thinkpool-pair 0.7.158 → 0.7.160

package/account.mjs

@@ -16,6 +16,7 @@ import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack } from './presence.mjs'
+import { supervisorServes, shouldCooldownOnExit, roomInCooldown } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 
@@ -230,6 +231,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: npx thinkpool-pair set-default-dir <dir>  ·  one room: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
+  // grantCooldown: room -> wall-clock ms deadline. A grantee child that yielded to the
+  // owner's returning bridge (exit 75) parks its room here so discovery does NOT re-spawn a
+  // child that would only yield again — the owner-serves/grantee-stands-by coexistence state
+  // must not thrash-churn every 15s tick (DEFECT 2, 2026-07-05). Expires after TP_GRANT_COOLDOWN_MS;
+  // after that discovery retries once — serving normally if the owner has since gone.
+  const grantCooldown = new Map()
+  const GRANT_COOLDOWN_MS = Math.max(15_000, parseInt(process.env.TP_GRANT_COOLDOWN_MS, 10) || 120_000)
   const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
   const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
@@ -529,26 +537,39 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       return
     }
     let rooms = []
+    const me = session.user.id
     try {
-      // Owner-only discovery (Contract C-CODE-2): a host bridges ONLY the sessions
-      // it CREATED. RLS on code_sessions returns owned OR participant rooms, so
-      // without this owner filter the supervisor auto-serves rooms you merely JOINED
-      // as a guest — spawning your machine into another owner's session that already
-      // runs its own bridge. The web watches tpacct:<session-owner>, so a
-      // participant's bridge is duplication the UI never even looks at.
-      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,participants').eq('owner_id', session.user.id).order('last_active_at', { ascending: false }).limit(20)
+      // Discovery (Contract C-CODE-2, evolved owner-only → owner-OR-granted): a host
+      // bridges the sessions it OWNS *plus* any it has been explicitly granted to serve
+      // (code_sessions.serve_grant_uid = me — the owner-consent grant, #206/#208). RLS
+      // returns owned OR participant rooms, and a grantee is ALWAYS a participant
+      // (set_serve_grant requires it), so a granted row is visible to this login. Without
+      // a filter the supervisor would auto-serve rooms you merely JOINED as a guest —
+      // spawning your machine into another owner's session that already runs its own
+      // bridge; the .or keeps un-granted joins out while letting a consented grant IN.
+      // The web watches tpacct:<session-owner>; a granted bridge serves on the owner's
+      // behalf (the grant IS the consent), so it is wanted duplication, not stray.
+      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,serve_grant_uid,participants').or(`owner_id.eq.${me},serve_grant_uid.eq.${me}`).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
-      // Prune refused entries for rooms we no longer own (only on a SUCCESSFUL fetch,
-      // so a transient query error never wipes the set).
-      const ownedCodes = new Set(rooms.map((r) => r.code))
-      for (const c of [...refused.keys()]) if (!ownedCodes.has(c)) refused.delete(c)
+      // Prune refused entries for rooms we can no longer serve — owned OR granted (only
+      // on a SUCCESSFUL fetch, so a transient query error never wipes the set).
+      const servableCodes = new Set(rooms.map((r) => r.code))
+      for (const c of [...refused.keys()]) if (!servableCodes.has(c)) refused.delete(c)
     } catch { /* transient — keep existing children, retry next tick */ }
     const dirs = loadDirs()
     const served = loadServed()
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
-      if (r.owner_id && r.owner_id !== session.user.id) continue   // never serve a room we don't own (defense-in-depth behind the .eq above)
+      // Grant-reclaim cooldown (DEFECT 2): this room's grantee child recently yielded to the
+      // owner's bridge (exit 75). Skip re-serving it until the window elapses so we don't
+      // thrash-respawn a child that will only yield again. refused already reads 'owner-serves'
+      // (set on that exit below), so presence stays honest while we stand by.
+      const cdUntil = grantCooldown.get(room)
+      if (roomInCooldown(cdUntil, Date.now())) continue
+      if (cdUntil) grantCooldown.delete(room)   // window elapsed — allow one fresh attempt (owner may have gone)
+      // Defense-in-depth behind the .or above: serve iff we OWN the room or hold its grant.
+      if (!supervisorServes({ ownerId: r.owner_id, grantUid: r.serve_grant_uid, myUid: me })) continue
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
       // to auto-serve an unbound room from $HOME — that strips the agent's resume context
       // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).
@@ -666,13 +687,22 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           try { w.reply(m) } catch { /* reply path gone */ }
         }
       })
-      const dropRoom = () => {
+      const dropRoom = (code) => {
         children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room); roomNames.delete(room); roomPartner.delete(room)   // re-served on the next tick
+        // Owner-reclaim SENTINEL (75): the grantee child stood down because the owner's bridge
+        // returned. Park the room on a cooldown so discovery doesn't respawn it into another
+        // immediate yield (DEFECT 2), and mark refused 'owner-serves' so presence is honest.
+        // A revoke-yield exits 0 (discovery drops a revoked room anyway); owner-owned rooms
+        // never yield, so neither cools down. `code` is undefined on the 'error' path — fine.
+        if (shouldCooldownOnExit(code)) {
+          grantCooldown.set(room, Date.now() + GRANT_COOLDOWN_MS)
+          refused.set(room, 'owner-serves')
+        }
         // Fail any in-flight cross-room peeks/posts this dead room had ASKED (bus-origin
         // entries have askerRoom null and just time out on their own).
         for (const [reqId, w] of pairPending) { if (w?.askerRoom === room) pairPending.delete(reqId) }
       }
-      child.on('exit', dropRoom)
+      child.on('exit', (code) => dropRoom(code))
       // A spawn that never starts (execPath/cwd vanished between the existsSync check and
       // spawn) emits 'error', NOT 'exit'. Without this handler the stale children-map entry
       // would block re-serving forever AND an unhandled 'error' would crash the supervisor.

package/bridge.mjs

@@ -37,7 +37,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
-import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage } from './serve-consent.mjs'
+import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage, gateFailAction, GRANT_RECLAIM_EXIT } from './serve-consent.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -586,8 +586,33 @@ let yielding = false         // set once when standing down, so reclaim + revoke
   // Standalone room mode ran anon unless TP_ACCESS_TOKEN was in env; load the stored
   // login so `npx thinkpool-pair <CODE>` authenticates AS the signed-in user (the
   // identity the consent check needs). Account children already carry the env token.
+  // Refresh the stored access token BEFORE the gate (DEFECT 1, 2026-07-05). A stored
+  // access token is minted at login and Supabase access tokens expire ~1h; a long-lived
+  // standalone bridge — or a service relaunched from a stale store — would otherwise hit
+  // the RLS-gated gate with a DEAD token: fetchServeRow → 401, which (old behavior) masked
+  // as a network error and FAILED OPEN → the consent gate was bypassed in the common case.
+  // authedClient exchanges the rotated refresh token for a live pair and persists it via
+  // saveAuth (refresh-token rotation: the used token is now dead, so the store must never be
+  // left on the stale pair). Only refresh when the token came from the STORE — an env token
+  // (TP_ACCESS_TOKEN, from a supervisor that already keeps it fresh) is left untouched.
+  let tokenFromStore = false
   if (!codeAuthToken) {
-    try { const { loadAuth } = await import('./auth-store.mjs'); codeAuthToken = loadAuth()?.access_token || null } catch { /* no store — stays anon */ }
+    try {
+      const { loadAuth } = await import('./auth-store.mjs')
+      codeAuthToken = loadAuth()?.access_token || null
+      if (codeAuthToken) tokenFromStore = true
+    } catch { /* no store — stays anon */ }
+  }
+  if (tokenFromStore) {
+    try {
+      const { authedClient } = await import('./account.mjs')
+      const refreshed = await authedClient(SUPABASE_URL, SUPABASE_ANON)
+      if (refreshed?.session?.access_token) codeAuthToken = refreshed.session.access_token
+      // If the refresh FAILS (dead refresh token / offline), keep the stale token: an
+      // offline refresh must not strand a legit owner. A dead refresh token then yields a
+      // 401 at fetchServeRow → refuse (correct: the login is genuinely gone); a transient
+      // offline refresh yields a fetch reject → fail-open (correct: availability).
+    } catch { /* account module / refresh failed — proceed with the stored token */ }
   }
   try {
     if (codeAuthToken) {
@@ -606,8 +631,15 @@ let yielding = false         // set once when standing down, so reclaim + revoke
     iServeAsGrantee = amGrantee({ ownerId, grantUid, myUid: myServeUid })
     if (iServeAsGrantee) process.stderr.write(`\n  ◆ serving room ${room} by the owner's grant — will yield if the owner's bridge returns or the grant is revoked.\n`)
   } catch (e) {
-    // Fail OPEN on a network/transport error ONLY (spec: never strand a user on a
-    // flaky fetch). A clean "no row / not granted" is a decision above, not a throw.
+    // A THROWN fetchServeRow error is either a definitively-bad auth (401/403) or an
+    // availability failure (5xx / transport reject). Only the latter fails OPEN — a stale
+    // 401 must NEVER serve, or the gate is bypassed (DEFECT 1). gateFailAction classifies.
+    if (gateFailAction(e) === 'refuse') {
+      process.stderr.write(refusalMessage({ room, name: null, reason: 'no-identity' }))
+      process.stderr.write(`\n  ◇ (serve-consent: auth rejected at the gate — ${e.message}; the stored login is expired or revoked. Re-run: npx thinkpool-pair login)\n`)
+      process.exit(0)
+    }
+    // Availability failure → fail OPEN (spec: never strand a user on a flaky fetch).
     process.stderr.write(`\n  ◇ serve-consent check degraded (${e.message}); proceeding without it.\n`)
   }
 }
@@ -902,7 +934,13 @@ function onPeerBridgeAnnounce (payload) {
   if (!standDownOnPeerAnnounce({ myUid: myServeUid, ownerId: roomOwnerId, peerUid: payload?.uid })) return
   yielding = true
   process.stderr.write(`\n  ◆ owner's bridge reconnected — yielding room ${room}.\n`)
-  shutdown(0)
+  // Exit with the grant-reclaim SENTINEL (not a clean 0). A supervisor that spawned this
+  // grantee child reads the code and puts the room on a cooldown, so it does NOT respawn a
+  // child that will only yield again — the owner-serves/grantee-stands-by coexistence state
+  // must not thrash-churn every discovery tick (DEFECT 2, 2026-07-05). shutdown() still sets
+  // shuttingDown FIRST, so the term-exit broadcast stays suppressed and structured terminal
+  // rows survive the stand-down (#205/#208 durability — a handover must not delete rows).
+  shutdown(GRANT_RECLAIM_EXIT)
 }
 
 // ── Thinkpool Ensemble — cross-ROOM reach (Tier 1: same-machine pair peek) ────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.158",
+  "version": "0.7.160",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/serve-consent.mjs

@@ -35,6 +35,18 @@ export function serveDecision ({ ownerId, grantUid, myUid }) {
   return { serve: false, reason: 'not-granted' }
 }
 
+// supervisorServes — the account supervisor's per-row discovery decision: may this
+// login auto-serve THIS discovered room? True iff the login OWNS the room or HOLDS its
+// serve grant. This is the defense-in-depth per-row check behind the supervisor's
+// `.or(owner_id.eq.me,serve_grant_uid.eq.me)` query — a broad RLS row (owned OR merely
+// participant) must still resolve to owned-or-granted before a child is spawned. Mirrors
+// serveDecision's owner|grant serve set, evaluated against a discovery row rather than a
+// gate fetch (Contract C-CODE-2, evolved owner-only → owner-or-granted).
+export function supervisorServes ({ ownerId, grantUid, myUid }) {
+  if (!myUid) return false
+  return ownerId === myUid || grantUid === myUid
+}
+
 // amGrantee — this bridge serves by grant (not as owner). Grantees are the only
 // bridges that ever stand down; the owner's bridge never yields.
 export function amGrantee ({ ownerId, grantUid, myUid }) {
@@ -62,9 +74,16 @@ export function standDownOnGrantChange ({ myUid, ownerId, grantUid }) {
 
 // fetchServeRow — read the room's consent columns with whatever identity the bridge
 // holds (authed token → RLS returns the row if the user is a member; anon → empty).
-// THROWS on a network/transport error so the caller can fail OPEN (never strand a
-// user on a flaky fetch). A clean HTTP response that simply yields no row is NOT a
-// throw — it returns { ownerId: null } and the caller refuses (unknown room).
+// THROWS on a non-OK response or a transport error. The thrown error carries `.authHard`
+// so the caller can tell the two apart (Contract C-CODE-3 invariant 2, hardened 2026-07-05):
+//   - 401/403 (authHard === true) → auth is DEFINITIVELY bad (dead/expired token). The
+//     caller REFUSES: a stale access token must never fail OPEN into serving, or the gate
+//     is bypassed in the common case (stored tokens expire ~1h). The caller refreshes the
+//     token BEFORE the gate, so a 401 here means the refresh also failed → genuinely unauthed.
+//   - 5xx / genuine fetch() reject (authHard === false) → availability failure. The caller
+//     fails OPEN (never strand a user on a flaky network / a Supabase blip).
+// A clean HTTP response that simply yields no row is NOT a throw — it returns
+// { ownerId: null } and the caller refuses (unknown room).
 export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
   const headers = { apikey: anonKey }
   if (token) headers.Authorization = `Bearer ${token}`
@@ -72,7 +91,12 @@ export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
     `${supabaseUrl}/rest/v1/code_sessions?select=owner_id,serve_grant_uid,name&code=eq.${encodeURIComponent(room)}`,
     { headers },
   )
-  if (!r.ok) throw new Error(`code_sessions fetch ${r.status}`)
+  if (!r.ok) {
+    const err = new Error(`code_sessions fetch ${r.status}`)
+    err.status = r.status
+    err.authHard = r.status === 401 || r.status === 403
+    throw err
+  }
   const rows = await r.json()
   const row = Array.isArray(rows) ? rows[0] : null
   return {
@@ -82,6 +106,36 @@ export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
   }
 }
 
+// gateFailAction — pure classifier for a THROWN fetchServeRow error at the boot gate.
+// 'refuse'    — auth is definitively bad (401/403 after a token refresh); do NOT fail open.
+// 'fail-open' — an availability error (5xx, offline, transport reject); serve rather than
+//               strand a user on a flaky fetch. This is the ONLY fail-open path.
+export function gateFailAction (err) {
+  return err?.authHard ? 'refuse' : 'fail-open'
+}
+
+// ── supervisor grant-reclaim cooldown (DEFECT 2, 2026-07-05) ──────────────────
+// A grantee child that yields to the owner's returning bridge exits with this SENTINEL
+// code (distinct from a clean 0 / a crash 1). The supervisor reads the exit code and puts
+// the room on a cooldown so it does NOT thrash-respawn a child that will only yield again —
+// the feature's INTENDED coexistence state (owner serves, grantee stands by) must not churn.
+// A revoke-yield keeps exit 0 (discovery drops a revoked room anyway); owner-owned rooms
+// never yield, so they never cool down.
+export const GRANT_RECLAIM_EXIT = 75
+
+// shouldCooldownOnExit — did this child exit BECAUSE the owner reclaimed the room (75)?
+// Only that exit arms the cooldown; a clean stop (0), a crash (1), or a signal (null) do not.
+export function shouldCooldownOnExit (code) {
+  return code === GRANT_RECLAIM_EXIT
+}
+
+// roomInCooldown — is a room still inside its grant-reclaim cooldown window? The supervisor
+// discovery tick skips re-serving while this is true. `until` is a wall-clock ms deadline
+// (Date.now() + window); a null/expired deadline means serve again (owner may have gone).
+export function roomInCooldown (until, now) {
+  return !!(until && now < until)
+}
+
 // refusalMessage — the human-facing stderr line when a bridge refuses to serve.
 export function refusalMessage ({ room, name, reason }) {
   const label = name ? `"${name}"` : '(unnamed)'