thinkpool-pair 0.7.108 → 0.7.110

package/account.mjs

@@ -255,6 +255,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
   let pendingUpdate = null     // newest published version once the poll sees it
   const warned = new Set()
+  const refused = new Map()   // room -> reason ('home'|'none'|'dir-gone'): owned but NOT served, announced in presence so the web shows a precise "attach this session" card instead of spinning
 
   // Account presence — so the web dashboard can show "● Bridge active" for this
   // account without per-room probing. We TRACK this machine (name + served room
@@ -324,7 +325,7 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // service (always-on, survives reboot) vs a foreground `npx` run that dies with its
   // terminal. THINKPOOL_PAIR_AUTOUPDATE=1 is set ONLY by the install-service plist/unit
   // (service.mjs), so it's the reliable proxy for "running as the managed service".
-  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], service: process.env.THINKPOOL_PAIR_AUTOUPDATE === '1', ts: Date.now() })
+  const pushPresence = () => trackPresence({ name: machine, version: VERSION, rooms: [...children.keys()], refused: [...refused].map(([code, reason]) => ({ code, reason })), service: process.env.THINKPOOL_PAIR_AUTOUPDATE === '1', ts: Date.now() })
   // Re-track on EVERY (re)subscribe, not just the first: a realtime reconnect
   // (network blip, or a token swap mid-flight) rejoins the channel and must
   // re-announce, or the dashboard would read "no bridge" until the next restart.
@@ -491,18 +492,23 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       // participant's bridge is duplication the UI never even looks at.
       const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,participants').eq('owner_id', session.user.id).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
+      // Prune refused entries for rooms we no longer own (only on a SUCCESSFUL fetch,
+      // so a transient query error never wipes the set).
+      const ownedCodes = new Set(rooms.map((r) => r.code))
+      for (const c of [...refused.keys()]) if (!ownedCodes.has(c)) refused.delete(c)
     } catch { /* transient — keep existing children, retry next tick */ }
     const dirs = loadDirs()
     const served = loadServed()
     for (const r of rooms) {
       const room = r.code
-      if (!room || children.has(room)) continue
+      if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
       if (r.owner_id && r.owner_id !== session.user.id) continue   // never serve a room we don't own (defense-in-depth behind the .eq above)
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
       // to auto-serve an unbound room from $HOME — that strips the agent's resume context
       // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).
       const choice = resolveServeDir({ bound: dirs[room], remembered: served[room], defaultDir: DEFAULT_DIR, home: os.homedir() })
       if (choice.refuse) {
+        refused.set(room, choice.reason)
         if (!warned.has(room)) {
           warned.add(room)
           const why = choice.reason === 'home'
@@ -514,10 +520,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       }
       const dir = choice.dir
       if (!fs.existsSync(dir)) {
+        refused.set(room, 'dir-gone')
         if (!warned.has(room)) { warned.add(room); process.stderr.write(`\n  ◇ ${room}: bound directory is gone (${dir}) — re-bind it.\n`) }
         continue
       }
       warned.delete(room)
+      refused.delete(room)   // about to serve → clear any prior refusal
       // Learn this room → dir so a later relaunch from $HOME resumes it HERE (the real
       // repo) instead of the home-dir fallback. Only the auto path is remembered; an
       // explicit bind already persists in dirs.json.

package/bridge.mjs

@@ -464,6 +464,66 @@ async function refreshOwnerPlan() {
   } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
 }
 refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken may be set from env)
+
+// ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
+// The bridge calls the durable ledger RPCs as the OWNER (codeAuthToken); is_session_member
+// passes for this room, so the room-scope cap enforces. Member-scope attribution needs the
+// SENDER's uid (not available here — a turn carries a display label + cid, not a uuid), so
+// the baseline records/enforces ROOM scope only; per-member caps wait on the quota-fairness
+// work. TP_BUDGET_OFF disables the whole path. `roomCapped` caches whether a cap exists so a
+// transient ledger error fails CLOSED only for a room we KNOW is capped, and open otherwise.
+const BUDGET_OFF = process.env.TP_BUDGET_OFF === '1'
+let roomCapped = false
+function monthResetLabel () {
+  const d = new Date()
+  return new Date(d.getFullYear(), d.getMonth() + 1, 1).toISOString().slice(0, 10)
+}
+async function budgetRpc (fn, args) {
+  const r = await fetch(`${SUPABASE_URL}/rest/v1/rpc/${fn}`, {
+    method: 'POST',
+    headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify(args),
+  })
+  if (!r.ok) throw new Error(`${fn} ${r.status}`)
+  const t = await r.text()
+  return t ? JSON.parse(t) : null
+}
+// Fire-and-forget: fold a completed turn's output tokens into the room's durable monthly
+// ledger. output_tokens = the billed reasoning+output spend the indicator already tracks.
+function recordRoomSpend (tokens) {
+  if (BUDGET_OFF || !codeAuthToken || !room || !tokens) return
+  budgetRpc('record_spend', { p_room: room, p_tokens: tokens }).catch(() => { /* best-effort — next turn's check reconciles */ })
+}
+// Pre-flight gate. Returns true if the turn must be REFUSED (room cap reached). Refusal is
+// legible (a ◆ control line both readers + late-joiners see), never a silent stall.
+async function budgetBlocked (s, term) {
+  if (BUDGET_OFF || !codeAuthToken) return false
+  const refuse = (text) => {
+    const evt = { kind: 'control', text }
+    try { pushLog(s, evt) } catch { /* no session log */ }
+    bcast('code-event', { term, evt })
+    return true
+  }
+  try {
+    const rows = await budgetRpc('check_budget', { p_room: room })
+    const r = Array.isArray(rows) ? rows[0] : rows
+    roomCapped = !!(r && r.remaining_tokens != null)
+    if (r && r.ok === false) {
+      process.stderr.write(`\n  ${A.yel}◆ turn refused — ${r.tightest_scope} budget cap reached (room ${room}).${A.rst}\n`)
+      return refuse(`◆ Turn blocked — this room hit its ${r.tightest_scope || 'budget'} cap. Resets ${monthResetLabel()}, or raise the cap.`)
+    }
+    return false
+  } catch (e) {
+    // Fail-closed ONLY where we know a cap exists — a transient ledger/DNS blip must never
+    // brick an UNCAPPED room (that would be a worse outage than the cap it's guarding).
+    if (roomCapped) {
+      process.stderr.write(`\n  ${A.yel}◆ turn refused — budget check failed, room is capped (fail-closed).${A.rst}\n`)
+      return refuse('◆ Turn blocked — budget check is unavailable and this room has a cap set. Try again in a moment.')
+    }
+    process.stderr.write(`\n  ${A.dim}◆ budget check skipped (${e.message}) — room uncapped, proceeding.${A.rst}\n`)
+    return false
+  }
+}
 // Throttled presence track() (presence.mjs) — a reconnect storm re-fires SUBSCRIBED and
 // the handler re-track()s; without throttle that spirals into the per-client presence
 // rate limit (ClientPresenceRateLimitReached). Lazy so it binds `channel` (the chain
@@ -1456,6 +1516,9 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         const b = flowBudgets.get(entry.flowSessionId)
         if (b) flowBudgets.set(entry.flowSessionId, recordSpend(b, evt.usage.output_tokens || 0))
       }
+      // Budget caps — fold EVERY completed turn's output tokens into the room's durable
+      // monthly ledger (lanes + normal turns), so check_budget can pre-flight the next one.
+      if (evt.kind === 'result' && evt.usage) recordRoomSpend(evt.usage.output_tokens || 0)
       // FL-B1 (lane) — a flow lane that ENDS ITS TURN is done: a bypass lane runs its slice
       // to completion in one turn, then narrates "done" and stops. Models often skip the
       // explicit signal (FLOW_DONE / mark_flow_done), which left the slice stuck 'dispatched'
@@ -1797,7 +1860,7 @@ channel
     if (payload?.host && payload.host !== name) return
     openStructured({ id: payload?.id || randomUUID(), model: payload?.model, resume: payload?.resume, mode: payload?.mode })
   })
-  .on('broadcast', { event: 'code-turn' }, ({ payload }) => {
+  .on('broadcast', { event: 'code-turn' }, async ({ payload }) => {
     const s = payload?.term && sessions.get(payload.term)
     if (!s || payload.text == null) return
     markActivity()
@@ -1857,6 +1920,10 @@ channel
       s.session.sendTurn(text)
       return
     }
+    // Pre-flight budget gate (room scope) — refuse the billable agent turn if the room hit
+    // its cap. The slash controls above (/model, /clear, /compact) are intentionally exempt:
+    // they let a user manage or REDUCE spend even when capped. Legible refusal, no silent stall.
+    if (await budgetBlocked(s, payload.term)) return
     s.session.sendTurn(text)
     echoYou()
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.108",
+  "version": "0.7.110",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {