thinkpool-pair 0.7.159 → 0.7.160

package/account.mjs

@@ -16,7 +16,7 @@ import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, loadDefaultDir, saveDefaultDir, claudeRecentProjectDir } from './auth-store.mjs'
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack } from './presence.mjs'
-import { supervisorServes } from './serve-consent.mjs'
+import { supervisorServes, shouldCooldownOnExit, roomInCooldown } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 
@@ -231,6 +231,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: npx thinkpool-pair set-default-dir <dir>  ·  one room: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
+  // grantCooldown: room -> wall-clock ms deadline. A grantee child that yielded to the
+  // owner's returning bridge (exit 75) parks its room here so discovery does NOT re-spawn a
+  // child that would only yield again — the owner-serves/grantee-stands-by coexistence state
+  // must not thrash-churn every 15s tick (DEFECT 2, 2026-07-05). Expires after TP_GRANT_COOLDOWN_MS;
+  // after that discovery retries once — serving normally if the owner has since gone.
+  const grantCooldown = new Map()
+  const GRANT_COOLDOWN_MS = Math.max(15_000, parseInt(process.env.TP_GRANT_COOLDOWN_MS, 10) || 120_000)
   const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
   const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
@@ -554,6 +561,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
+      // Grant-reclaim cooldown (DEFECT 2): this room's grantee child recently yielded to the
+      // owner's bridge (exit 75). Skip re-serving it until the window elapses so we don't
+      // thrash-respawn a child that will only yield again. refused already reads 'owner-serves'
+      // (set on that exit below), so presence stays honest while we stand by.
+      const cdUntil = grantCooldown.get(room)
+      if (roomInCooldown(cdUntil, Date.now())) continue
+      if (cdUntil) grantCooldown.delete(room)   // window elapsed — allow one fresh attempt (owner may have gone)
       // Defense-in-depth behind the .or above: serve iff we OWN the room or hold its grant.
       if (!supervisorServes({ ownerId: r.owner_id, grantUid: r.serve_grant_uid, myUid: me })) continue
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
@@ -673,13 +687,22 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
           try { w.reply(m) } catch { /* reply path gone */ }
         }
       })
-      const dropRoom = () => {
+      const dropRoom = (code) => {
         children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room); roomNames.delete(room); roomPartner.delete(room)   // re-served on the next tick
+        // Owner-reclaim SENTINEL (75): the grantee child stood down because the owner's bridge
+        // returned. Park the room on a cooldown so discovery doesn't respawn it into another
+        // immediate yield (DEFECT 2), and mark refused 'owner-serves' so presence is honest.
+        // A revoke-yield exits 0 (discovery drops a revoked room anyway); owner-owned rooms
+        // never yield, so neither cools down. `code` is undefined on the 'error' path — fine.
+        if (shouldCooldownOnExit(code)) {
+          grantCooldown.set(room, Date.now() + GRANT_COOLDOWN_MS)
+          refused.set(room, 'owner-serves')
+        }
         // Fail any in-flight cross-room peeks/posts this dead room had ASKED (bus-origin
         // entries have askerRoom null and just time out on their own).
         for (const [reqId, w] of pairPending) { if (w?.askerRoom === room) pairPending.delete(reqId) }
       }
-      child.on('exit', dropRoom)
+      child.on('exit', (code) => dropRoom(code))
       // A spawn that never starts (execPath/cwd vanished between the existsSync check and
       // spawn) emits 'error', NOT 'exit'. Without this handler the stale children-map entry
       // would block re-serving forever AND an unhandled 'error' would crash the supervisor.

package/bridge.mjs

@@ -37,7 +37,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
-import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage } from './serve-consent.mjs'
+import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage, gateFailAction, GRANT_RECLAIM_EXIT } from './serve-consent.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -586,8 +586,33 @@ let yielding = false         // set once when standing down, so reclaim + revoke
   // Standalone room mode ran anon unless TP_ACCESS_TOKEN was in env; load the stored
   // login so `npx thinkpool-pair <CODE>` authenticates AS the signed-in user (the
   // identity the consent check needs). Account children already carry the env token.
+  // Refresh the stored access token BEFORE the gate (DEFECT 1, 2026-07-05). A stored
+  // access token is minted at login and Supabase access tokens expire ~1h; a long-lived
+  // standalone bridge — or a service relaunched from a stale store — would otherwise hit
+  // the RLS-gated gate with a DEAD token: fetchServeRow → 401, which (old behavior) masked
+  // as a network error and FAILED OPEN → the consent gate was bypassed in the common case.
+  // authedClient exchanges the rotated refresh token for a live pair and persists it via
+  // saveAuth (refresh-token rotation: the used token is now dead, so the store must never be
+  // left on the stale pair). Only refresh when the token came from the STORE — an env token
+  // (TP_ACCESS_TOKEN, from a supervisor that already keeps it fresh) is left untouched.
+  let tokenFromStore = false
   if (!codeAuthToken) {
-    try { const { loadAuth } = await import('./auth-store.mjs'); codeAuthToken = loadAuth()?.access_token || null } catch { /* no store — stays anon */ }
+    try {
+      const { loadAuth } = await import('./auth-store.mjs')
+      codeAuthToken = loadAuth()?.access_token || null
+      if (codeAuthToken) tokenFromStore = true
+    } catch { /* no store — stays anon */ }
+  }
+  if (tokenFromStore) {
+    try {
+      const { authedClient } = await import('./account.mjs')
+      const refreshed = await authedClient(SUPABASE_URL, SUPABASE_ANON)
+      if (refreshed?.session?.access_token) codeAuthToken = refreshed.session.access_token
+      // If the refresh FAILS (dead refresh token / offline), keep the stale token: an
+      // offline refresh must not strand a legit owner. A dead refresh token then yields a
+      // 401 at fetchServeRow → refuse (correct: the login is genuinely gone); a transient
+      // offline refresh yields a fetch reject → fail-open (correct: availability).
+    } catch { /* account module / refresh failed — proceed with the stored token */ }
   }
   try {
     if (codeAuthToken) {
@@ -606,8 +631,15 @@ let yielding = false         // set once when standing down, so reclaim + revoke
     iServeAsGrantee = amGrantee({ ownerId, grantUid, myUid: myServeUid })
     if (iServeAsGrantee) process.stderr.write(`\n  ◆ serving room ${room} by the owner's grant — will yield if the owner's bridge returns or the grant is revoked.\n`)
   } catch (e) {
-    // Fail OPEN on a network/transport error ONLY (spec: never strand a user on a
-    // flaky fetch). A clean "no row / not granted" is a decision above, not a throw.
+    // A THROWN fetchServeRow error is either a definitively-bad auth (401/403) or an
+    // availability failure (5xx / transport reject). Only the latter fails OPEN — a stale
+    // 401 must NEVER serve, or the gate is bypassed (DEFECT 1). gateFailAction classifies.
+    if (gateFailAction(e) === 'refuse') {
+      process.stderr.write(refusalMessage({ room, name: null, reason: 'no-identity' }))
+      process.stderr.write(`\n  ◇ (serve-consent: auth rejected at the gate — ${e.message}; the stored login is expired or revoked. Re-run: npx thinkpool-pair login)\n`)
+      process.exit(0)
+    }
+    // Availability failure → fail OPEN (spec: never strand a user on a flaky fetch).
     process.stderr.write(`\n  ◇ serve-consent check degraded (${e.message}); proceeding without it.\n`)
   }
 }
@@ -902,7 +934,13 @@ function onPeerBridgeAnnounce (payload) {
   if (!standDownOnPeerAnnounce({ myUid: myServeUid, ownerId: roomOwnerId, peerUid: payload?.uid })) return
   yielding = true
   process.stderr.write(`\n  ◆ owner's bridge reconnected — yielding room ${room}.\n`)
-  shutdown(0)
+  // Exit with the grant-reclaim SENTINEL (not a clean 0). A supervisor that spawned this
+  // grantee child reads the code and puts the room on a cooldown, so it does NOT respawn a
+  // child that will only yield again — the owner-serves/grantee-stands-by coexistence state
+  // must not thrash-churn every discovery tick (DEFECT 2, 2026-07-05). shutdown() still sets
+  // shuttingDown FIRST, so the term-exit broadcast stays suppressed and structured terminal
+  // rows survive the stand-down (#205/#208 durability — a handover must not delete rows).
+  shutdown(GRANT_RECLAIM_EXIT)
 }
 
 // ── Thinkpool Ensemble — cross-ROOM reach (Tier 1: same-machine pair peek) ────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.159",
+  "version": "0.7.160",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/serve-consent.mjs

@@ -74,9 +74,16 @@ export function standDownOnGrantChange ({ myUid, ownerId, grantUid }) {
 
 // fetchServeRow — read the room's consent columns with whatever identity the bridge
 // holds (authed token → RLS returns the row if the user is a member; anon → empty).
-// THROWS on a network/transport error so the caller can fail OPEN (never strand a
-// user on a flaky fetch). A clean HTTP response that simply yields no row is NOT a
-// throw — it returns { ownerId: null } and the caller refuses (unknown room).
+// THROWS on a non-OK response or a transport error. The thrown error carries `.authHard`
+// so the caller can tell the two apart (Contract C-CODE-3 invariant 2, hardened 2026-07-05):
+//   - 401/403 (authHard === true) → auth is DEFINITIVELY bad (dead/expired token). The
+//     caller REFUSES: a stale access token must never fail OPEN into serving, or the gate
+//     is bypassed in the common case (stored tokens expire ~1h). The caller refreshes the
+//     token BEFORE the gate, so a 401 here means the refresh also failed → genuinely unauthed.
+//   - 5xx / genuine fetch() reject (authHard === false) → availability failure. The caller
+//     fails OPEN (never strand a user on a flaky network / a Supabase blip).
+// A clean HTTP response that simply yields no row is NOT a throw — it returns
+// { ownerId: null } and the caller refuses (unknown room).
 export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
   const headers = { apikey: anonKey }
   if (token) headers.Authorization = `Bearer ${token}`
@@ -84,7 +91,12 @@ export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
     `${supabaseUrl}/rest/v1/code_sessions?select=owner_id,serve_grant_uid,name&code=eq.${encodeURIComponent(room)}`,
     { headers },
   )
-  if (!r.ok) throw new Error(`code_sessions fetch ${r.status}`)
+  if (!r.ok) {
+    const err = new Error(`code_sessions fetch ${r.status}`)
+    err.status = r.status
+    err.authHard = r.status === 401 || r.status === 403
+    throw err
+  }
   const rows = await r.json()
   const row = Array.isArray(rows) ? rows[0] : null
   return {
@@ -94,6 +106,36 @@ export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
   }
 }
 
+// gateFailAction — pure classifier for a THROWN fetchServeRow error at the boot gate.
+// 'refuse'    — auth is definitively bad (401/403 after a token refresh); do NOT fail open.
+// 'fail-open' — an availability error (5xx, offline, transport reject); serve rather than
+//               strand a user on a flaky fetch. This is the ONLY fail-open path.
+export function gateFailAction (err) {
+  return err?.authHard ? 'refuse' : 'fail-open'
+}
+
+// ── supervisor grant-reclaim cooldown (DEFECT 2, 2026-07-05) ──────────────────
+// A grantee child that yields to the owner's returning bridge exits with this SENTINEL
+// code (distinct from a clean 0 / a crash 1). The supervisor reads the exit code and puts
+// the room on a cooldown so it does NOT thrash-respawn a child that will only yield again —
+// the feature's INTENDED coexistence state (owner serves, grantee stands by) must not churn.
+// A revoke-yield keeps exit 0 (discovery drops a revoked room anyway); owner-owned rooms
+// never yield, so they never cool down.
+export const GRANT_RECLAIM_EXIT = 75
+
+// shouldCooldownOnExit — did this child exit BECAUSE the owner reclaimed the room (75)?
+// Only that exit arms the cooldown; a clean stop (0), a crash (1), or a signal (null) do not.
+export function shouldCooldownOnExit (code) {
+  return code === GRANT_RECLAIM_EXIT
+}
+
+// roomInCooldown — is a room still inside its grant-reclaim cooldown window? The supervisor
+// discovery tick skips re-serving while this is true. `until` is a wall-clock ms deadline
+// (Date.now() + window); a null/expired deadline means serve again (owner may have gone).
+export function roomInCooldown (until, now) {
+  return !!(until && now < until)
+}
+
 // refusalMessage — the human-facing stderr line when a bridge refuses to serve.
 export function refusalMessage ({ room, name, reason }) {
   const label = name ? `"${name}"` : '(unnamed)'