thinkpool-pair 0.7.99 → 0.7.101

package/bridge.mjs

@@ -1839,7 +1839,10 @@ flowChannel
         const laneId = randomUUID()
         termNames[laneId] = `Flow · ${t.task_key}`
         saveNames(room, termNames)
-        openStructured({ id: laneId, cwd: dir, mode: 'acceptEdits', rolePrompt: isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT, flowSessionId: payload.flowId, flowTaskKey: t.task_key, spawnedBy: `flow:${payload.flowId}` })
+        // Lanes build autonomously in their own worktree — bypassPermissions so they
+        // don't stall on a card for every write/bash (matches the user's expectation that
+        // a Flow summoned from a bypass terminal runs hands-off).
+        openStructured({ id: laneId, cwd: dir, mode: 'bypassPermissions', rolePrompt: isReview ? FLOW_REVIEWER_PROMPT : FLOW_LANE_PROMPT, flowSessionId: payload.flowId, flowTaskKey: t.task_key, spawnedBy: `flow:${payload.flowId}` })
         const le = sessions.get(laneId)
         if (le?.session) {
           const spec =

package/flow-assembly.mjs

@@ -42,7 +42,18 @@ export function inlineSingleHtml ({ htmlPath, root, readFile = fsReadFile }) {
   let html = String(readFile(htmlPath, 'utf8'))
 
   const isLocal = (ref) => ref && !/^[a-z]+:\/\//i.test(ref) && !ref.startsWith('//')
-  const resolve = (ref) => path.join(baseDir, ref.replace(/^\.\//, ''))
+  // CONTAIN to baseDir — a lane-authored index.html could reference `../../etc/passwd`
+  // or an absolute path; without this the bridge would read arbitrary host files and
+  // inline them into the served preview (path traversal). Mirrors resolveUnderRoot in
+  // flow-preview.mjs: resolve, then reject anything that escapes baseDir. Returns null on
+  // an out-of-root / absolute ref so callers leave the tag untouched (never read it).
+  const resolve = (ref) => {
+    if (!ref || path.isAbsolute(ref)) return null
+    const abs = path.resolve(baseDir, ref.replace(/^\.\//, ''))
+    const rel = path.relative(baseDir, abs)
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) return rel === '' ? abs : null
+    return abs
+  }
 
   // Collected module-script bodies (import/export users) get merged into one block.
   const moduleBodies = []
@@ -53,7 +64,8 @@ export function inlineSingleHtml ({ htmlPath, root, readFile = fsReadFile }) {
     (tag) => {
       const m = tag.match(/\bhref=["']([^"']+)["']/i)
       if (!m || !isLocal(m[1])) return tag
-      const css = String(readFile(resolve(m[1]), 'utf8'))
+      const p = resolve(m[1]); if (!p) return tag   // out-of-root ref → leave the tag as-is
+      const css = String(readFile(p, 'utf8'))
       return `<style>\n${css}\n</style>`
     }
   )
@@ -64,9 +76,10 @@ export function inlineSingleHtml ({ htmlPath, root, readFile = fsReadFile }) {
     /<script\b([^>]*)\bsrc=["']([^"']+)["']([^>]*)>\s*<\/script>/gi,
     (tag, pre, src, post) => {
       if (!isLocal(src)) return tag
+      const p = resolve(src); if (!p) return tag   // out-of-root ref → leave the tag as-is
       const attrs = `${pre} ${post}`
       const isModule = /\btype=["']module["']/i.test(attrs)
-      const body = String(readFile(resolve(src), 'utf8'))
+      const body = String(readFile(p, 'utf8'))
       const usesEsm = /(^|[\s;{(])(import|export)\s/.test(body)
       if (isModule && usesEsm) {
         moduleBodies.push(`/* inlined: ${src} */\n${body}`)

package/flow-conductor.mjs

@@ -24,6 +24,8 @@ export { normalizePlanOutput }
 // moat, partition by file ownership, plan-in-store-not-context, right-size the slice
 // count (3 focused beats 7 scattered), explicit acyclic deps.
 export const FLOW_CONDUCTOR_PROMPT = [
+  'THINKPOOL FLOW CONDUCTOR — HARD RULES (read first, no exceptions): You are in PLAN MODE. Your ONLY output action is calling the ExitPlanMode tool EXACTLY ONCE with the task-graph JSON. You MUST NOT write or edit files, MUST NOT run bash/git, MUST NOT call AskUserQuestion, and MUST NOT build the project yourself — in plan mode those are blocked and will just stall you on a permission prompt. You do NOT build; you DECOMPOSE so the lanes build. A fully-specified build is STILL decomposed, never built here. If a detail is ambiguous, make a reasonable assumption and note it in the plan summary — do NOT ask. Think, then call ExitPlanMode. That is the whole job.',
+
   'THINKPOOL FLOW — you are the CONDUCTOR of an ensemble build. Your job RIGHT NOW (Step 1) is to decompose the user\'s build request into a TASK-GRAPH: a set of RUNNABLE slices with explicit dependencies, then submit that plan for human approval. Do NOT start building and do NOT spawn lanes yet — that happens only after the user approves the plan (Step 2+).',
 
   'DECOMPOSE INTO RUNNABLE SLICES. Each slice must be something ONE lane can build, RUN in its own browser-side WebContainer sandbox, observe, and self-correct INDEPENDENTLY. A slice that cannot run on its own is not a slice — split it or merge it until it is. The runtime (a lane running what it built) is the moat; slices that can\'t run break the whole model.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.99",
+  "version": "0.7.101",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {