thinkpool-pair 0.7.364 → 0.7.366

package/flow-review.mjs

@@ -1,152 +1 @@
-// Thinkpool Flow — Step 4: adversarial review + per-lane atomic revert.
-//
-// After a lane commits its slice (commit_sha on flow_tasks = the revert target), an
-// ADVERSARIAL reviewer lane tries to BREAK it: run it, find where acceptance isn't
-// actually met, find regressions/edge cases. Its verdict drives the gate — accept iff
-// every reviewer passed; any fail → revert THIS lane only. The atomic-revert invariant:
-// one lane rolls back (its worktree + branch gone) without touching any other lane's
-// work (disjoint worktrees, M57). Spec: docs/specs/2026-06-29-thinkpool-flow.md (Step 4).
-//
-// Pure over injected git/removeWorktree so it's unit-testable against a temp repo.
-
-import { execFileSync } from 'node:child_process'
-import { TASK_STATUS } from './flow-task-graph.mjs'
-import { removeFlowWorktree } from './flow-worktree.mjs'
-import { reviewReflectionDecision, REVIEW_DEFAULTS } from './flow-review-reflect.mjs'
-
-// The reviewer lane's rolePrompt (via startClaudeSession). Mirrors FLOW_LANE_PROMPT's
-// join('  ') style. This lane is ADVERSARIAL — its job is to disprove "done", not to build.
-export const FLOW_REVIEWER_PROMPT = [
-  'THINKPOOL FLOW — you are an ADVERSARIAL REVIEWER in an ensemble build. You did NOT build this slice. Another lane did, and claims it is done. Your job is to TRY TO BREAK IT — independently verify whether its acceptance criteria are ACTUALLY met. The slice you are reviewing (its scope, acceptance criteria, inherited non-goals, baseline gate/evidence, and worktree/branch) arrives as your first message.',
-
-  'RUN IT, DON\'T TRUST IT. Check out the lane\'s worktree/branch and RUN the slice yourself. "It compiles" is not "it works". Reproduce the acceptance proof with your own hands — run the command, hit the endpoint, submit the form, reload the page. If you cannot independently reproduce the acceptance criteria, that is a REJECT.',
-
-  'VERIFY THE INHERITED CONTRACT. Check the builder\'s baseline receipt against the real pre-edit claim where feasible; it must be an observed command/behavior, not a fabricated sentence. Check the implementation did not cross its inherited non-goals. Do not invent another baseline. HUNT FOR FAILURE: edge cases, empty/malformed input, the second click, the reload, concurrent use, and the error path. A green happy-path is the floor, not the bar.',
-
-  'DEFAULT TO REJECT. If you cannot independently verify EVERY acceptance criterion — reject. Ambiguity, "probably fine", "looks right", an untestable claim, a flaky run — all REJECT. The cost of a false pass (a broken slice merged into the assembly) is far higher than a re-run.',
-
-  'BE SPECIFIC. Your reasons must name exactly WHAT failed and HOW you found it — the command you ran, the output you got, the acceptance criterion it violated. "Doesn\'t work" is useless. "GET /api/todos returned 500 with `column todos.user_id does not exist`; acceptance required 200 + []" is a usable verdict.',
-
-  'YOU GET BOUNDED HUNT ROUNDS, NOT ONE GLANCE. You may be asked to dig again — up to a hard ceiling of rounds. A green happy-path on round 1 is NOT a pass; use the next round to hunt harder (edge cases, the reload, the second click, concurrent use, the error path). You only stop early two ways: you reproduce a concrete FAILURE (emit pass:false — that ends it, the slice reverts), OR you have genuinely EXHAUSTED your checks and found nothing (emit pass:true AND exhausted:true — that ends it, the slice passes). If you still have angles left to try, emit pass:true and leave exhausted false/absent — you will be asked to dig one more round until the ceiling, at which point the inconclusive result is handed to the two humans to decide (never an unbounded self-loop).',
-
-  'EMIT YOUR VERDICT BY WRITING FLOW_REVIEW.json. Do NOT call mark_flow_done or ExitPlanMode (they hang here). As your LAST action, use the Write tool with file_path "FLOW_REVIEW.json" and content = a single JSON object { "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>", "exhausted": <boolean, optional — true only when you have nothing left to check> }. `pass: false` reverts the reviewed slice so it rebuilds. The content of FLOW_REVIEW.json must be ONLY that JSON object (no prose, no markdown fences). Do not edit the slice — you review, you do not fix.',
-].join('  ')
-
-export const FLOW_CODEX_REVIEWER_PROMPT = [
-  'THINKPOOL FLOW REVIEW — you are a non-mutating adversarial reviewer. Your native sandbox lets you write only inside your OWN disposable reviewer worktree. The reviewed builder worktree is outside that writable root: never edit, commit, revert, install into, or repair it.',
-  'For any install/build/test that produces files, copy the reviewed source into a scratch directory under your own current worktree first, then run the write-producing command against that scratch copy. Read-only inspection may target the reviewed worktree directly.',
-  'Independently reproduce every acceptance criterion, verify the inherited baseline evidence and non-goals without inventing a second baseline, and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.',
-  'Submit each review round by calling the ThinkPool submit_flow_review MCP tool with a JSON verdict: {"pass":boolean,"reasons":["specific evidence"],"taskKey":"allowed reviewed task","exhausted":boolean}. Do not write FLOW_REVIEW.json and do not call mark_flow_done. A pass without exhausted=true may trigger another bounded hunt round; a failure triggers the room revert path.',
-].join(' ')
-
-// Parse a reviewer's raw verdict. Accepts an object OR a JSON string (optionally
-// ```json-fenced). Tolerant of the fence the model sometimes wraps; throws on garbage.
-// Returns { pass, reasons } — pass coerced to boolean, reasons normalized to string[].
-export function parseReviewVerdict (raw) {
-  let obj = raw
-  if (typeof raw === 'string') {
-    let s = raw.trim()
-    const fence = s.match(/```(?:json)?\s*([\s\S]*?)```/i)
-    if (fence) s = fence[1].trim()
-    obj = JSON.parse(s) // throws on unparseable
-  }
-  if (!obj || typeof obj !== 'object') throw new Error('review verdict is not an object')
-  if (typeof obj.pass !== 'boolean') throw new Error('review verdict missing boolean `pass`')
-  const reasons = Array.isArray(obj.reasons) ? obj.reasons.map(String) : []
-  // E1 (bounded self-test): `exhausted` is an OPTIONAL third signal — true only when the
-  // reviewer reports it has nothing left to check. Absent/non-boolean → false (keep hunting
-  // until the round ceiling). Never throws on its absence; it's additive to the old contract.
-  const exhausted = obj.exhausted === true
-  return { pass: obj.pass, reasons, exhausted }
-}
-
-// E1 — map a parsed review verdict into the two governor inputs. A concrete FAILURE
-// (pass:false) is a reproduced break → foundFailure. A pass is only conclusive when the
-// reviewer says it EXHAUSTED its checks; a bare pass:true means "happy path held, more to
-// hunt" → keep going until the round ceiling. Pure; the seam the loop drives on.
-export function reviewVerdictToReflection (verdict) {
-  const v = verdict || {}
-  return {
-    foundFailure: v.pass === false,
-    exhausted: v.pass === true && v.exhausted === true,
-  }
-}
-
-// E1+A1/A2 — the BOUNDED reviewer loop. Drives the adversarial reviewer across up to
-// `maxRounds` hunt rounds, consulting reviewReflectionDecision between rounds, and stops at
-// the FIRST terminal outcome (reject on a concrete failure, pass on exhaustion, or SURFACE
-// when a ceiling — rounds or budget — is hit inconclusively). Pure over two injected effects
-// so it's unit-testable without a live Flow room (the S5 split):
-//   • runRound(round)  → Promise<parsed verdict {pass,reasons,exhausted}> — spend one round
-//   • getSpent()       → number — the review lane's tokens spent so far (flow-budget ledger)
-// N1 fail-closed: the budget is checked BEFORE each round is spent, so a review lane at/over
-// its cap SURFACES without ever spending the next round (never runs the bill up, anti-Emergent).
-// Returns { action, surfaceToPair, reason, rounds, verdict } — `rounds` = rounds actually run.
-export async function runBoundedReview ({ maxRounds, budgetCap = null, getSpent = () => 0, runRound }) {
-  if (typeof runRound !== 'function') throw new Error('runBoundedReview needs a runRound(round) function')
-  const cap = Number.isFinite(maxRounds) && maxRounds > 0 ? maxRounds : REVIEW_DEFAULTS.maxRounds
-  const capped = budgetCap != null && Number.isFinite(budgetCap)
-  for (let round = 1; ; round++) {
-    // N1 fail-closed pre-gate: never SPEND another review round once the cap is reached.
-    const spentBefore = getSpent()
-    if (capped && spentBefore >= budgetCap) {
-      const d = reviewReflectionDecision({
-        round, maxRounds: cap, spentTokens: spentBefore, budgetCap,
-        foundFailure: false, exhausted: false,
-      })
-      return { ...d, rounds: round - 1, verdict: null }
-    }
-    const verdict = await runRound(round)
-    const decision = reviewReflectionDecision({
-      round, maxRounds: cap, spentTokens: getSpent(), budgetCap,
-      ...reviewVerdictToReflection(verdict),
-    })
-    if (decision.stop) return { ...decision, rounds: round, verdict }
-    // else action==='continue' — under both ceilings, not yet concluded → dig another round.
-  }
-}
-
-// Gate decision over a task's verdicts (≥1 reviewer). Accept iff EVERY verdict passes;
-// any fail → mustRevert. reasons collects the failing verdicts' reasons (the why).
-export function reviewDecision ({ verdicts }) {
-  const list = Array.isArray(verdicts) ? verdicts : []
-  if (list.length === 0) {
-    // No reviewer ran — cannot independently verify, so default to reject (the prompt's stance).
-    return { accept: false, mustRevert: true, reasons: ['no review verdict produced'] }
-  }
-  const accept = list.every(v => v.pass === true)
-  const reasons = list.filter(v => !v.pass).flatMap(v => Array.isArray(v.reasons) ? v.reasons : [])
-  return { accept, mustRevert: !accept, reasons }
-}
-
-// Atomic per-lane revert: tear down ONE lane's worktree + branch, nothing else.
-// Delegates to the injected removeWorktree (defaults to removeFlowWorktree). Best-effort
-// — never throws on an already-gone worktree/branch. Returns { reverted, branch }.
-export function revertLane ({ flowId, taskKey, root, git = defaultGit, removeWorktree = removeFlowWorktree }) {
-  const { branch } = worktreeBranch({ flowId, taskKey, root })
-  try {
-    removeWorktree({ flowId, taskKey, root, git })
-  } catch { /* best-effort: worktree/branch already gone */ }
-  return { reverted: true, branch }
-}
-
-// Status a task moves to after the review gate resolves.
-export function nextTaskStatusAfterReview ({ accept }) {
-  return accept ? TASK_STATUS.done : TASK_STATUS.reverted
-}
-
-// ── internals ───────────────────────────────────────────────────────────────
-// Resolve the lane's branch name without importing worktreeSpec's full surface here;
-// keeps revertLane's return honest even when the injected removeWorktree is a spy.
-function worktreeBranch ({ flowId, taskKey, root }) {
-  const short = String(flowId).replace(/-/g, '').slice(0, 8)
-  const safeKey = String(taskKey).toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 40).replace(/^-+|-+$/g, '') || 'task'
-  void root
-  return { branch: `flow/${short}/${safeKey}` }
-}
-
-// Default git runner mirrors flow-worktree's — only used if a caller passes neither
-// git nor a custom removeWorktree (the real removeFlowWorktree supplies its own default).
-function defaultGit (args, cwd) {
-  return execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' })
-}
+import{execFileSync as e}from"node:child_process";import{TASK_STATUS as t}from"./flow-task-graph.mjs";import{removeFlowWorktree as o}from"./flow-worktree.mjs";import{reviewReflectionDecision as r,REVIEW_DEFAULTS as n}from"./flow-review-reflect.mjs";export const FLOW_REVIEWER_PROMPT=["THINKPOOL FLOW — you are an ADVERSARIAL REVIEWER in an ensemble build. You did NOT build this slice. Another lane did, and claims it is done. Your job is to TRY TO BREAK IT — independently verify whether its acceptance criteria are ACTUALLY met. The slice you are reviewing (its scope, acceptance criteria, inherited non-goals, baseline gate/evidence, and worktree/branch) arrives as your first message.",'RUN IT, DON\'T TRUST IT. Check out the lane\'s worktree/branch and RUN the slice yourself. "It compiles" is not "it works". Reproduce the acceptance proof with your own hands — run the command, hit the endpoint, submit the form, reload the page. If you cannot independently reproduce the acceptance criteria, that is a REJECT.',"VERIFY THE INHERITED CONTRACT. Check the builder's baseline receipt against the real pre-edit claim where feasible; it must be an observed command/behavior, not a fabricated sentence. Check the implementation did not cross its inherited non-goals. Do not invent another baseline. HUNT FOR FAILURE: edge cases, empty/malformed input, the second click, the reload, concurrent use, and the error path. A green happy-path is the floor, not the bar.",'DEFAULT TO REJECT. If you cannot independently verify EVERY acceptance criterion — reject. Ambiguity, "probably fine", "looks right", an untestable claim, a flaky run — all REJECT. The cost of a false pass (a broken slice merged into the assembly) is far higher than a re-run.','BE SPECIFIC. Your reasons must name exactly WHAT failed and HOW you found it — the command you ran, the output you got, the acceptance criterion it violated. "Doesn\'t work" is useless. "GET /api/todos returned 500 with `column todos.user_id does not exist`; acceptance required 200 + []" is a usable verdict.',"YOU GET BOUNDED HUNT ROUNDS, NOT ONE GLANCE. You may be asked to dig again — up to a hard ceiling of rounds. A green happy-path on round 1 is NOT a pass; use the next round to hunt harder (edge cases, the reload, the second click, concurrent use, the error path). You only stop early two ways: you reproduce a concrete FAILURE (emit pass:false — that ends it, the slice reverts), OR you have genuinely EXHAUSTED your checks and found nothing (emit pass:true AND exhausted:true — that ends it, the slice passes). If you still have angles left to try, emit pass:true and leave exhausted false/absent — you will be asked to dig one more round until the ceiling, at which point the inconclusive result is handed to the two humans to decide (never an unbounded self-loop).",'EMIT YOUR VERDICT BY WRITING FLOW_REVIEW.json. Do NOT call mark_flow_done or ExitPlanMode (they hang here). As your LAST action, use the Write tool with file_path "FLOW_REVIEW.json" and content = a single JSON object { "pass": <boolean>, "reasons": ["<specific finding>", ...], "taskKey": "<the slice you reviewed>", "exhausted": <boolean, optional — true only when you have nothing left to check> }. `pass: false` reverts the reviewed slice so it rebuilds. The content of FLOW_REVIEW.json must be ONLY that JSON object (no prose, no markdown fences). Do not edit the slice — you review, you do not fix.'].join("  ");export const FLOW_CODEX_REVIEWER_PROMPT=["THINKPOOL FLOW REVIEW — you are a non-mutating adversarial reviewer. Your native sandbox lets you write only inside your OWN disposable reviewer worktree. The reviewed builder worktree is outside that writable root: never edit, commit, revert, install into, or repair it.","For any install/build/test that produces files, copy the reviewed source into a scratch directory under your own current worktree first, then run the write-producing command against that scratch copy. Read-only inspection may target the reviewed worktree directly.","Independently reproduce every acceptance criterion, verify the inherited baseline evidence and non-goals without inventing a second baseline, and hunt edge cases, reloads, repeated actions, concurrency, malformed input, and error paths. A green happy path is only the floor. If a claim cannot be reproduced, reject it with the exact command/output.",'Submit each review round by calling the ThinkPool submit_flow_review MCP tool with a JSON verdict: {"pass":boolean,"reasons":["specific evidence"],"taskKey":"allowed reviewed task","exhausted":boolean}. Do not write FLOW_REVIEW.json and do not call mark_flow_done. A pass without exhausted=true may trigger another bounded hunt round; a failure triggers the room revert path.'].join(" ");export function parseReviewVerdict(e){let t=e;if("string"==typeof e){let o=e.trim();const r=o.match(/```(?:json)?\s*([\s\S]*?)```/i);r&&(o=r[1].trim()),t=JSON.parse(o)}if(!t||"object"!=typeof t)throw new Error("review verdict is not an object");if("boolean"!=typeof t.pass)throw new Error("review verdict missing boolean `pass`");const o=Array.isArray(t.reasons)?t.reasons.map(String):[],r=!0===t.exhausted;return{pass:t.pass,reasons:o,exhausted:r}}export function reviewVerdictToReflection(e){const t=e||{};return{foundFailure:!1===t.pass,exhausted:!0===t.pass&&!0===t.exhausted}}export async function runBoundedReview({maxRounds:e,budgetCap:t=null,getSpent:o=()=>0,runRound:a}){if("function"!=typeof a)throw new Error("runBoundedReview needs a runRound(round) function");const i=Number.isFinite(e)&&e>0?e:n.maxRounds,s=null!=t&&Number.isFinite(t);for(let e=1;;e++){const n=o();if(s&&n>=t)return{...r({round:e,maxRounds:i,spentTokens:n,budgetCap:t,foundFailure:!1,exhausted:!1}),rounds:e-1,verdict:null};const c=await a(e),d=r({round:e,maxRounds:i,spentTokens:o(),budgetCap:t,...reviewVerdictToReflection(c)});if(d.stop)return{...d,rounds:e,verdict:c}}}export function reviewDecision({verdicts:e}){const t=Array.isArray(e)?e:[];if(0===t.length)return{accept:!1,mustRevert:!0,reasons:["no review verdict produced"]};const o=t.every(e=>!0===e.pass);return{accept:o,mustRevert:!o,reasons:t.filter(e=>!e.pass).flatMap(e=>Array.isArray(e.reasons)?e.reasons:[])}}export function revertLane({flowId:e,taskKey:t,root:r,git:n=a,removeWorktree:i=o}){const{branch:s}=function({flowId:e,taskKey:t,root:o}){return{branch:`flow/${String(e).replace(/-/g,"").slice(0,8)}/${String(t).toLowerCase().replace(/[^a-z0-9-]/g,"-").slice(0,40).replace(/^-+|-+$/g,"")||"task"}`}}({flowId:e,taskKey:t,root:r});try{i({flowId:e,taskKey:t,root:r,git:n})}catch{}return{reverted:!0,branch:s}}export function nextTaskStatusAfterReview({accept:e}){return e?t.done:t.reverted}function a(t,o){return e("git",t,{cwd:o,stdio:["ignore","pipe","pipe"],encoding:"utf8"})}

package/flow-scope-evidence.mjs

@@ -1,117 +1 @@
-import path from 'node:path'
-
-const MAX_SCOPE_PATHS = 32
-const MAX_PATH = 180
-const MAX_OBSERVED = 32
-const MAX_CHECKS = 8
-const MAX_CHECK = 220
-const PRIVATE_PATH = /(?:^|\/)(?:\.env(?:\.|$)|\.git(?:\/|$)|\.thinkpool(?:\/|$)|node_modules(?:\/|$))/
-const SECRET = /(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|gh[pousr]_[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|npm_[a-z0-9]{24,}|bearer\s+[a-z0-9._-]{8,}|(?:api[_-]?key|access[_-]?token|auth(?:orization)?|token|secret)\s*[=:]\s*\S+)/i
-const VERIFY_COMMAND = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|build|lint|check|typecheck|verify)\b|(?:^|\s)node\s+--test\b|(?:vitest|jest|playwright|eslint|tsc)\b/i
-
-function uniqueSorted(values, max = MAX_OBSERVED) {
-  return [...new Set(values)].sort().slice(0, max)
-}
-
-function repoPath(value, { allowPattern = false } = {}) {
-  if (typeof value !== 'string') return null
-  let text = value.trim().replaceAll('\\', '/')
-  if (!text || text.length > MAX_PATH || text.startsWith('/') || /^[A-Za-z]:\//.test(text)) return null
-  const directoryPattern = allowPattern && text.endsWith('/**')
-  if (text.includes('*') && !directoryPattern) return null
-  const bare = directoryPattern ? text.slice(0, -3) : text
-  if (!bare || bare.endsWith('/') || bare.split('/').some((part) => !part || part === '.' || part === '..')) return null
-  if (PRIVATE_PATH.test(bare)) return null
-  const last = bare.split('/').at(-1)
-  if (allowPattern && !directoryPattern && !last.includes('.') && !/^(?:Dockerfile|Makefile|LICENSE|README)$/i.test(last)) return null
-  text = directoryPattern ? `${bare}/**` : bare
-  return text
-}
-
-export function normalizeFlowScopePaths(value) {
-  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_SCOPE_PATHS) {
-    throw new TypeError(`scope paths must contain 1-${MAX_SCOPE_PATHS} repo-relative entries`)
-  }
-  const paths = []
-  for (const item of value) {
-    const safe = repoPath(item, { allowPattern: true })
-    if (!safe) throw new TypeError(`invalid scope path: ${JSON.stringify(item)}`)
-    if (!paths.includes(safe)) paths.push(safe)
-  }
-  return paths.sort()
-}
-
-export function classifyFlowScope({ declared, changed } = {}) {
-  const safeDeclared = normalizeFlowScopePaths(declared)
-  const safeChanged = uniqueSorted((Array.isArray(changed) ? changed : []).map((item) => repoPath(item)).filter(Boolean))
-  const unexpected = safeChanged.filter((file) => !safeDeclared.some((scope) =>
-    scope.endsWith('/**') ? file.startsWith(scope.slice(0, -2)) : file === scope
-  ))
-  return { declared: safeDeclared, changed: safeChanged, unexpected, held: unexpected.length === 0 }
-}
-
-function observedPath(value, repoRoot) {
-  if (typeof value !== 'string' || !value.trim()) return null
-  const absoluteRoot = path.resolve(repoRoot)
-  const absolute = path.isAbsolute(value) ? path.resolve(value) : path.resolve(absoluteRoot, value)
-  const relative = path.relative(absoluteRoot, absolute).replaceAll('\\', '/')
-  if (!relative || relative.startsWith('../') || path.isAbsolute(relative)) return null
-  return repoPath(relative)
-}
-
-function safeCheck(value, repoRoot) {
-  if (typeof value !== 'string') return null
-  let command = value.replaceAll(path.resolve(repoRoot), '.').replace(/\s+/g, ' ').trim()
-  if (!command || command.length > MAX_CHECK || SECRET.test(command) || !VERIFY_COMMAND.test(command)) return null
-  return command
-}
-
-export function collectFlowScopeEvidence({ log = [], repoRoot, declared, changed } = {}) {
-  const classified = classifyFlowScope({ declared, changed })
-  const reads = []
-  const checks = new Map()
-  const successful = new Set()
-  for (const event of Array.isArray(log) ? log : []) {
-    if (event?.kind === 'assistant') {
-      for (const block of event.blocks || []) {
-        if (block?.type !== 'tool_use') continue
-        const name = String(block.name || '').toLowerCase()
-        if (['read', 'read_file', 'edit', 'write'].includes(name)) {
-          const candidate = block.input?.file_path ?? block.input?.path
-          const safe = observedPath(candidate, repoRoot)
-          if (safe) reads.push(safe)
-        }
-        if (name === 'bash' || name === 'exec_command' || name === 'command_execution') {
-          const command = safeCheck(block.input?.command ?? block.input?.cmd, repoRoot)
-          if (block.id && command) checks.set(block.id, command)
-        }
-      }
-    } else if (event?.kind === 'tool_result' && event.toolUseId && event.isError !== true) {
-      successful.add(event.toolUseId)
-    }
-  }
-  return {
-    declared: classified.declared,
-    read: uniqueSorted(reads),
-    changed: classified.changed,
-    verified: uniqueSorted([...checks].filter(([id]) => successful.has(id)).map(([, command]) => command), MAX_CHECKS),
-    unexpected: classified.unexpected,
-    held: classified.held,
-  }
-}
-
-export function normalizeFlowScopeEvidence(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
-  try {
-    const classified = classifyFlowScope({ declared: value.declared, changed: value.changed })
-    const read = uniqueSorted((Array.isArray(value.read) ? value.read : []).map((item) => repoPath(item)).filter(Boolean))
-    const verified = uniqueSorted((Array.isArray(value.verified) ? value.verified : [])
-      .map((item) => typeof item === 'string' && item.length <= MAX_CHECK && !SECRET.test(item) && VERIFY_COMMAND.test(item) ? item.trim() : null)
-      .filter(Boolean), MAX_CHECKS)
-    if (Boolean(value.held) !== classified.held) return null
-    if (JSON.stringify(uniqueSorted(Array.isArray(value.unexpected) ? value.unexpected : [])) !== JSON.stringify(classified.unexpected)) return null
-    return { declared: classified.declared, read, changed: classified.changed, verified, unexpected: classified.unexpected, held: classified.held }
-  } catch {
-    return null
-  }
-}
+import e from"node:path";const t=/(?:^|\/)(?:\.env(?:\.|$)|\.git(?:\/|$)|\.thinkpool(?:\/|$)|node_modules(?:\/|$))/,r=/(?:sk[_-](?:proj[_-])?[a-z0-9_-]{8,}|github_pat_[a-z0-9_]{20,}|gh[pousr]_[a-z0-9_-]{8,}|(?:AKIA|ASIA)[0-9A-Z]{16}|npm_[a-z0-9]{24,}|bearer\s+[a-z0-9._-]{8,}|(?:api[_-]?key|access[_-]?token|auth(?:orization)?|token|secret)\s*[=:]\s*\S+)/i,n=/(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|build|lint|check|typecheck|verify)\b|(?:^|\s)node\s+--test\b|(?:vitest|jest|playwright|eslint|tsc)\b/i;function l(e,t=32){return[...new Set(e)].sort().slice(0,t)}function i(e,{allowPattern:r=!1}={}){if("string"!=typeof e)return null;let n=e.trim().replaceAll("\\","/");if(!n||n.length>180||n.startsWith("/")||/^[A-Za-z]:\//.test(n))return null;const l=r&&n.endsWith("/**");if(n.includes("*")&&!l)return null;const i=l?n.slice(0,-3):n;if(!i||i.endsWith("/")||i.split("/").some(e=>!e||"."===e||".."===e))return null;if(t.test(i))return null;const o=i.split("/").at(-1);return!r||l||o.includes(".")||/^(?:Dockerfile|Makefile|LICENSE|README)$/i.test(o)?(n=l?`${i}/**`:i,n):null}export function normalizeFlowScopePaths(e){if(!Array.isArray(e)||0===e.length||e.length>32)throw new TypeError("scope paths must contain 1-32 repo-relative entries");const t=[];for(const r of e){const e=i(r,{allowPattern:!0});if(!e)throw new TypeError(`invalid scope path: ${JSON.stringify(r)}`);t.includes(e)||t.push(e)}return t.sort()}export function classifyFlowScope({declared:e,changed:t}={}){const r=normalizeFlowScopePaths(e),n=l((Array.isArray(t)?t:[]).map(e=>i(e)).filter(Boolean)),o=n.filter(e=>!r.some(t=>t.endsWith("/**")?e.startsWith(t.slice(0,-2)):e===t));return{declared:r,changed:n,unexpected:o,held:0===o.length}}function o(t,r){if("string"!=typeof t||!t.trim())return null;const n=e.resolve(r),l=e.isAbsolute(t)?e.resolve(t):e.resolve(n,t),o=e.relative(n,l).replaceAll("\\","/");return!o||o.startsWith("../")||e.isAbsolute(o)?null:i(o)}function s(t,l){if("string"!=typeof t)return null;let i=t.replaceAll(e.resolve(l),".").replace(/\s+/g," ").trim();return!i||i.length>220||r.test(i)||!n.test(i)?null:i}export function collectFlowScopeEvidence({log:e=[],repoRoot:t,declared:r,changed:n}={}){const i=classifyFlowScope({declared:r,changed:n}),a=[],c=new Map,d=new Set;for(const r of Array.isArray(e)?e:[])if("assistant"===r?.kind)for(const e of r.blocks||[]){if("tool_use"!==e?.type)continue;const r=String(e.name||"").toLowerCase();if(["read","read_file","edit","write"].includes(r)){const r=o(e.input?.file_path??e.input?.path,t);r&&a.push(r)}if("bash"===r||"exec_command"===r||"command_execution"===r){const r=s(e.input?.command??e.input?.cmd,t);e.id&&r&&c.set(e.id,r)}}else"tool_result"===r?.kind&&r.toolUseId&&!0!==r.isError&&d.add(r.toolUseId);return{declared:i.declared,read:l(a),changed:i.changed,verified:l([...c].filter(([e])=>d.has(e)).map(([,e])=>e),8),unexpected:i.unexpected,held:i.held}}export function normalizeFlowScopeEvidence(e){if(!e||"object"!=typeof e||Array.isArray(e))return null;try{const t=classifyFlowScope({declared:e.declared,changed:e.changed}),o=l((Array.isArray(e.read)?e.read:[]).map(e=>i(e)).filter(Boolean)),s=l((Array.isArray(e.verified)?e.verified:[]).map(e=>"string"==typeof e&&e.length<=220&&!r.test(e)&&n.test(e)?e.trim():null).filter(Boolean),8);return Boolean(e.held)!==t.held||JSON.stringify(l(Array.isArray(e.unexpected)?e.unexpected:[]))!==JSON.stringify(t.unexpected)?null:{declared:t.declared,read:o,changed:t.changed,verified:s,unexpected:t.unexpected,held:t.held}}catch{return null}}

package/flow-skill-registry.mjs

@@ -1,140 +1 @@
-// Thinkpool Flow — progressive skill registry.
-//
-// A Flow lane boots with only skill METADATA (name + description + whenToUse) injected
-// into its base prompt — the compact manifest(). The full SKILL.md body loads ON DEMAND
-// via loadBody(name) only when the lane actually activates that skill. Token win: the
-// manifest is orders of magnitude smaller than the sum of all skill bodies.
-//
-// Format: each skill lives at <dir>/<skill-name>/SKILL.md with agentskills.io YAML
-// frontmatter (name, description, and optional whenToUse). The body is the full SKILL.md
-// file content (frontmatter included) — the complete text a lane sees on activation.
-//
-// Public/custom split: publicDir carries built-in product skills; customDir (optional)
-// carries user/room-level overrides. Custom skills override public ones by `name` field.
-//
-// Pure module — canonical at src/lib/flow/skillRegistry.js, mirrored byte-identically
-// at bridge/flow-skill-registry.mjs (same reason as taskGraph / contextStore: the bridge
-// ships as thinkpool-pair npm package and can't import across the bridge↔src boundary
-// at publish time). Sync: bridge/flow-skill-registry.sync.test.js.
-//
-// Node built-ins only (node:fs, node:path) — no new deps.
-// All fs calls are injectable (fs option) so logic is unit-testable against temp dirs.
-
-import nodeFs from 'node:fs'
-import nodePath from 'node:path'
-
-// ── parseFrontmatter ──────────────────────────────────────────────────────────
-// Parse agentskills.io YAML-like frontmatter from a SKILL.md string.
-// Returns { meta: { name, description, whenToUse? } } or null if malformed/missing.
-// Required fields: name, description — missing either → null (skill skipped from manifest).
-// Tolerant: unknown YAML fields silently ignored; only scalar key:value pairs parsed.
-function parseFrontmatter (content) {
-  if (typeof content !== 'string') return null
-  // Strip BOM if present
-  const s = content.charCodeAt(0) === 0xFEFF ? content.slice(1) : content
-  if (!s.startsWith('---')) return null
-  const afterOpen = s.slice(3)
-  // Closing delimiter: a line that is exactly '---' (accept \r\n or \n line endings)
-  const closeMatch = afterOpen.match(/\r?\n---(?:\r?\n|$)/)
-  if (!closeMatch) return null
-  const yamlBlock = afterOpen.slice(0, closeMatch.index)
-
-  // Scalar key: value extraction only — not a full YAML parser; lists/nested maps silently mis-parsed.
-  const meta = {}
-  for (const line of yamlBlock.split(/\r?\n/)) {
-    const colonIdx = line.indexOf(':')
-    if (colonIdx === -1) continue
-    const key = line.slice(0, colonIdx).trim()
-    const val = line.slice(colonIdx + 1).trim()
-    if (key) meta[key] = val
-  }
-
-  // Both name and description are required for a valid skill entry
-  if (!meta.name || !meta.description) return null
-  return { meta }
-}
-
-// ── scanDir ───────────────────────────────────────────────────────────────────
-// Scan `dir` for skill entries. Each valid skill is a subdirectory containing a SKILL.md
-// with parseable frontmatter (name + description required). Malformed SKILL.md → skipped
-// without throwing. Missing or inaccessible dir → returns [].
-// Returns [{ name, description, whenToUse?, _path }] where _path is the absolute SKILL.md
-// path (internal — stripped from manifest() output, used by loadBody).
-function scanDir (dir, { fs = nodeFs } = {}) {
-  if (!dir) return []
-  let entries
-  try {
-    entries = fs.readdirSync(dir)
-  } catch (e) {
-    if (e && (e.code === 'ENOENT' || e.code === 'ENOTDIR')) return []
-    throw e
-  }
-  const skills = []
-  for (const entry of entries) {
-    const skillDir = nodePath.join(dir, entry)
-    let stat
-    // lstatSync does NOT follow symlinks — a symlinked entry returns isSymbolicLink()=true
-    // and isDirectory()=false, so it is skipped. Using statSync would follow the link and
-    // allow scanning a directory outside publicDir/customDir (symlink escape vector).
-    try { stat = fs.lstatSync(skillDir) } catch { continue }
-    if (!stat.isDirectory()) continue
-    const skillMdPath = nodePath.join(skillDir, 'SKILL.md')
-    // Belt-and-suspenders: lstat the SKILL.md too — skip if it is itself a symlink.
-    // Covers a file-level symlink inside a real (non-symlinked) skill dir.
-    let skillMdStat
-    try { skillMdStat = fs.lstatSync(skillMdPath) } catch { continue }
-    if (skillMdStat.isSymbolicLink()) continue
-    let content
-    try { content = fs.readFileSync(skillMdPath, 'utf8') } catch { continue }
-    const parsed = parseFrontmatter(content)
-    if (!parsed) continue  // malformed — skip silently, do not throw
-    const { meta } = parsed
-    const skill = { name: meta.name, description: meta.description, _path: skillMdPath }
-    if (meta.whenToUse) skill.whenToUse = meta.whenToUse
-    skills.push(skill)
-  }
-  return skills
-}
-
-// ── manifest ──────────────────────────────────────────────────────────────────
-// Build the compact skill manifest: an array of { name, description, whenToUse? } per
-// skill — METADATA ONLY, no SKILL.md body. This is what a lane injects into its base
-// prompt to know which skills are available without loading any body.
-//
-// Merge rule: publicDir skills load first; customDir skills then override/extend by
-// `name`. A custom skill with the same name as a public skill replaces it in the result.
-//
-// Returns [] if both dirs are absent or contain no valid skills.
-export function manifest ({ publicDir, customDir, fs = nodeFs } = {}) {
-  const publicSkills = scanDir(publicDir, { fs })
-  const customSkills = scanDir(customDir, { fs })
-  // Merge: public first, custom overrides by name
-  const byName = new Map()
-  for (const s of publicSkills) byName.set(s.name, s)
-  for (const s of customSkills) byName.set(s.name, s)
-  // Return compact entries — strip internal _path
-  return [...byName.values()].map(({ name, description, whenToUse }) => {
-    const entry = { name, description }
-    if (whenToUse !== undefined) entry.whenToUse = whenToUse
-    return entry
-  })
-}
-
-// ── loadBody ──────────────────────────────────────────────────────────────────
-// Load the full SKILL.md content for the named skill, on demand.
-// customDir is checked before publicDir (a custom skill overrides a public of the same name).
-// Unknown name / skill not found in either dir → returns null (clean miss, never throws).
-export function loadBody (name, { publicDir, customDir, fs = nodeFs } = {}) {
-  if (!name || typeof name !== 'string') return null
-  // Custom takes priority over public — check custom first
-  for (const dir of [customDir, publicDir]) {
-    const skills = scanDir(dir, { fs })
-    const found = skills.find(s => s.name === name)
-    if (found) {
-      try {
-        return fs.readFileSync(found._path, 'utf8')
-      } catch { /* skill file disappeared — try next dir */ }
-    }
-  }
-  return null  // clean miss — not found in either dir
-}
+import n from"node:fs";import t from"node:path";function e(n){if("string"!=typeof n)return null;const t=65279===n.charCodeAt(0)?n.slice(1):n;if(!t.startsWith("---"))return null;const e=t.slice(3),o=e.match(/\r?\n---(?:\r?\n|$)/);if(!o)return null;const i=e.slice(0,o.index),r={};for(const n of i.split(/\r?\n/)){const t=n.indexOf(":");if(-1===t)continue;const e=n.slice(0,t).trim(),o=n.slice(t+1).trim();e&&(r[e]=o)}return r.name&&r.description?{meta:r}:null}function o(o,{fs:i=n}={}){if(!o)return[];let r;try{r=i.readdirSync(o)}catch(n){if(n&&("ENOENT"===n.code||"ENOTDIR"===n.code))return[];throw n}const c=[];for(const n of r){const r=t.join(o,n);let s;try{s=i.lstatSync(r)}catch{continue}if(!s.isDirectory())continue;const f=t.join(r,"SKILL.md");let u,a;try{u=i.lstatSync(f)}catch{continue}if(u.isSymbolicLink())continue;try{a=i.readFileSync(f,"utf8")}catch{continue}const l=e(a);if(!l)continue;const{meta:m}=l,d={name:m.name,description:m.description,_path:f};m.whenToUse&&(d.whenToUse=m.whenToUse),c.push(d)}return c}export function manifest({publicDir:t,customDir:e,fs:i=n}={}){const r=o(t,{fs:i}),c=o(e,{fs:i}),s=new Map;for(const n of r)s.set(n.name,n);for(const n of c)s.set(n.name,n);return[...s.values()].map(({name:n,description:t,whenToUse:e})=>{const o={name:n,description:t};return void 0!==e&&(o.whenToUse=e),o})}export function loadBody(t,{publicDir:e,customDir:i,fs:r=n}={}){if(!t||"string"!=typeof t)return null;for(const n of[i,e]){const e=o(n,{fs:r}).find(n=>n.name===t);if(e)try{return r.readFileSync(e._path,"utf8")}catch{}}return null}