thinkpool-pair 0.7.115 → 0.7.117

package/bridge.mjs

@@ -529,6 +529,22 @@ function recordRoomSpend (tokens) {
   if (BUDGET_OFF || !codeAuthToken || !room || !tokens) return
   budgetRpc('record_spend', { p_room: room, p_tokens: tokens }).catch(() => { /* best-effort — next turn's check reconciles */ })
 }
+// Fire-and-forget: log a completed Code turn's BYOK token usage per-MODEL into
+// chat_usage (via record_code_usage → attributes to the room owner) so the
+// Settings "AI usage" card counts ThinkPool Code, not just chat. Independent of
+// TP_BUDGET_OFF (that only governs the cap ledger; usage accounting should still
+// run). input = full input incl. cache; cached = cache-read slice; both mapped to
+// pricing.js's rowCostEur formula. No model → skip (can't price/label it).
+function recordCodeUsage (model, usage) {
+  if (!codeAuthToken || !room || !model) return
+  const u = usage || {}
+  const input  = (u.input_tokens || 0) + (u.cache_creation_input_tokens || 0) + (u.cache_read_input_tokens || 0)
+  const output = u.output_tokens || 0
+  const cached = u.cache_read_input_tokens || 0
+  if (!input && !output) return
+  budgetRpc('record_code_usage', { p_room: room, p_model: model, p_input: input, p_output: output, p_cached: cached })
+    .catch(() => { /* best-effort — usage accounting is not load-bearing for the turn */ })
+}
 // Pre-flight gate. Returns true if the turn must be REFUSED (room cap reached). Refusal is
 // legible (a ◆ control line both readers + late-joiners see), never a silent stall.
 async function budgetBlocked (s, term) {
@@ -1613,7 +1629,7 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
       }
       // Budget caps — fold EVERY completed turn's output tokens into the room's durable
       // monthly ledger (lanes + normal turns), so check_budget can pre-flight the next one.
-      if (evt.kind === 'result' && evt.usage) recordRoomSpend(evt.usage.output_tokens || 0)
+      if (evt.kind === 'result' && evt.usage) { recordRoomSpend(evt.usage.output_tokens || 0); recordCodeUsage(evt.model, evt.usage) }
       // FL-B1 (lane) — a flow lane that ENDS ITS TURN is done: a bypass lane runs its slice
       // to completion in one turn, then narrates "done" and stops. Models often skip the
       // explicit signal (FLOW_DONE / mark_flow_done), which left the slice stuck 'dispatched'
@@ -2393,7 +2409,19 @@ flowChannel
     cleanupFlowLanes(payload.flowId, 600)
     process.stderr.write(`\n  ${A.yel}◆ flow cancelled — closing its lanes (${String(payload.flowId).replace(/-/g, '').slice(0, 8)}).${A.rst}\n`)
   })
-  .subscribe()
+  .subscribe(status => {
+    // BRG-2 (audit 2026-07-02): tpflow had a bare subscribe with no status handler, so a
+    // channel-specific CHANNEL_ERROR (socket still healthy → the main tpcode watchdog
+    // never trips) dropped flow dispatch/plan/done silently until the next bridge
+    // restart. Surface it. supabase-js auto-rejoins every channel on a socket reconnect,
+    // so a transient drop self-heals; an active per-channel re-subscribe is deliberately
+    // NOT added here — re-subscribing a live supabase channel is a known lifecycle
+    // footgun (the 2026-06-30 channel-collision family) and can't be two-device verified
+    // from a single host.
+    if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT' || status === 'CLOSED') {
+      process.stderr.write(`\n  ⚠ flow realtime ${status} (tpflow:${room}).\n`)
+    }
+  })
 
 // Watchdog — if the realtime channel is stuck (never connected, or dropped and
 // not recovered) for >60s, exit non-zero so a supervisor/launchd restarts a
@@ -2549,6 +2577,10 @@ async function shutdown(code = 0, farewell = true) {
   // socket is alive; on a wedge it won't flush and the hard backstop above wins).
   try { await channel.untrack() } catch { /* noop */ }
   try { await supabase.removeChannel(channel) } catch { /* noop */ }
+  // BRG-2 (audit 2026-07-02): shutdown removed only the room channel, leaking the flow
+  // topic (no presence to untrack, but the subscription + socket join outlived the
+  // process teardown). Close it too so shutdown is symmetric.
+  try { await supabase.removeChannel(flowChannel) } catch { /* noop */ }
   setTimeout(() => process.exit(code), 250)   // grace for the leave/close frames to flush
 }
 process.on('SIGINT', () => shutdown(0))

package/claude-session.mjs

@@ -171,6 +171,9 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // per turn on `result`.
   let turnBaseOut = 0             // output tokens from completed messages this turn
   let curMsgOut = 0               // latest output_tokens for the in-flight message
+  let curModel = model || null    // latest model id seen (init/system + ctx); stamped on
+                                  // the result event so the bridge can attribute BYOK Code
+                                  // spend per-model (record_code_usage → chat_usage).
   // ── stall watchdog (C2) — stream silence ≠ done; a turn can stall (deltas pause
   // 3+ min) or abort silently with no `result`. Track turn liveness + last event
   // time; if an active turn goes quiet past STALL_MS, emit one `stalled` chrome
@@ -197,6 +200,22 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // the catch self-heals.
   const FORCE_STOP_MS = Math.max(STALL_MS * 3, parseInt(process.env.TP_FORCE_STOP_MS, 10) || 300000)
   let forceStopped = false
+  // Waiting on a HUMAN decision (permission card / plan gate / AskUserQuestion)
+  // is NOT a wedge — the turn is correctly idle until the person answers. Every
+  // interactive gate goes through requestPermission, so wrap it once to bump a
+  // counter while a card is pending; the stall watchdog below stands down while
+  // awaitingUser > 0. Without this, a slow human answer (e.g. a late
+  // AskUserQuestion pick) trips FORCE_STOP_MS, the turn is force-stopped, and the
+  // answer lands on a dead turn ("agent went silent … send again to resume").
+  // On release, stamp lastEvtTs = now so the resumed turn isn't force-stopped on
+  // the very next tick by a now-stale (minutes-old) timestamp.
+  let awaitingUser = 0
+  const _requestPermission = requestPermission
+  requestPermission = async (req) => {
+    awaitingUser++
+    try { return await _requestPermission?.(req) }
+    finally { awaitingUser = Math.max(0, awaitingUser - 1); lastEvtTs = Date.now() }
+  }
   // Set while an interrupt is settling. q.interrupt() doesn't end the turn cleanly on this
   // SDK — it surfaces a REDUNDANT pair of terminal results (subtype `aborted` AND
   // `error_during_execution`) and re-inits the session. abort() emits the single canonical
@@ -225,7 +244,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
 
   const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
   const stallTimer = setInterval(() => {
-    if (!turnActive) return
+    if (!turnActive || awaitingUser > 0) return   // awaiting a human decision ≠ wedged
     const quiet = Date.now() - lastEvtTs
     if (quiet > FORCE_STOP_MS && !forceStopped) {
       // True wedge — no result, no error, just silence. Unblocks between-turns
@@ -650,6 +669,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             // m.slash_commands (init message) — the commands this session really
             // supports: built-ins + the host's custom .claude/commands. Surfaced
             // so the room composer's autocomplete lists what ACTUALLY exists.
+            curModel = m.model || model || curModel
             emit({ kind: 'system', sessionId, model: m.model || model || null, commands: Array.isArray(m.slash_commands) ? m.slash_commands : undefined })
             // Dynamic model list — ask the SDK for its OWN supported models and surface
             // them to the room so the /model picker renders live options (incl. new
@@ -715,7 +735,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             turnActive = false               // turn settled → stall watchdog stands down
             restartCount = 0                 // a successful turn refills the auto-restart budget
             forceStopped = false
-            emit({ kind: 'result', subtype: m.subtype, sessionId, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
+            emit({ kind: 'result', subtype: m.subtype, sessionId, model: curModel, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
             // Arm the Haiku fallback: if Claude's own prompt_suggestion doesn't arrive within
             // the window, generate one from the last assistant reply. (Skip aborted turns.)
             if (sugTimer) clearTimeout(sugTimer)
@@ -726,7 +746,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               let ctx = null
               try {
                 const c = await q?.getContextUsage?.()
-                if (c) ctx = { used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }
+                if (c) { ctx = { used: c.totalTokens, max: c.maxTokens, pct: Math.round(c.percentage), model: c.model }; if (c.model) curModel = c.model }
               } catch { /* control req may be unavailable */ }
               const u = m.usage || {}
               emit({ kind: 'usage', costUsd: m.total_cost_usd ?? null, tokens: (u.input_tokens || 0) + (u.output_tokens || 0), ctx })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.115",
+  "version": "0.7.117",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {