thinkpool-pair 0.7.157 → 0.7.158

package/bridge.mjs

@@ -37,6 +37,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
+import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage } from './serve-consent.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -569,7 +570,49 @@ async function refreshOwnerPlan() {
     if (rows?.[0]?.plan) ownerPlan = rows[0].plan === 'plus' ? 'plus' : 'free'
   } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
 }
-refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken may be set from env)
+// ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
+// A room is served by its OWNER's bridge; a non-owner may serve only with the
+// owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
+// realtime channel is even built — so a refused bridge never dials the room. Owner
+// reclaim (a grantee yields when the owner's bridge reappears) + grant revocation are
+// wired below on the EXISTING room channel / REST row — no new topic
+// (feedback_no_duplicate_realtime_channel, H41). LIMITATION: enforcement is in-bridge;
+// an OLDER bridge bypasses it (no wire-level lock). Spec: docs/specs/2026-07-04-room-serve-owner-consent.md.
+let roomOwnerId = null       // code_sessions.owner_id, learned at the gate
+let myServeUid = null        // this bridge's authed uid (null = anon)
+let iServeAsGrantee = false  // serving by grant, not as owner → the only bridge that yields
+let yielding = false         // set once when standing down, so reclaim + revoke don't double-fire
+{
+  // Standalone room mode ran anon unless TP_ACCESS_TOKEN was in env; load the stored
+  // login so `npx thinkpool-pair <CODE>` authenticates AS the signed-in user (the
+  // identity the consent check needs). Account children already carry the env token.
+  if (!codeAuthToken) {
+    try { const { loadAuth } = await import('./auth-store.mjs'); codeAuthToken = loadAuth()?.access_token || null } catch { /* no store — stays anon */ }
+  }
+  try {
+    if (codeAuthToken) {
+      const { data } = await supabase.auth.getUser(codeAuthToken)
+      myServeUid = data?.user?.id || null
+    }
+    const { ownerId, grantUid, name } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
+    roomOwnerId = ownerId
+    const decision = serveDecision({ ownerId, grantUid, myUid: myServeUid })
+    if (!decision.serve) {
+      process.stderr.write(refusalMessage({ room, name, reason: decision.reason }))
+      // exit 0 — an intentional stand-down, not a crash, so a supervisor does not
+      // thrash-restart it (matches the machine-lock stand-down at the top of boot).
+      process.exit(0)
+    }
+    iServeAsGrantee = amGrantee({ ownerId, grantUid, myUid: myServeUid })
+    if (iServeAsGrantee) process.stderr.write(`\n  ◆ serving room ${room} by the owner's grant — will yield if the owner's bridge returns or the grant is revoked.\n`)
+  } catch (e) {
+    // Fail OPEN on a network/transport error ONLY (spec: never strand a user on a
+    // flaky fetch). A clean "no row / not granted" is a decision above, not a throw.
+    process.stderr.write(`\n  ◇ serve-consent check degraded (${e.message}); proceeding without it.\n`)
+  }
+}
+
+refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken now set from env OR the stored login)
 
 // ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
 // The bridge calls the durable ledger RPCs as the OWNER (codeAuthToken); is_session_member
@@ -800,6 +843,12 @@ const announce = () =>
     // Additive top-level field; consumed by src/pages/code/room.jsx onAnnounce in
     // a later lane. Older clients ignore it.
     host,
+    // uid: the authed user id whose bridge is serving this room (owner or grantee).
+    // Additive field (older clients ignore it). A grantee bridge watches peer `bridge`
+    // announces for uid === owner_id to know the owner's bridge reclaimed the room and
+    // it must stand down (Contract C-CODE-3 invariant 3). No new topic — rides the
+    // existing announce (feedback_no_duplicate_realtime_channel).
+    uid: myServeUid || undefined,
     // provider: the LLM endpoint this bridge drives Claude Code through —
     // 'anthropic' (the default, the host's regular Claude login) or 'custom'
     // (any Anthropic-compatible base url: GLM/Z.ai, OpenRouter, a proxy). Shown
@@ -841,6 +890,21 @@ const announce = () =>
     ],
   })
 
+// Owner reclaim (Contract C-CODE-3 invariant 3): a grantee-served bridge that sees
+// the OWNER's bridge announce on this same room channel stands down — the owner's
+// bridge always wins. Reuses the existing `bridge` announce (its additive `uid`) — no
+// new topic (feedback_no_duplicate_realtime_channel). The owner's own bridge never
+// yields (standDownOnPeerAnnounce returns false for it). Clean shutdown(0): shuttingDown
+// suppresses the term-exit broadcast, so no structured terminal row is reaped
+// (docs/specs/2026-07-04-structured-terminal-durability.md — a handover must not delete rows).
+function onPeerBridgeAnnounce (payload) {
+  if (yielding) return
+  if (!standDownOnPeerAnnounce({ myUid: myServeUid, ownerId: roomOwnerId, peerUid: payload?.uid })) return
+  yielding = true
+  process.stderr.write(`\n  ◆ owner's bridge reconnected — yielding room ${room}.\n`)
+  shutdown(0)
+}
+
 // ── Thinkpool Ensemble — cross-ROOM reach (Tier 1: same-machine pair peek) ────
 // The in-room Ensemble (read_terminal over sibling terminals) expanded ACROSS the
 // account's OTHER rooms. The account supervisor (account.mjs) is the router: this
@@ -2478,6 +2542,9 @@ channel
     announce()
   })
   .on('broadcast', { event: 'who' }, announce)
+  // Peer bridge announces (owner reclaim) — a grantee yields when the owner's bridge
+  // reappears. broadcast self:false, so this only fires for OTHER bridges on the topic.
+  .on('broadcast', { event: 'bridge' }, ({ payload }) => onPeerBridgeAnnounce(payload))
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
@@ -2844,6 +2911,26 @@ setInterval(() => {
   }
 }, 15000).unref()
 
+// Grant revocation mid-serve (Contract C-CODE-3 invariant 3): a grantee re-checks the
+// row on a slow cadence — a cheap poll on the EXISTING REST endpoint, no new realtime
+// subscription (the owner-reclaim announce path above is the fast one). If the grant no
+// longer names this bridge (cleared or reassigned), stand down. Owner bridges never poll
+// (iServeAsGrantee is false for them). A flaky fetch never yields — next tick re-checks.
+if (iServeAsGrantee) {
+  const RECHECK_MS = Math.max(15000, parseInt(process.env.TP_SERVE_RECHECK_MS, 10) || 30000)
+  setInterval(async () => {
+    if (yielding) return
+    try {
+      const { grantUid } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
+      if (standDownOnGrantChange({ myUid: myServeUid, ownerId: roomOwnerId, grantUid })) {
+        yielding = true
+        process.stderr.write(`\n  ◆ serve grant revoked — yielding room ${room}.\n`)
+        shutdown(0)
+      }
+    } catch { /* transient — never yield on a flaky fetch; next tick re-checks */ }
+  }, RECHECK_MS).unref()
+}
+
 // ── auto-update (OS-service tier only) ─────────────────────────────────
 // launchd (KeepAlive) and systemd (Restart=always) re-run
 // `npx -y thinkpool-pair@latest` on every (re)start, so a clean exit here makes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.157",
+  "version": "0.7.158",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -31,6 +31,7 @@
     "flow-redispatch.mjs",
     "flow-skill-registry.mjs",
     "serve-dir.mjs",
+    "serve-consent.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",

package/serve-consent.mjs

@@ -0,0 +1,95 @@
+// Room-serve owner consent — decision core (pure) + row fetch.
+//
+// Spec: docs/specs/2026-07-04-room-serve-owner-consent.md (Contract C-CODE-3).
+// A room is served by its OWNER's bridge; a non-owner bridge may serve only with
+// the owner's explicit grant (`code_sessions.serve_grant_uid`); the owner's bridge
+// always wins reclaim, the grantee stands down.
+//
+// This module holds ONLY pure, order-independent decisions (unit-tested in
+// bridge/test-serve-consent.mjs) plus a single network helper. The wiring —
+// where the gate runs, when a grantee yields — lives in bridge.mjs. Keeping the
+// logic pure is the feedback_code_seed_order_independent discipline: no decision
+// depends on live channel/session state, so every branch is testable off-wire.
+//
+// LIMITATION (documented, spec Contract C-CODE-3 invariant 1): enforcement is
+// in-bridge. A bridge OLDER than this version never reads the column and bypasses
+// the check — there is no server-side wire-level lock. The grant is a coordination
+// signal honored by compliant bridges, not a serve token. Out of scope here.
+
+// serveDecision — may THIS bridge serve THIS room?
+//   ownerId  : code_sessions.owner_id (uuid | null)
+//   grantUid : code_sessions.serve_grant_uid (uuid | null)  — the one granted non-owner
+//   myUid    : this bridge's authed user id (uuid | null)   — null when the bridge is anon
+// Returns { serve, reason }:
+//   reason 'owner'       — myUid owns the room (always serves)
+//   reason 'grant'       — myUid is the granted non-owner
+//   reason 'no-identity' — bridge has no authed uid, so it can be neither owner nor
+//                          grantee → refuse (the new model has no anon serve path)
+//   reason 'not-granted' — authed, but neither owner nor the current grantee → refuse
+//   reason 'unknown-room'— no owner_id resolved (row missing / RLS-hidden) → refuse
+export function serveDecision ({ ownerId, grantUid, myUid }) {
+  if (!myUid) return { serve: false, reason: 'no-identity' }
+  if (!ownerId) return { serve: false, reason: 'unknown-room' }
+  if (myUid === ownerId) return { serve: true, reason: 'owner' }
+  if (grantUid && myUid === grantUid) return { serve: true, reason: 'grant' }
+  return { serve: false, reason: 'not-granted' }
+}
+
+// amGrantee — this bridge serves by grant (not as owner). Grantees are the only
+// bridges that ever stand down; the owner's bridge never yields.
+export function amGrantee ({ ownerId, grantUid, myUid }) {
+  return !!(myUid && myUid !== ownerId && grantUid && myUid === grantUid)
+}
+
+// standDownOnPeerAnnounce — a grantee-served bridge saw ANOTHER bridge announce on
+// the room channel. Yield iff that peer is the OWNER's bridge (peerUid === ownerId)
+// and I am not the owner. The owner's own bridge (myUid === ownerId) never yields —
+// serveDecision already refused any second non-owner, so a peer that isn't the owner
+// is either a stale duplicate of me or nothing to cede to.
+export function standDownOnPeerAnnounce ({ myUid, ownerId, peerUid }) {
+  if (!myUid || !ownerId) return false
+  if (myUid === ownerId) return false          // owner never stands down
+  return !!peerUid && peerUid === ownerId       // owner's bridge reclaimed → yield
+}
+
+// standDownOnGrantChange — a grantee re-checked the row and the grant no longer
+// names it (revoked, or reassigned to a third party). Yield. The owner never yields
+// on a grant change (the grant does not govern the owner).
+export function standDownOnGrantChange ({ myUid, ownerId, grantUid }) {
+  if (!myUid || myUid === ownerId) return false
+  return grantUid !== myUid
+}
+
+// fetchServeRow — read the room's consent columns with whatever identity the bridge
+// holds (authed token → RLS returns the row if the user is a member; anon → empty).
+// THROWS on a network/transport error so the caller can fail OPEN (never strand a
+// user on a flaky fetch). A clean HTTP response that simply yields no row is NOT a
+// throw — it returns { ownerId: null } and the caller refuses (unknown room).
+export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
+  const headers = { apikey: anonKey }
+  if (token) headers.Authorization = `Bearer ${token}`
+  const r = await fetch(
+    `${supabaseUrl}/rest/v1/code_sessions?select=owner_id,serve_grant_uid,name&code=eq.${encodeURIComponent(room)}`,
+    { headers },
+  )
+  if (!r.ok) throw new Error(`code_sessions fetch ${r.status}`)
+  const rows = await r.json()
+  const row = Array.isArray(rows) ? rows[0] : null
+  return {
+    ownerId: row?.owner_id ?? null,
+    grantUid: row?.serve_grant_uid ?? null,
+    name: row?.name ?? null,
+  }
+}
+
+// refusalMessage — the human-facing stderr line when a bridge refuses to serve.
+export function refusalMessage ({ room, name, reason }) {
+  const label = name ? `"${name}"` : '(unnamed)'
+  if (reason === 'no-identity') {
+    return `\n  ◇ Refusing to serve room ${room} — this bridge is not signed in.\n` +
+      `    A room is served by its owner's bridge. Sign in first:  npx thinkpool-pair login\n`
+  }
+  return `\n  ◇ Refusing to serve room ${room} ${label} — it is owned by another person; their bridge serves it.\n` +
+    `    Ask them to grant your machine hosting rights in the room (bridge status card),\n` +
+    `    then re-run. The grant is the only way in — there is no override flag.\n`
+}