thinkpool-pair 0.7.157 → 0.7.159

package/account.mjs

@@ -16,6 +16,7 @@ import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack } from './presence.mjs'
+import { supervisorServes } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 
@@ -529,26 +530,32 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       return
     }
     let rooms = []
+    const me = session.user.id
     try {
-      // Owner-only discovery (Contract C-CODE-2): a host bridges ONLY the sessions
-      // it CREATED. RLS on code_sessions returns owned OR participant rooms, so
-      // without this owner filter the supervisor auto-serves rooms you merely JOINED
-      // as a guest — spawning your machine into another owner's session that already
-      // runs its own bridge. The web watches tpacct:<session-owner>, so a
-      // participant's bridge is duplication the UI never even looks at.
-      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,participants').eq('owner_id', session.user.id).order('last_active_at', { ascending: false }).limit(20)
+      // Discovery (Contract C-CODE-2, evolved owner-only → owner-OR-granted): a host
+      // bridges the sessions it OWNS *plus* any it has been explicitly granted to serve
+      // (code_sessions.serve_grant_uid = me — the owner-consent grant, #206/#208). RLS
+      // returns owned OR participant rooms, and a grantee is ALWAYS a participant
+      // (set_serve_grant requires it), so a granted row is visible to this login. Without
+      // a filter the supervisor would auto-serve rooms you merely JOINED as a guest —
+      // spawning your machine into another owner's session that already runs its own
+      // bridge; the .or keeps un-granted joins out while letting a consented grant IN.
+      // The web watches tpacct:<session-owner>; a granted bridge serves on the owner's
+      // behalf (the grant IS the consent), so it is wanted duplication, not stray.
+      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,serve_grant_uid,participants').or(`owner_id.eq.${me},serve_grant_uid.eq.${me}`).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
-      // Prune refused entries for rooms we no longer own (only on a SUCCESSFUL fetch,
-      // so a transient query error never wipes the set).
-      const ownedCodes = new Set(rooms.map((r) => r.code))
-      for (const c of [...refused.keys()]) if (!ownedCodes.has(c)) refused.delete(c)
+      // Prune refused entries for rooms we can no longer serve — owned OR granted (only
+      // on a SUCCESSFUL fetch, so a transient query error never wipes the set).
+      const servableCodes = new Set(rooms.map((r) => r.code))
+      for (const c of [...refused.keys()]) if (!servableCodes.has(c)) refused.delete(c)
     } catch { /* transient — keep existing children, retry next tick */ }
     const dirs = loadDirs()
     const served = loadServed()
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
-      if (r.owner_id && r.owner_id !== session.user.id) continue   // never serve a room we don't own (defense-in-depth behind the .eq above)
+      // Defense-in-depth behind the .or above: serve iff we OWN the room or hold its grant.
+      if (!supervisorServes({ ownerId: r.owner_id, grantUid: r.serve_grant_uid, myUid: me })) continue
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
       // to auto-serve an unbound room from $HOME — that strips the agent's resume context
       // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).

package/bridge.mjs

@@ -37,6 +37,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
+import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage } from './serve-consent.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -569,7 +570,49 @@ async function refreshOwnerPlan() {
     if (rows?.[0]?.plan) ownerPlan = rows[0].plan === 'plus' ? 'plus' : 'free'
   } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
 }
-refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken may be set from env)
+// ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
+// A room is served by its OWNER's bridge; a non-owner may serve only with the
+// owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
+// realtime channel is even built — so a refused bridge never dials the room. Owner
+// reclaim (a grantee yields when the owner's bridge reappears) + grant revocation are
+// wired below on the EXISTING room channel / REST row — no new topic
+// (feedback_no_duplicate_realtime_channel, H41). LIMITATION: enforcement is in-bridge;
+// an OLDER bridge bypasses it (no wire-level lock). Spec: docs/specs/2026-07-04-room-serve-owner-consent.md.
+let roomOwnerId = null       // code_sessions.owner_id, learned at the gate
+let myServeUid = null        // this bridge's authed uid (null = anon)
+let iServeAsGrantee = false  // serving by grant, not as owner → the only bridge that yields
+let yielding = false         // set once when standing down, so reclaim + revoke don't double-fire
+{
+  // Standalone room mode ran anon unless TP_ACCESS_TOKEN was in env; load the stored
+  // login so `npx thinkpool-pair <CODE>` authenticates AS the signed-in user (the
+  // identity the consent check needs). Account children already carry the env token.
+  if (!codeAuthToken) {
+    try { const { loadAuth } = await import('./auth-store.mjs'); codeAuthToken = loadAuth()?.access_token || null } catch { /* no store — stays anon */ }
+  }
+  try {
+    if (codeAuthToken) {
+      const { data } = await supabase.auth.getUser(codeAuthToken)
+      myServeUid = data?.user?.id || null
+    }
+    const { ownerId, grantUid, name } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
+    roomOwnerId = ownerId
+    const decision = serveDecision({ ownerId, grantUid, myUid: myServeUid })
+    if (!decision.serve) {
+      process.stderr.write(refusalMessage({ room, name, reason: decision.reason }))
+      // exit 0 — an intentional stand-down, not a crash, so a supervisor does not
+      // thrash-restart it (matches the machine-lock stand-down at the top of boot).
+      process.exit(0)
+    }
+    iServeAsGrantee = amGrantee({ ownerId, grantUid, myUid: myServeUid })
+    if (iServeAsGrantee) process.stderr.write(`\n  ◆ serving room ${room} by the owner's grant — will yield if the owner's bridge returns or the grant is revoked.\n`)
+  } catch (e) {
+    // Fail OPEN on a network/transport error ONLY (spec: never strand a user on a
+    // flaky fetch). A clean "no row / not granted" is a decision above, not a throw.
+    process.stderr.write(`\n  ◇ serve-consent check degraded (${e.message}); proceeding without it.\n`)
+  }
+}
+
+refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken now set from env OR the stored login)
 
 // ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
 // The bridge calls the durable ledger RPCs as the OWNER (codeAuthToken); is_session_member
@@ -800,6 +843,12 @@ const announce = () =>
     // Additive top-level field; consumed by src/pages/code/room.jsx onAnnounce in
     // a later lane. Older clients ignore it.
     host,
+    // uid: the authed user id whose bridge is serving this room (owner or grantee).
+    // Additive field (older clients ignore it). A grantee bridge watches peer `bridge`
+    // announces for uid === owner_id to know the owner's bridge reclaimed the room and
+    // it must stand down (Contract C-CODE-3 invariant 3). No new topic — rides the
+    // existing announce (feedback_no_duplicate_realtime_channel).
+    uid: myServeUid || undefined,
     // provider: the LLM endpoint this bridge drives Claude Code through —
     // 'anthropic' (the default, the host's regular Claude login) or 'custom'
     // (any Anthropic-compatible base url: GLM/Z.ai, OpenRouter, a proxy). Shown
@@ -841,6 +890,21 @@ const announce = () =>
     ],
   })
 
+// Owner reclaim (Contract C-CODE-3 invariant 3): a grantee-served bridge that sees
+// the OWNER's bridge announce on this same room channel stands down — the owner's
+// bridge always wins. Reuses the existing `bridge` announce (its additive `uid`) — no
+// new topic (feedback_no_duplicate_realtime_channel). The owner's own bridge never
+// yields (standDownOnPeerAnnounce returns false for it). Clean shutdown(0): shuttingDown
+// suppresses the term-exit broadcast, so no structured terminal row is reaped
+// (docs/specs/2026-07-04-structured-terminal-durability.md — a handover must not delete rows).
+function onPeerBridgeAnnounce (payload) {
+  if (yielding) return
+  if (!standDownOnPeerAnnounce({ myUid: myServeUid, ownerId: roomOwnerId, peerUid: payload?.uid })) return
+  yielding = true
+  process.stderr.write(`\n  ◆ owner's bridge reconnected — yielding room ${room}.\n`)
+  shutdown(0)
+}
+
 // ── Thinkpool Ensemble — cross-ROOM reach (Tier 1: same-machine pair peek) ────
 // The in-room Ensemble (read_terminal over sibling terminals) expanded ACROSS the
 // account's OTHER rooms. The account supervisor (account.mjs) is the router: this
@@ -2478,6 +2542,9 @@ channel
     announce()
   })
   .on('broadcast', { event: 'who' }, announce)
+  // Peer bridge announces (owner reclaim) — a grantee yields when the owner's bridge
+  // reappears. broadcast self:false, so this only fires for OTHER bridges on the topic.
+  .on('broadcast', { event: 'bridge' }, ({ payload }) => onPeerBridgeAnnounce(payload))
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
@@ -2844,6 +2911,26 @@ setInterval(() => {
   }
 }, 15000).unref()
 
+// Grant revocation mid-serve (Contract C-CODE-3 invariant 3): a grantee re-checks the
+// row on a slow cadence — a cheap poll on the EXISTING REST endpoint, no new realtime
+// subscription (the owner-reclaim announce path above is the fast one). If the grant no
+// longer names this bridge (cleared or reassigned), stand down. Owner bridges never poll
+// (iServeAsGrantee is false for them). A flaky fetch never yields — next tick re-checks.
+if (iServeAsGrantee) {
+  const RECHECK_MS = Math.max(15000, parseInt(process.env.TP_SERVE_RECHECK_MS, 10) || 30000)
+  setInterval(async () => {
+    if (yielding) return
+    try {
+      const { grantUid } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
+      if (standDownOnGrantChange({ myUid: myServeUid, ownerId: roomOwnerId, grantUid })) {
+        yielding = true
+        process.stderr.write(`\n  ◆ serve grant revoked — yielding room ${room}.\n`)
+        shutdown(0)
+      }
+    } catch { /* transient — never yield on a flaky fetch; next tick re-checks */ }
+  }, RECHECK_MS).unref()
+}
+
 // ── auto-update (OS-service tier only) ─────────────────────────────────
 // launchd (KeepAlive) and systemd (Restart=always) re-run
 // `npx -y thinkpool-pair@latest` on every (re)start, so a clean exit here makes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.157",
+  "version": "0.7.159",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -31,6 +31,7 @@
     "flow-redispatch.mjs",
     "flow-skill-registry.mjs",
     "serve-dir.mjs",
+    "serve-consent.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",

package/serve-consent.mjs

@@ -0,0 +1,107 @@
+// Room-serve owner consent — decision core (pure) + row fetch.
+//
+// Spec: docs/specs/2026-07-04-room-serve-owner-consent.md (Contract C-CODE-3).
+// A room is served by its OWNER's bridge; a non-owner bridge may serve only with
+// the owner's explicit grant (`code_sessions.serve_grant_uid`); the owner's bridge
+// always wins reclaim, the grantee stands down.
+//
+// This module holds ONLY pure, order-independent decisions (unit-tested in
+// bridge/test-serve-consent.mjs) plus a single network helper. The wiring —
+// where the gate runs, when a grantee yields — lives in bridge.mjs. Keeping the
+// logic pure is the feedback_code_seed_order_independent discipline: no decision
+// depends on live channel/session state, so every branch is testable off-wire.
+//
+// LIMITATION (documented, spec Contract C-CODE-3 invariant 1): enforcement is
+// in-bridge. A bridge OLDER than this version never reads the column and bypasses
+// the check — there is no server-side wire-level lock. The grant is a coordination
+// signal honored by compliant bridges, not a serve token. Out of scope here.
+
+// serveDecision — may THIS bridge serve THIS room?
+//   ownerId  : code_sessions.owner_id (uuid | null)
+//   grantUid : code_sessions.serve_grant_uid (uuid | null)  — the one granted non-owner
+//   myUid    : this bridge's authed user id (uuid | null)   — null when the bridge is anon
+// Returns { serve, reason }:
+//   reason 'owner'       — myUid owns the room (always serves)
+//   reason 'grant'       — myUid is the granted non-owner
+//   reason 'no-identity' — bridge has no authed uid, so it can be neither owner nor
+//                          grantee → refuse (the new model has no anon serve path)
+//   reason 'not-granted' — authed, but neither owner nor the current grantee → refuse
+//   reason 'unknown-room'— no owner_id resolved (row missing / RLS-hidden) → refuse
+export function serveDecision ({ ownerId, grantUid, myUid }) {
+  if (!myUid) return { serve: false, reason: 'no-identity' }
+  if (!ownerId) return { serve: false, reason: 'unknown-room' }
+  if (myUid === ownerId) return { serve: true, reason: 'owner' }
+  if (grantUid && myUid === grantUid) return { serve: true, reason: 'grant' }
+  return { serve: false, reason: 'not-granted' }
+}
+
+// supervisorServes — the account supervisor's per-row discovery decision: may this
+// login auto-serve THIS discovered room? True iff the login OWNS the room or HOLDS its
+// serve grant. This is the defense-in-depth per-row check behind the supervisor's
+// `.or(owner_id.eq.me,serve_grant_uid.eq.me)` query — a broad RLS row (owned OR merely
+// participant) must still resolve to owned-or-granted before a child is spawned. Mirrors
+// serveDecision's owner|grant serve set, evaluated against a discovery row rather than a
+// gate fetch (Contract C-CODE-2, evolved owner-only → owner-or-granted).
+export function supervisorServes ({ ownerId, grantUid, myUid }) {
+  if (!myUid) return false
+  return ownerId === myUid || grantUid === myUid
+}
+
+// amGrantee — this bridge serves by grant (not as owner). Grantees are the only
+// bridges that ever stand down; the owner's bridge never yields.
+export function amGrantee ({ ownerId, grantUid, myUid }) {
+  return !!(myUid && myUid !== ownerId && grantUid && myUid === grantUid)
+}
+
+// standDownOnPeerAnnounce — a grantee-served bridge saw ANOTHER bridge announce on
+// the room channel. Yield iff that peer is the OWNER's bridge (peerUid === ownerId)
+// and I am not the owner. The owner's own bridge (myUid === ownerId) never yields —
+// serveDecision already refused any second non-owner, so a peer that isn't the owner
+// is either a stale duplicate of me or nothing to cede to.
+export function standDownOnPeerAnnounce ({ myUid, ownerId, peerUid }) {
+  if (!myUid || !ownerId) return false
+  if (myUid === ownerId) return false          // owner never stands down
+  return !!peerUid && peerUid === ownerId       // owner's bridge reclaimed → yield
+}
+
+// standDownOnGrantChange — a grantee re-checked the row and the grant no longer
+// names it (revoked, or reassigned to a third party). Yield. The owner never yields
+// on a grant change (the grant does not govern the owner).
+export function standDownOnGrantChange ({ myUid, ownerId, grantUid }) {
+  if (!myUid || myUid === ownerId) return false
+  return grantUid !== myUid
+}
+
+// fetchServeRow — read the room's consent columns with whatever identity the bridge
+// holds (authed token → RLS returns the row if the user is a member; anon → empty).
+// THROWS on a network/transport error so the caller can fail OPEN (never strand a
+// user on a flaky fetch). A clean HTTP response that simply yields no row is NOT a
+// throw — it returns { ownerId: null } and the caller refuses (unknown room).
+export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
+  const headers = { apikey: anonKey }
+  if (token) headers.Authorization = `Bearer ${token}`
+  const r = await fetch(
+    `${supabaseUrl}/rest/v1/code_sessions?select=owner_id,serve_grant_uid,name&code=eq.${encodeURIComponent(room)}`,
+    { headers },
+  )
+  if (!r.ok) throw new Error(`code_sessions fetch ${r.status}`)
+  const rows = await r.json()
+  const row = Array.isArray(rows) ? rows[0] : null
+  return {
+    ownerId: row?.owner_id ?? null,
+    grantUid: row?.serve_grant_uid ?? null,
+    name: row?.name ?? null,
+  }
+}
+
+// refusalMessage — the human-facing stderr line when a bridge refuses to serve.
+export function refusalMessage ({ room, name, reason }) {
+  const label = name ? `"${name}"` : '(unnamed)'
+  if (reason === 'no-identity') {
+    return `\n  ◇ Refusing to serve room ${room} — this bridge is not signed in.\n` +
+      `    A room is served by its owner's bridge. Sign in first:  npx thinkpool-pair login\n`
+  }
+  return `\n  ◇ Refusing to serve room ${room} ${label} — it is owned by another person; their bridge serves it.\n` +
+    `    Ask them to grant your machine hosting rights in the room (bridge status card),\n` +
+    `    then re-run. The grant is the only way in — there is no override flag.\n`
+}