly bytes to get right for no gain when `zip` is on every dev box.
-// Falls back gracefully — if `zip` is missing, throws a clear, catchable error so
-// callers (and the test) can skip rather than crash the bridge.
-export function zipDir ({ dir }) {
-  try {
-    return execFileSync('zip', ['-q', '-r', '-', '.'], {
-      cwd: dir,
-      maxBuffer: 256 * 1024 * 1024
-    })
-  } catch (err) {
-    if (err && err.code === 'ENOENT') {
-      const e = new Error('zipDir: system `zip` not available')
-      e.code = 'NO_ZIP'
-      throw e
-    }
-    throw err
-  }
-}
-
-// ── initRepo ─────────────────────────────────────────────────────────────────
-// git init + add -A + commit in dir. Injectable git for tests. Returns
-// { committed } — false when there was nothing to commit (empty tree).
-export function initRepo ({ dir, git = runGit }) {
-  git(['init', '-q', '-b', 'main'], dir)
-  git(['add', '-A'], dir)
-  try {
-    git(['commit', '-q', '-m', 'Assembled by Thinkpool Flow'], dir)
-    return { committed: true }
-  } catch {
-    return { committed: false }   // nothing staged / nothing to commit
-  }
-}
-
-// ── pushToGithub ─────────────────────────────────────────────────────────────
-// Best-effort, OPTIONAL. Create a private repo from dir and push via the gh CLI.
-// Never throws — if gh is absent / unauthed / errors, returns { pushed:false,
-// reason } so delivery (repo + zip) still succeeds. Injectable gh for tests.
-export async function pushToGithub ({ dir, repoName, gh = ghCli }) {
-  try {
-    gh(['repo', 'create', repoName, '--private', '--source=.', '--push'], dir)
-    return { pushed: true }
-  } catch (err) {
-    return { pushed: false, reason: err && err.message ? err.message : String(err) }
-  }
-}
-
-// ── injected defaults ─────────────────────────────────────────────────────────
-function runGit (args, cwd) {
-  return execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' })
-}
-function ghCli (args, cwd) {
-  return execFileSync('gh', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' })
-}
+import{readFileSync as t}from"node:fs";import e from"node:fs";import r from"node:path";import{execFileSync as i}from"node:child_process";export function inlineSingleHtml({htmlPath:e,root:i,readFile:n=t}){const o=i||r.dirname(e);let s=String(n(e,"utf8"));const c=t=>t&&!/^[a-z]+:\/\//i.test(t)&&!t.startsWith("//"),p=t=>{if(!t||r.isAbsolute(t))return null;const e=r.resolve(o,t.replace(/^\.\//,"")),i=r.relative(o,e);return""===i||i.startsWith("..")||r.isAbsolute(i)?""===i?e:null:e},u=[];if(s=s.replace(/<link\b[^>]*\brel=["']stylesheet["'][^>]*>/gi,t=>{const e=t.match(/\bhref=["']([^"']+)["']/i);if(!e||!c(e[1]))return t;const r=p(e[1]);return r?`<style>\n${String(n(r,"utf8"))}\n</style>`:t}),s=s.replace(/<script\b([^>]*)\bsrc=["']([^"']+)["']([^>]*)>\s*<\/script>/gi,(t,e,r,i)=>{if(!c(r))return t;const o=p(r);if(!o)return t;const s=/\btype=["']module["']/i.test(`${e} ${i}`),d=String(n(o,"utf8")),l=/(^|[\s;{(])(import|export)\s/.test(d);return s&&l?(u.push(`/* inlined: ${r} */\n${d}`),""):`<script>\n${d}\n<\/script>`}),u.length){const t=`<script type="module">\n${u.join("\n")}\n<\/script>`;/<\/body>/i.test(s)?s=s.replace(/<\/body>/i,`${t}\n</body>`):s+=`\n${t}\n`}return s}export function mergeWorktrees({dirs:t,outDir:i,fs:n=e}){const o=new Set([".git","node_modules",".claude"]),s=new Set,c=[],p=[];n.mkdirSync(i,{recursive:!0});const u=(t,e="")=>{const d=r.join(t,e);for(const l of n.readdirSync(d,{withFileTypes:!0})){if(o.has(l.name))continue;const d=e?r.join(e,l.name):l.name;if(l.isDirectory())u(t,d);else if(l.isFile()){const e=r.join(i,d);s.has(d)?p.push(d):(s.add(d),c.push(d)),n.mkdirSync(r.dirname(e),{recursive:!0}),n.copyFileSync(r.join(t,d),e)}}};for(const e of t)u(e);return{files:c,conflicts:p}}export function zipDir({dir:t}){try{return i("zip",["-q","-r","-","."],{cwd:t,maxBuffer:268435456})}catch(t){if(t&&"ENOENT"===t.code){const t=new Error("zipDir: system `zip` not available");throw t.code="NO_ZIP",t}throw t}}export function initRepo({dir:t,git:e=n}){e(["init","-q","-b","main"],t),e(["add","-A"],t);try{return e(["commit","-q","-m","Assembled by Thinkpool Flow"],t),{committed:!0}}catch{return{committed:!1}}}export async function pushToGithub({dir:t,repoName:e,gh:r=o}){try{return r(["repo","create",e,"--private","--source=.","--push"],t),{pushed:!0}}catch(t){return{pushed:!1,reason:t&&t.message?t.message:String(t)}}}function n(t,e){return i("git",t,{cwd:e,stdio:["ignore","pipe","pipe"],encoding:"utf8"})}function o(t,e){return i("gh",t,{cwd:e,stdio:["ignore","pipe","pipe"],encoding:"utf8"})}

package/flow-budget.mjs

@@ -1,84 +1 @@
-// Thinkpool Flow — autonomy modes' budget cap, kill-switch, and adaptive escalation.
-//
-// Steps 5+6 of the Flow build (docs/specs/2026-06-29-thinkpool-flow.md). Step 5 is
-// the autonomy ladder (Steer / Guide / Autopilot) + adaptive escalation — Autopilot
-// pulls the human back in when a task keeps failing. Step 6 is the HARD budget cap +
-// kill-switch — the run stops BEFORE it overruns, never after. Pure module (no IO,
-// no deps), shared by the bridge (conductor) and the client (room UI), exactly like
-// taskGraph.js — except killSwitchEnv(), the single deliberately-impure fn that reads
-// process.env for the operator override.
-//
-// Enforces spec invariants:
-//   (b) maxHop:1 — lanes never recursively spawn lanes.
-//   (c) Autopilot budget cap is HARD — the kill-switch fires before overrun.
-
-// Concurrency / recursion / escalation limits — mirrored by the dispatcher and the
-// bridge. One source of truth for the numbers the spec locks.
-export const FLOW_LIMITS = {
-  maxConcurrentLanes: 8,   // invariant: ≤8 live Flow lanes at once
-  maxHop: 1,               // invariant (b): no recursive spawning (a lane can't spawn lanes)
-  escalateAfterFails: 2,   // adaptive escalation: pull the human in once failCount hits this
-}
-
-// A budget ledger. capTokens null = uncapped (steer/guide); a number = Autopilot's
-// HARD cap. `killed` latches true once the cap is hit and never flips back.
-export function makeBudget ({ capTokens = null } = {}) {
-  return { capTokens, spentTokens: 0, killed: false }
-}
-
-// Immutable spend update — returns a NEW budget (never mutates). If the cap is set
-// and spend reaches it, `killed` latches true: invariant (c), stop before overrun.
-export function recordSpend (budget, tokens) {
-  const spentTokens = budget.spentTokens + tokens
-  const killed = budget.capTokens != null
-    ? (budget.killed || spentTokens >= budget.capTokens)
-    : budget.killed
-  return { ...budget, spentTokens, killed }
-}
-
-// Has the cap been reached? Uncapped budgets never exceed.
-export function budgetExceeded (budget) {
-  return budget.capTokens != null && budget.spentTokens >= budget.capTokens
-}
-
-// Tokens left before the cap. Uncapped → Infinity. Never negative.
-export function remainingBudget (budget) {
-  if (budget.capTokens == null) return Infinity
-  return Math.max(0, budget.capTokens - budget.spentTokens)
-}
-
-// Gate a dispatch. Lane cap applies in EVERY mode (invariant: ≤8). The budget cap
-// only bites in Autopilot — steer/guide keep a human in the loop, so they ignore the
-// cap (no auto-spend to runaway-protect against). { ok, reason } — reason is '' when ok.
-export function canDispatch ({ mode, liveLanes, budget }) {
-  if (liveLanes >= FLOW_LIMITS.maxConcurrentLanes) {
-    return { ok: false, reason: 'lane cap' }
-  }
-  if (mode === FLOW_MODE_AUTOPILOT && (budget.killed || budgetExceeded(budget))) {
-    return { ok: false, reason: 'budget cap' }
-  }
-  return { ok: true, reason: '' }
-}
-
-// Should this fail surface to the human? In Autopilot the human is OUT of the loop,
-// so we only escalate (auto-pull-human) once a task has failed escalateAfterFails
-// times — adaptive escalation, not on the first hiccup. In guide/steer the human is
-// ALREADY watching, so any fail surfaces immediately — escalation is always true.
-export function shouldEscalate ({ mode, failCount }) {
-  if (mode === FLOW_MODE_AUTOPILOT) return failCount >= FLOW_LIMITS.escalateAfterFails
-  return true
-}
-
-// THE ONLY IMPURE FN — reads process.env for the operator kill-switch / cap override.
-// TP_FLOW_OFF=1 disables Flow dispatch entirely; TP_FLOW_BUDGET_CAP sets the Autopilot
-// token cap from the environment. Kept isolated + flagged so the rest stays pure.
-export function killSwitchEnv () {
-  return {
-    disabled: process.env.TP_FLOW_OFF === '1',
-    capFromEnv: process.env.TP_FLOW_BUDGET_CAP ? Number(process.env.TP_FLOW_BUDGET_CAP) : null,
-  }
-}
-
-// Local mirror of the mode literal (taskGraph.js owns FLOW_MODE; this keeps the
-// budget module dependency-free — it only ever needs the one value).
-const FLOW_MODE_AUTOPILOT = 'autopilot'
+export const FLOW_LIMITS={maxConcurrentLanes:8,maxHop:1,escalateAfterFails:2};export function makeBudget({capTokens:e=null}={}){return{capTokens:e,spentTokens:0,killed:!1}}export function recordSpend(e,n){const o=e.spentTokens+n,t=null!=e.capTokens?e.killed||o>=e.capTokens:e.killed;return{...e,spentTokens:o,killed:t}}export function budgetExceeded(e){return null!=e.capTokens&&e.spentTokens>=e.capTokens}export function remainingBudget(e){return null==e.capTokens?1/0:Math.max(0,e.capTokens-e.spentTokens)}export function canDispatch({mode:n,liveLanes:o,budget:t}){return o>=FLOW_LIMITS.maxConcurrentLanes?{ok:!1,reason:"lane cap"}:n===e&&(t.killed||budgetExceeded(t))?{ok:!1,reason:"budget cap"}:{ok:!0,reason:""}}export function shouldEscalate({mode:n,failCount:o}){return n!==e||o>=FLOW_LIMITS.escalateAfterFails}export function killSwitchEnv(){return{disabled:"1"===process.env.TP_FLOW_OFF,capFromEnv:process.env.TP_FLOW_BUDGET_CAP?Number(process.env.TP_FLOW_BUDGET_CAP):null}}const e="autopilot";

package/flow-conductor.mjs

@@ -1,259 +1 @@
-// Thinkpool Flow — the conductor brain.
-//
-// The conductor is a Claude agent session (run via startClaudeSession with
-// `rolePrompt: FLOW_CONDUCTOR_PROMPT`) whose Step-1 job is to DECOMPOSE a "build me
-// X" prompt into a task-graph of RUNNABLE slices + dependencies, then submit that
-// plan for human approval. It does not build or spawn lanes yet — dispatch is Step 2.
-// The plan lives in the task-graph store (DB), not in the conductor's chat context
-// (research move #1). Spec: docs/specs/2026-06-29-thinkpool-flow.md.
-
-// Bridge-local MIRROR of src/lib/flow/taskGraph.js — NOT a cross-package import.
-// The bridge ships as its own npm package (thinkpool-pair); `../src/...` does not
-// exist in the published tarball, only in a checkout. flow-task-graph.mjs is a
-// byte-identical copy, kept honest by bridge/flow-task-graph.sync.test.js (fails if
-// it drifts from the canonical src module). One logical source, two reachable copies.
-import { FLOW_MODE, FLOW_STATUS, normalizePlanOutput } from './flow-task-graph.mjs'
-
-// S1 (context-offload) — read the conductor's BOUNDED cross-wave context from the durable
-// digest store instead of accumulating full lane transcripts. loadDigest already enforces
-// the hard CEILING (summary + pointers per closed slice, truncated before it grows), so
-// the assembled cross-wave context can never overflow the conductor's head. Consume the
-// store — do NOT re-implement it (canonical src/lib/flow/contextStore.js, mirror here).
-import { loadDigest } from './flow-context-store.mjs'
-// Progressive skill registry (S2). Bridge-local mirror of src/lib/flow/skillRegistry.js
-// (same tarball-boundary reason as flow-task-graph). `manifest()` yields compact
-// METADATA ONLY (name/description/whenToUse — never a SKILL.md body); `loadBody(name)`
-// returns a single body on demand. This wiring injects the manifest into a lane's base
-// prompt and loads a body only when the lane activates that skill. DO NOT edit the
-// registry here — consume it.
-import { manifest as skillManifest, loadBody as skillLoadBody } from './flow-skill-registry.mjs'
-
-// Re-export the shared plan normalizer so bridge callers import Flow pieces from one
-// place. The implementation lives in the shared model (src/lib/flow/taskGraph.js).
-export { normalizePlanOutput }
-
-// Prepended to the room's standard appendSystemPrompt for a Flow conductor session.
-// This prompt IS the moat — decomposition intelligence. Grounded in the Flow research
-// (docs/specs/2026-06-29-thinkpool-flow.md §Research sources): runtime-per-lane is the
-// moat, partition by file ownership, plan-in-store-not-context, right-size the slice
-// count (3 focused beats 7 scattered), explicit acyclic deps.
-export const FLOW_CONDUCTOR_PROMPT = [
-  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. When a detail is ambiguous or the user is unsure, choose the least-invasive reversible default, record that assumption in the summary, and continue. Never ask merely because the user is unsure; ask only when a choice would materially expand scope or authority. User steering always wins. Think, then call submit_flow_plan. That is the whole job.',
-
-  'DO NOT SPAWN SUBAGENTS. You MUST NOT use the Task/Agent tool or launch Explore / sub-agents — every subagent spawn pops a permission card and stalls the whole flow (this is the #1 way the conductor hangs asking for permission). You almost never need to look at code to decompose: decompose from the build request itself. If you genuinely must inspect something first, read it YOURSELF with Read/Grep/Glob (those are allowed without a prompt) — never delegate it to a spawned agent. Decompose, then Write FLOW_PLAN.json.',
-
-  'THINKPOOL FLOW — you are the CONDUCTOR of an ensemble build. Your job RIGHT NOW (Step 1) is to decompose the user\'s build request into a TASK-GRAPH: a set of RUNNABLE slices with explicit dependencies, then submit that plan for human approval. Do NOT start building and do NOT spawn lanes yet — that happens only after the user approves the plan (Step 2+).',
-
-  'DECOMPOSE INTO RUNNABLE SLICES. Each slice must be something ONE lane can build, RUN in its own browser-side WebContainer sandbox, observe, and self-correct INDEPENDENTLY. A slice that cannot run on its own is not a slice — split it or merge it until it is. The runtime (a lane running what it built) is the moat; slices that can\'t run break the whole model.',
-
-  'PARTITION BY FILE OWNERSHIP. Each slice MUST own a disjoint set of files/components — state the exact paths in `scope`. Two lanes editing the same file collide (a branch is NOT isolation when two lanes share a tree). If two slices want the same file, one depends on the other, or you split the file. State ownership precisely.',
-
-  'EXPLICIT ACYCLIC DEPENDENCIES. Every slice lists the keys of slices it depends on. Dependencies must form a DAG. A slice needing another\'s output (an API contract, a shared type, a layout component) depends on it. Minimize coupling — prefer independent slices that build in parallel.',
-
-  'ACCEPTANCE CRITERIA per slice: how does the lane know it is DONE AND RUNNING? A lane is done when its slice runs in its WebContainer and meets the criteria — not when it has merely written code. State the observable, runnable proof (e.g. "GET /api/todos returns 200 + []", "submitting the form adds a row to the list that persists across reload").',
-
-  'GATE-FIRST CONTRACT per builder/fix/scaffold slice: include an explicit bounded `nonGoals` list (what this slice will not change) and a `baseline` gate describing the real pre-edit condition that must FAIL or be ABSENT. The builder must observe that gate before editing and later supply a bounded evidence receipt; do not invent a RED sentence. A review task must depend on exactly one builder/fix task and inherits that target contract — it verifies the same acceptance, non-goals, and baseline evidence instead of inventing a second baseline.',
-
-  'RIGHT-SIZE THE SLICE COUNT. Bias to FEW slices that each carry real weight, not many tiny ones. For a small app: 2-3 slices. Concurrent lanes are bounded (a low dispatch ceiling), so a flat fan-out of well-chosen slices beats a sprawling one. Three focused slices outperform seven scattered ones.',
-
-  'SUBMIT BY WRITING FLOW_PLAN.json — when the decomposition is ready, use the Write tool with file_path "FLOW_PLAN.json" and content set to your plan as ONE JSON object. The room validates the plan is a real DAG (acyclic, all deps resolve), persists it to the task-graph store, and shows a plan-approval card. A malformed plan is rejected with the reason as the tool result — fix it and Write FLOW_PLAN.json again. Do not also narrate the plan in prose. The exact shape:',
-  '{ "summary": "<one line: what we are building; assumptions: …>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "nonGoals": ["<bounded exclusion>"], "baseline": { "gate": "<what currently fails/is absent before edits>", "evidence": "<optional observed command/output receipt>" }, "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',
-  '`key` values are stable short kebab-case identifiers. `deps` references other tasks\' keys. The content of FLOW_PLAN.json must be ONLY the JSON object (no surrounding prose, no markdown fences).',
-
-  'PLAN LIVES IN THE STORE, NOT THE CHAT. Your JSON plan is the artifact — it gets persisted to the task-graph (flow_sessions / flow_tasks) and rendered as an approval card. Do not ALSO narrate a long plan in prose. You may add 1-2 sentences framing the decomposition choice (why these slices, what was coupled), nothing more.',
-
-  'MODE-AWARE. The user picked a mode — steer (watch every lane live), guide (DEFAULT: approve this plan, then review at phase boundaries), or autopilot (full-auto with a budget cap + adaptive escalation that pulls them in only if a lane stalls). Produce the full plan now regardless; the mode changes how much the human intervenes later, not how you decompose.',
-].join(' ')
-
-export const FLOW_CODEX_CONDUCTOR_PROMPT = [
-  'THINKPOOL FLOW CONDUCTOR — you are decomposition-only. Do not build, edit files, run commands, or spawn agents. Read only when needed to make the decomposition concrete.',
-  'Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each builder/fix/scaffold task needs key, title, scope, observable acceptance, bounded nonGoals, and a baseline {gate,evidence?}; the gate states what currently fails or is absent before edits. Every review task depends on exactly ONE builder task and inherits/verifies that builder contract. Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier.',
-  'When details are ambiguous or the user says they are unsure, choose a safe reversible default, record it in summary.assumptions text, and continue. Do not ask merely because of uncertainty; ask only when a choice materially expands scope or authority. Honor later user steering.',
-  'Submit the finished graph by calling the ThinkPool submit_flow_plan MCP tool with one JSON object encoded in its plan argument. Do not write FLOW_PLAN.json and do not use ExitPlanMode. The MCP submission is your only completion path; after it succeeds, stop and wait for the room.',
-].join(' ')
-
-// Env vars handed to a conductor session via startClaudeSession({ env }). The conductor
-// reads these to know which Flow run it owns + what mode the human picked.
-export function buildConductorEnv ({ flowSessionId, mode, budgetCapAutopilot = null }) {
-  return {
-    TP_FLOW_SESSION: flowSessionId,
-    TP_FLOW_MODE: mode,
-    ...(mode === FLOW_MODE.autopilot && budgetCapAutopilot != null
-      ? { TP_FLOW_BUDGET_CAP: String(budgetCapAutopilot) }
-      : {}),
-  }
-}
-
-// Status the FlowSession moves to once the conductor emits + the client validates a
-// plan (i.e. the plan-approval card can now be shown). Kept here so bridge + client
-// import the same transition target.
-export const PLAN_READY_STATUS = FLOW_STATUS.awaiting_approval
-
-// ── Lane builder ────────────────────────────────────────────────────────────
-// The conductor DECOMPOSES; a lane BUILDS one slice. Lanes dispatch after the human
-// approves the plan (Step 2). Each lane runs in its own git worktree (disjoint tree,
-// atomic-revert target). This prompt is the lane's rolePrompt (via startClaudeSession).
-export const FLOW_LANE_PROMPT = [
-  'THINKPOOL FLOW — you are ONE LANE in an ensemble build. The conductor already decomposed the project into RUNNABLE slices; you own exactly ONE. Your task (scope + acceptance + deps) arrives as your first message.',
-
-  'OWN YOUR FILES ONLY. The `scope` names the files/components this lane OWNS — they are DISJOINT from every other lane. Edit ONLY those. Touching another lane\'s files is a collision that breaks the merge — never do it. If you genuinely need a file outside your scope, STOP and say so instead of editing it.',
-
-  'GATE BEFORE EDITS. First reproduce the assigned baseline gate in the real pre-edit state. Record only what you actually observed (a command/behavior + bounded receipt); never fabricate a RED sentence. Preserve the assigned non-goals. If a bounded detail is ambiguous, take the least-invasive reversible default and state it in your receipt; ask only if the choice would materially expand scope or authority.',
-
-  'DONE MEANS RUNS. You are not done when you\'ve written code — you\'re done when your slice RUNS and meets the `acceptance` criteria (the observable, runnable proof). Verify it yourself before declaring done. State the proof (the command, the output) when you finish.',
-
-  'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root with content `{"baselineEvidence":"<real bounded pre-edit command/behavior receipt>"}`. That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, records real baseline evidence, AND is committed.',
-
-  'STAY IN YOUR LANE. Do NOT spawn further lanes (one hop only — the fork-bomb breaker). Do NOT edit other worktrees. If you\'re blocked on a dependency that isn\'t ready, say so + stop — another lane is building it.',
-
-  'BE RIGOROUS, NOT VIBES. Trace the data path, root-cause before fixing, verify before claiming done. A lane that ships a guess costs the whole ensemble.',
-].join(' ')
-
-export const FLOW_CODEX_LANE_PROMPT = [
-  'THINKPOOL FLOW — you are one builder lane in an ensemble. The conductor gives you one runnable slice with disjoint scope. Edit only that scope and never touch another lane or worktree.',
-  'Before editing, reproduce the assigned baseline gate in the real pre-edit state. Preserve the explicit non-goals. Record only an actual bounded command/behavior receipt; never manufacture a RED claim. For a bounded ambiguity, take the least-invasive reversible default and state it in that receipt; ask only if a choice would materially expand scope or authority.',
-  'Done means the slice runs and its acceptance proof has been observed. Diagnose before changing code, verify with the real command or behavior, and make one focused git commit in your assigned worktree. Do not push.',
-  'After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once with the real `baselineEvidence` receipt. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.',
-  'Do not spawn more lanes. If the scope is unsafe or a dependency is missing, report the blocker instead of editing outside your ownership.',
-].join(' ')
-
-// Env vars handed to a lane session so it knows its Flow run + which task it owns.
-export function buildLaneEnv ({ flowSessionId, taskKey, laneId }) {
-  return {
-    TP_FLOW_SESSION: flowSessionId,
-    TP_FLOW_TASK_KEY: taskKey,
-    TP_FLOW_LANE_ID: laneId,
-  }
-}
-
-// ── assembleCrossWaveContext ────────────────────────────────────────────────
-// S1 (context-offload) — the conductor's bounded cross-wave context for a dispatch
-// wave. Reads the durable digest store (loadDigest, which enforces the hard CEILING)
-// and renders the closed-slice digests as a compact block a lane can be seeded with:
-// a one-line summary + artifact pointers per closed slice, NOT full transcripts.
-//
-// Before S1, each newly-dispatched lane was told only the NAMES of the slices it
-// depends on (`DEPENDS ON (already built): a, b`) with no content, and the conductor
-// itself would (across many waves) accumulate full lane output in its chat context —
-// the overflow this slice fixes. Now the ordered digest is the ONLY cross-wave carrier,
-// and its size is capped by loadDigest's CEILING guarantee (JSON.stringify(digest)
-// length ≤ CEILING), so the assembled context is bounded across ≥2 waves by construction.
-//
-// Returns { text, digest } — `text` is the ready-to-embed block (empty string when the
-// flow has no closed slices yet), `digest` is the raw bounded array (for tests/assertions).
-// Pure over an injected fs so it's unit-testable against a temp digest store.
-export function assembleCrossWaveContext (flowId, { baseDir, deps = null, fs } = {}) {
-  if (!flowId || !baseDir) return { text: '', digest: [] }
-  let digest
-  try {
-    digest = loadDigest(flowId, { baseDir, ...(fs ? { fs } : {}) })
-  } catch {
-    // A malformed/absent digest store must never wedge dispatch — degrade to no context.
-    return { text: '', digest: [] }
-  }
-  // If the caller named the current slice's deps, prefer them (so a lane sees its
-  // dependencies first); otherwise show every closed slice. loadDigest already bounds
-  // the whole set under CEILING, so filtering only ever shrinks the block.
-  const wanted = Array.isArray(deps) && deps.length ? new Set(deps) : null
-  const shown = wanted ? digest.filter((d) => wanted.has(d.taskKey)) : digest
-  if (!shown.length) return { text: '', digest }
-  const lines = shown.map((d) => {
-    const ptrs = (d.pointers || [])
-      .map((p) => `${p.name}@${String(p.sha).slice(0, 8)}`)
-      .join(', ')
-    return `  - ${d.summary}${ptrs ? ` [artifacts: ${ptrs}]` : ''}`
-  })
-  const text = `CLOSED SLICES (bounded digest — summary + artifact pointers, not full output):\n${lines.join('\n')}`
-  return { text, digest }
-}
-
-// ── Progressive skill loading (S2) ───────────────────────────────────────────
-// A lane boots knowing only the skill MANIFEST (a tiny menu: name + one-line
-// description + whenToUse) — never the bodies. It pulls a full SKILL.md body in only
-// when it actually activates that skill. This is the DeerFlow steal: metadata in the
-// base prompt, body on demand. The token win (manifest ≪ Σ bodies) is the whole point.
-
-// Resolve the skill directories a Flow lane draws from. publicDir = built-in
-// product-facing skills; customDir = optional user/room-level overrides. Both come from
-// env so the bridge operator can point them at a real skills tree; absent → undefined,
-// which the registry treats as "no skills" (empty manifest, loadBody clean-misses). This
-// is deliberately NOT the .claude/skills dev-side harness — that stays out of scope.
-export function flowSkillDirs (env = process.env) {
-  return {
-    publicDir: env.TP_FLOW_SKILLS_DIR || undefined,
-    customDir: env.TP_FLOW_SKILLS_CUSTOM_DIR || undefined,
-  }
-}
-
-// ── Absolute manifest ceiling (S2 blocker 2) ─────────────────────────────────
-// The token-win invariant (manifest ≪ Σ bodies) is only a RELATIVE ratio — it does
-// nothing to bound the ABSOLUTE size of the manifest block that lands in EVERY lane's
-// base prompt. Custom skills are user/room-uploadable (H1/S6), so a single skill with a
-// pathological description/whenToUse (a 200KB blob) would balloon the base prompt
-// unbounded. These caps give the ceiling teeth: each field is truncated per-entry, and
-// the whole rendered block is hard-capped, with a visible marker where content is cut.
-export const MANIFEST_MAX_CHARS = 4096        // absolute ceiling on the rendered block
-export const MANIFEST_FIELD_MAX = 240         // per-field (description / whenToUse) cap
-const TRUNC_MARK = '…[truncated]'
-
-// Truncate a single metadata field to MANIFEST_FIELD_MAX chars with a visible marker.
-function clampField (s) {
-  const str = typeof s === 'string' ? s : ''
-  if (str.length <= MANIFEST_FIELD_MAX) return str
-  return str.slice(0, MANIFEST_FIELD_MAX - TRUNC_MARK.length) + TRUNC_MARK
-}
-
-// Render the compact manifest as a prompt block — METADATA ONLY. Each entry is one line:
-// the skill name, its one-line description, and (if present) whenToUse. There is NO code
-// path here that can emit a SKILL.md body: this function only ever sees manifest entries
-// (which carry no body), so a body cannot leak into the base prompt through it.
-// Returns '' for an empty manifest so the base prompt is unchanged when no skills exist.
-//
-// ABSOLUTE CEILING: every field is clamped to MANIFEST_FIELD_MAX, and the assembled block
-// is hard-capped at MANIFEST_MAX_CHARS — entries that would push past the ceiling are
-// dropped and a visible marker names how many were omitted. A pathological huge-metadata
-// skill therefore cannot grow the base prompt beyond MANIFEST_MAX_CHARS (+ a small header).
-export function renderSkillManifestBlock (entries) {
-  if (!Array.isArray(entries) || entries.length === 0) return ''
-  const header = [
-    'AVAILABLE SKILLS (menu only — names + descriptions, NOT the instructions). You boot',
-    'knowing this menu; you do NOT carry any skill\'s full instructions. When a task matches',
-    'a skill (or you invoke it slash-style), the room loads that ONE skill\'s full body for',
-    'you on demand — never all of them, never up front. The menu:',
-  ].join('\n')
-
-  const rendered = []
-  let used = header.length
-  let dropped = 0
-  for (const e of entries) {
-    const when = e.whenToUse ? ` — use when: ${clampField(e.whenToUse)}` : ''
-    const line = `  • ${e.name}: ${clampField(e.description)}${when}`
-    // +1 for the '\n' joining this line to what precedes it.
-    if (used + 1 + line.length > MANIFEST_MAX_CHARS) { dropped++; continue }
-    rendered.push(line)
-    used += 1 + line.length
-  }
-  if (dropped > 0) {
-    rendered.push(`  …[${dropped} more skill(s) omitted — manifest ceiling reached]`)
-  }
-  return [header, ...rendered].join('\n')
-}
-
-// Build a lane's base prompt: the static FLOW_LANE_PROMPT (or FLOW_REVIEWER-style base
-// passed in) PLUS the skill MANIFEST block — metadata only, never bodies. This is what a
-// lane session boots with. The token win vs. inlining bodies is asserted in tests.
-// dirs/fs are injectable for unit-testing against temp fixtures; default to env dirs.
-export function buildLanePrompt ({ base = FLOW_LANE_PROMPT, publicDir, customDir, fs } = {}) {
-  const dirs = publicDir === undefined && customDir === undefined ? flowSkillDirs() : { publicDir, customDir }
-  const entries = skillManifest({ ...dirs, ...(fs ? { fs } : {}) })
-  const block = renderSkillManifestBlock(entries)
-  return block ? `${base}\n\n${block}` : base
-}
-
-// Load exactly ONE skill's full body, on demand, when a lane activates it. Returns the
-// SKILL.md body string, or null on a clean miss (unknown / disabled skill — never a
-// throw). Callers inject this into the lane mid-task; it is never part of the base prompt.
-export function activateLaneSkill (name, { publicDir, customDir, fs } = {}) {
-  const dirs = publicDir === undefined && customDir === undefined ? flowSkillDirs() : { publicDir, customDir }
-  return skillLoadBody(name, { ...dirs, ...(fs ? { fs } : {}) })
-}
+import{FLOW_MODE as e,FLOW_STATUS as t,normalizePlanOutput as o}from"./flow-task-graph.mjs";import{loadDigest as n}from"./flow-context-store.mjs";import{manifest as s,loadBody as i}from"./flow-skill-registry.mjs";export{o as normalizePlanOutput};export const FLOW_CONDUCTOR_PROMPT=["THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are a DECOMPOSITION-ONLY conductor. Your ONLY output action is using the Write tool ONCE to write your task-graph JSON to the file named exactly FLOW_PLAN.json. That single Write IS how you submit your plan — the room ingests it directly. Do NOT use ExitPlanMode and do NOT call submit_flow_plan (both hang here). Do NOT write any other file and do NOT write a plan-document markdown. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — those are blocked and will just stall you. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. When a detail is ambiguous or the user is unsure, choose the least-invasive reversible default, record that assumption in the summary, and continue. Never ask merely because the user is unsure; ask only when a choice would materially expand scope or authority. User steering always wins. Think, then call submit_flow_plan. That is the whole job.","DO NOT SPAWN SUBAGENTS. You MUST NOT use the Task/Agent tool or launch Explore / sub-agents — every subagent spawn pops a permission card and stalls the whole flow (this is the #1 way the conductor hangs asking for permission). You almost never need to look at code to decompose: decompose from the build request itself. If you genuinely must inspect something first, read it YOURSELF with Read/Grep/Glob (those are allowed without a prompt) — never delegate it to a spawned agent. Decompose, then Write FLOW_PLAN.json.","THINKPOOL FLOW — you are the CONDUCTOR of an ensemble build. Your job RIGHT NOW (Step 1) is to decompose the user's build request into a TASK-GRAPH: a set of RUNNABLE slices with explicit dependencies, then submit that plan for human approval. Do NOT start building and do NOT spawn lanes yet — that happens only after the user approves the plan (Step 2+).","DECOMPOSE INTO RUNNABLE SLICES. Each slice must be something ONE lane can build, RUN in its own browser-side WebContainer sandbox, observe, and self-correct INDEPENDENTLY. A slice that cannot run on its own is not a slice — split it or merge it until it is. The runtime (a lane running what it built) is the moat; slices that can't run break the whole model.","PARTITION BY FILE OWNERSHIP. Each slice MUST own a disjoint set of files/components — state the exact paths in `scope`. Two lanes editing the same file collide (a branch is NOT isolation when two lanes share a tree). If two slices want the same file, one depends on the other, or you split the file. State ownership precisely.","EXPLICIT ACYCLIC DEPENDENCIES. Every slice lists the keys of slices it depends on. Dependencies must form a DAG. A slice needing another's output (an API contract, a shared type, a layout component) depends on it. Minimize coupling — prefer independent slices that build in parallel.",'ACCEPTANCE CRITERIA per slice: how does the lane know it is DONE AND RUNNING? A lane is done when its slice runs in its WebContainer and meets the criteria — not when it has merely written code. State the observable, runnable proof (e.g. "GET /api/todos returns 200 + []", "submitting the form adds a row to the list that persists across reload").',"GATE-FIRST CONTRACT per builder/fix/scaffold slice: include an explicit bounded `nonGoals` list (what this slice will not change) and a `baseline` gate describing the real pre-edit condition that must FAIL or be ABSENT. The builder must observe that gate before editing and later supply a bounded evidence receipt; do not invent a RED sentence. A review task must depend on exactly one builder/fix task and inherits that target contract — it verifies the same acceptance, non-goals, and baseline evidence instead of inventing a second baseline.","RIGHT-SIZE THE SLICE COUNT. Bias to FEW slices that each carry real weight, not many tiny ones. For a small app: 2-3 slices. Concurrent lanes are bounded (a low dispatch ceiling), so a flat fan-out of well-chosen slices beats a sprawling one. Three focused slices outperform seven scattered ones.",'SUBMIT BY WRITING FLOW_PLAN.json — when the decomposition is ready, use the Write tool with file_path "FLOW_PLAN.json" and content set to your plan as ONE JSON object. The room validates the plan is a real DAG (acyclic, all deps resolve), persists it to the task-graph store, and shows a plan-approval card. A malformed plan is rejected with the reason as the tool result — fix it and Write FLOW_PLAN.json again. Do not also narrate the plan in prose. The exact shape:','{ "summary": "<one line: what we are building; assumptions: …>", "tasks": [ { "key": "<short-unique-kebab-key>", "title": "<imperative title>", "scope": "<files/components this lane owns>", "acceptance": "<runnable proof it is done>", "nonGoals": ["<bounded exclusion>"], "baseline": { "gate": "<what currently fails/is absent before edits>", "evidence": "<optional observed command/output receipt>" }, "deps": ["<other-task-key>", ...], "sliceType": "feature|scaffold|review|fix" } ] }',"`key` values are stable short kebab-case identifiers. `deps` references other tasks' keys. The content of FLOW_PLAN.json must be ONLY the JSON object (no surrounding prose, no markdown fences).","PLAN LIVES IN THE STORE, NOT THE CHAT. Your JSON plan is the artifact — it gets persisted to the task-graph (flow_sessions / flow_tasks) and rendered as an approval card. Do not ALSO narrate a long plan in prose. You may add 1-2 sentences framing the decomposition choice (why these slices, what was coupled), nothing more.","MODE-AWARE. The user picked a mode — steer (watch every lane live), guide (DEFAULT: approve this plan, then review at phase boundaries), or autopilot (full-auto with a budget cap + adaptive escalation that pulls them in only if a lane stalls). Produce the full plan now regardless; the mode changes how much the human intervenes later, not how you decompose."].join(" ");export const FLOW_CODEX_CONDUCTOR_PROMPT=["THINKPOOL FLOW CONDUCTOR — you are decomposition-only. Do not build, edit files, run commands, or spawn agents. Read only when needed to make the decomposition concrete.","Turn the request into a small acyclic graph of independently runnable slices with disjoint file ownership. Each builder/fix/scaffold task needs key, title, scope, observable acceptance, bounded nonGoals, and a baseline {gate,evidence?}; the gate states what currently fails or is absent before edits. Every review task depends on exactly ONE builder task and inherits/verifies that builder contract. Review is intelligence-sensitive and must never be assigned a cheap/mechanical tier.","When details are ambiguous or the user says they are unsure, choose a safe reversible default, record it in summary.assumptions text, and continue. Do not ask merely because of uncertainty; ask only when a choice materially expands scope or authority. Honor later user steering.","Submit the finished graph by calling the ThinkPool submit_flow_plan MCP tool with one JSON object encoded in its plan argument. Do not write FLOW_PLAN.json and do not use ExitPlanMode. The MCP submission is your only completion path; after it succeeds, stop and wait for the room."].join(" ");export function buildConductorEnv({flowSessionId:t,mode:o,budgetCapAutopilot:n=null}){return{TP_FLOW_SESSION:t,TP_FLOW_MODE:o,...o===e.autopilot&&null!=n?{TP_FLOW_BUDGET_CAP:String(n)}:{}}}export const PLAN_READY_STATUS=t.awaiting_approval;export const FLOW_LANE_PROMPT=["THINKPOOL FLOW — you are ONE LANE in an ensemble build. The conductor already decomposed the project into RUNNABLE slices; you own exactly ONE. Your task (scope + acceptance + deps) arrives as your first message.","OWN YOUR FILES ONLY. The `scope` names the files/components this lane OWNS — they are DISJOINT from every other lane. Edit ONLY those. Touching another lane's files is a collision that breaks the merge — never do it. If you genuinely need a file outside your scope, STOP and say so instead of editing it.","GATE BEFORE EDITS. First reproduce the assigned baseline gate in the real pre-edit state. Record only what you actually observed (a command/behavior + bounded receipt); never fabricate a RED sentence. Preserve the assigned non-goals. If a bounded detail is ambiguous, take the least-invasive reversible default and state it in your receipt; ask only if the choice would materially expand scope or authority.","DONE MEANS RUNS. You are not done when you've written code — you're done when your slice RUNS and meets the `acceptance` criteria (the observable, runnable proof). Verify it yourself before declaring done. State the proof (the command, the output) when you finish.",'COMMIT WHEN DONE, THEN SIGNAL. You are in your own git worktree on your own branch. When your slice meets acceptance — it RUNS and you have verified the proof — commit it atomically (one focused commit) with `git` via the Bash tool; that commit is the revert target if review later rejects it. THEN, as your VERY LAST action, signal completion by using the Write tool to write a file named exactly FLOW_DONE in your worktree root with content `{"baselineEvidence":"<real bounded pre-edit command/behavior receipt>"}`. That single Write IS the done signal — it records your commit + tells the room the slice is done (unblocking dependents). Do NOT use mark_flow_done (it hangs here). Do not push. Do NOT write FLOW_DONE before your slice actually runs, meets acceptance, records real baseline evidence, AND is committed.',"STAY IN YOUR LANE. Do NOT spawn further lanes (one hop only — the fork-bomb breaker). Do NOT edit other worktrees. If you're blocked on a dependency that isn't ready, say so + stop — another lane is building it.","BE RIGOROUS, NOT VIBES. Trace the data path, root-cause before fixing, verify before claiming done. A lane that ships a guess costs the whole ensemble."].join(" ");export const FLOW_CODEX_LANE_PROMPT=["THINKPOOL FLOW — you are one builder lane in an ensemble. The conductor gives you one runnable slice with disjoint scope. Edit only that scope and never touch another lane or worktree.","Before editing, reproduce the assigned baseline gate in the real pre-edit state. Preserve the explicit non-goals. Record only an actual bounded command/behavior receipt; never manufacture a RED claim. For a bounded ambiguity, take the least-invasive reversible default and state it in that receipt; ask only if a choice would materially expand scope or authority.","Done means the slice runs and its acceptance proof has been observed. Diagnose before changing code, verify with the real command or behavior, and make one focused git commit in your assigned worktree. Do not push.","After the commit and verification succeed, call the ThinkPool mark_flow_done MCP tool exactly once with the real `baselineEvidence` receipt. Do not write FLOW_DONE. The MCP call is the completion signal that records your commit and unblocks dependent slices.","Do not spawn more lanes. If the scope is unsafe or a dependency is missing, report the blocker instead of editing outside your ownership."].join(" ");export function buildLaneEnv({flowSessionId:e,taskKey:t,laneId:o}){return{TP_FLOW_SESSION:e,TP_FLOW_TASK_KEY:t,TP_FLOW_LANE_ID:o}}export function assembleCrossWaveContext(e,{baseDir:t,deps:o=null,fs:s}={}){if(!e||!t)return{text:"",digest:[]};let i;try{i=n(e,{baseDir:t,...s?{fs:s}:{}})}catch{return{text:"",digest:[]}}const a=Array.isArray(o)&&o.length?new Set(o):null,r=a?i.filter(e=>a.has(e.taskKey)):i;return r.length?{text:`CLOSED SLICES (bounded digest — summary + artifact pointers, not full output):\n${r.map(e=>{const t=(e.pointers||[]).map(e=>`${e.name}@${String(e.sha).slice(0,8)}`).join(", ");return`  - ${e.summary}${t?` [artifacts: ${t}]`:""}`}).join("\n")}`,digest:i}:{text:"",digest:i}}export function flowSkillDirs(e=process.env){return{publicDir:e.TP_FLOW_SKILLS_DIR||void 0,customDir:e.TP_FLOW_SKILLS_CUSTOM_DIR||void 0}}export const MANIFEST_MAX_CHARS=4096;export const MANIFEST_FIELD_MAX=240;function a(e){const t="string"==typeof e?e:"";return t.length<=240?t:t.slice(0,228)+"…[truncated]"}export function renderSkillManifestBlock(e){if(!Array.isArray(e)||0===e.length)return"";const t=["AVAILABLE SKILLS (menu only — names + descriptions, NOT the instructions). You boot","knowing this menu; you do NOT carry any skill's full instructions. When a task matches","a skill (or you invoke it slash-style), the room loads that ONE skill's full body for","you on demand — never all of them, never up front. The menu:"].join("\n"),o=[];let n=t.length,s=0;for(const t of e){const e=t.whenToUse?` — use when: ${a(t.whenToUse)}`:"",i=`  • ${t.name}: ${a(t.description)}${e}`;n+1+i.length>4096?s++:(o.push(i),n+=1+i.length)}return s>0&&o.push(`  …[${s} more skill(s) omitted — manifest ceiling reached]`),[t,...o].join("\n")}export function buildLanePrompt({base:e=FLOW_LANE_PROMPT,publicDir:t,customDir:o,fs:n}={}){const i=void 0===t&&void 0===o?flowSkillDirs():{publicDir:t,customDir:o},a=renderSkillManifestBlock(s({...i,...n?{fs:n}:{}}));return a?`${e}\n\n${a}`:e}export function activateLaneSkill(e,{publicDir:t,customDir:o,fs:n}={}){const s=void 0===t&&void 0===o?flowSkillDirs():{publicDir:t,customDir:o};return i(e,{...s,...n?{fs:n}:{}})}