thinkpool-pair 0.7.108 → 0.7.109

package/bridge.mjs

@@ -464,6 +464,66 @@ async function refreshOwnerPlan() {
   } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
 }
 refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken may be set from env)
+
+// ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
+// The bridge calls the durable ledger RPCs as the OWNER (codeAuthToken); is_session_member
+// passes for this room, so the room-scope cap enforces. Member-scope attribution needs the
+// SENDER's uid (not available here — a turn carries a display label + cid, not a uuid), so
+// the baseline records/enforces ROOM scope only; per-member caps wait on the quota-fairness
+// work. TP_BUDGET_OFF disables the whole path. `roomCapped` caches whether a cap exists so a
+// transient ledger error fails CLOSED only for a room we KNOW is capped, and open otherwise.
+const BUDGET_OFF = process.env.TP_BUDGET_OFF === '1'
+let roomCapped = false
+function monthResetLabel () {
+  const d = new Date()
+  return new Date(d.getFullYear(), d.getMonth() + 1, 1).toISOString().slice(0, 10)
+}
+async function budgetRpc (fn, args) {
+  const r = await fetch(`${SUPABASE_URL}/rest/v1/rpc/${fn}`, {
+    method: 'POST',
+    headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify(args),
+  })
+  if (!r.ok) throw new Error(`${fn} ${r.status}`)
+  const t = await r.text()
+  return t ? JSON.parse(t) : null
+}
+// Fire-and-forget: fold a completed turn's output tokens into the room's durable monthly
+// ledger. output_tokens = the billed reasoning+output spend the indicator already tracks.
+function recordRoomSpend (tokens) {
+  if (BUDGET_OFF || !codeAuthToken || !room || !tokens) return
+  budgetRpc('record_spend', { p_room: room, p_tokens: tokens }).catch(() => { /* best-effort — next turn's check reconciles */ })
+}
+// Pre-flight gate. Returns true if the turn must be REFUSED (room cap reached). Refusal is
+// legible (a ◆ control line both readers + late-joiners see), never a silent stall.
+async function budgetBlocked (s, term) {
+  if (BUDGET_OFF || !codeAuthToken) return false
+  const refuse = (text) => {
+    const evt = { kind: 'control', text }
+    try { pushLog(s, evt) } catch { /* no session log */ }
+    bcast('code-event', { term, evt })
+    return true
+  }
+  try {
+    const rows = await budgetRpc('check_budget', { p_room: room })
+    const r = Array.isArray(rows) ? rows[0] : rows
+    roomCapped = !!(r && r.remaining_tokens != null)
+    if (r && r.ok === false) {
+      process.stderr.write(`\n  ${A.yel}◆ turn refused — ${r.tightest_scope} budget cap reached (room ${room}).${A.rst}\n`)
+      return refuse(`◆ Turn blocked — this room hit its ${r.tightest_scope || 'budget'} cap. Resets ${monthResetLabel()}, or raise the cap.`)
+    }
+    return false
+  } catch (e) {
+    // Fail-closed ONLY where we know a cap exists — a transient ledger/DNS blip must never
+    // brick an UNCAPPED room (that would be a worse outage than the cap it's guarding).
+    if (roomCapped) {
+      process.stderr.write(`\n  ${A.yel}◆ turn refused — budget check failed, room is capped (fail-closed).${A.rst}\n`)
+      return refuse('◆ Turn blocked — budget check is unavailable and this room has a cap set. Try again in a moment.')
+    }
+    process.stderr.write(`\n  ${A.dim}◆ budget check skipped (${e.message}) — room uncapped, proceeding.${A.rst}\n`)
+    return false
+  }
+}
 // Throttled presence track() (presence.mjs) — a reconnect storm re-fires SUBSCRIBED and
 // the handler re-track()s; without throttle that spirals into the per-client presence
 // rate limit (ClientPresenceRateLimitReached). Lazy so it binds `channel` (the chain
@@ -1456,6 +1516,9 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         const b = flowBudgets.get(entry.flowSessionId)
         if (b) flowBudgets.set(entry.flowSessionId, recordSpend(b, evt.usage.output_tokens || 0))
       }
+      // Budget caps — fold EVERY completed turn's output tokens into the room's durable
+      // monthly ledger (lanes + normal turns), so check_budget can pre-flight the next one.
+      if (evt.kind === 'result' && evt.usage) recordRoomSpend(evt.usage.output_tokens || 0)
       // FL-B1 (lane) — a flow lane that ENDS ITS TURN is done: a bypass lane runs its slice
       // to completion in one turn, then narrates "done" and stops. Models often skip the
       // explicit signal (FLOW_DONE / mark_flow_done), which left the slice stuck 'dispatched'
@@ -1797,7 +1860,7 @@ channel
     if (payload?.host && payload.host !== name) return
     openStructured({ id: payload?.id || randomUUID(), model: payload?.model, resume: payload?.resume, mode: payload?.mode })
   })
-  .on('broadcast', { event: 'code-turn' }, ({ payload }) => {
+  .on('broadcast', { event: 'code-turn' }, async ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
     if (!s || payload.text == null) return
     markActivity()
@@ -1857,6 +1920,10 @@ channel
       s.session.sendTurn(text)
       return
     }
+    // Pre-flight budget gate (room scope) — refuse the billable agent turn if the room hit
+    // its cap. The slash controls above (/model, /clear, /compact) are intentionally exempt:
+    // they let a user manage or REDUCE spend even when capped. Legible refusal, no silent stall.
+    if (await budgetBlocked(s, payload.term)) return
     s.session.sendTurn(text)
     echoYou()
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.108",
+  "version": "0.7.109",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {