thinkpool-pair 0.7.161 → 0.7.162

package/bridge.mjs

@@ -38,6 +38,7 @@ import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage, gateFailAction, GRANT_RECLAIM_EXIT } from './serve-consent.mjs'
+import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
@@ -574,6 +575,28 @@ async function refreshOwnerPlan() {
     if (rows?.[0]?.plan) ownerPlan = rows[0].plan === 'plus' ? 'plus' : 'free'
   } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
 }
+
+// ── Bridge-side row reap (Contract §Bridge-side reap, 2026-07-04) ───────────────
+// A cleanly-closed structured lane's code_terminals row must be gone within seconds
+// REGARDLESS of any client tab being open. The client-side reap (#205, room.jsx's
+// `term-exit` handler) only runs in whichever browser tab happens to catch the transient
+// broadcast — close a lane while no fresh tab is listening (stale/asleep) and the broadcast
+// evaporates, leaving a permanent dormant ghost row (three hand-deleted 2026-07-04/05).
+// The bridge is the ONE authoritative witness of a clean structured close, so it reaps the
+// row itself. RLS: code_terminals_member_delete permits DELETE to any parent-session member;
+// this bridge serves as the room owner or an authed grantee (codeAuthToken), so it qualifies.
+// Anon bridges (no token) skip — the client reap covers them, as it does old bridges (#205
+// is kept as-is). Idempotent: a fast client tab may reap first (204 / 0 rows is fine).
+// Best-effort: any failure is swallowed and the client reap remains the fallback.
+// Suppressed while shuttingDown — a late cleanupFlowLanes timer firing during teardown /
+// stand-down / restart must NOT delete rows: dormant lanes across a restart are the feature.
+// Thin wrapper: close over the bridge's LIVE state (codeAuthToken + shuttingDown are
+// reassigned over the process life, so read them at call time) and delegate to the
+// unit-tested reap-terminal.mjs. Fire-and-forget from endStructured — the module never
+// throws (best-effort), so an unawaited promise can't reject.
+function reapTerminalRow(id) {
+  return _reapTerminalRow({ id, token: codeAuthToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown })
+}
 // ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
 // A room is served by its OWNER's bridge; a non-owner may serve only with the
 // owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
@@ -2213,6 +2236,8 @@ function endStructured(id) {
     try { s.mockupWatcher?.close() } catch { /* noop */ }
     sessions.delete(id)
     bcast('term-exit', { id })
+    reapTerminalRow(id)    // bridge-side reap: delete the code_terminals row ourselves — the
+                           // client reap (#205) evaporates if no fresh tab caught the broadcast
     fireImageCleanup(id)   // drop this term's screenshots from Storage (COGS)
     // EN-m3 — closing a spawner ORPHANS the lanes it spawned (only that spawner could
     // close_terminal them; they can never be closed otherwise + keep occupying the caps).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.161",
+  "version": "0.7.162",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -32,6 +32,7 @@
     "flow-skill-registry.mjs",
     "serve-dir.mjs",
     "serve-consent.mjs",
+    "reap-terminal.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",

package/reap-terminal.mjs

@@ -0,0 +1,47 @@
+// Bridge-side reap of a cleanly-closed structured lane's code_terminals row.
+//
+// Spec: docs/specs/2026-07-04-structured-terminal-durability.md §Bridge-side reap.
+//
+// WHY this exists: the row-reap on a clean structured close (endStructured / MCP
+// close_terminal) used to be CLIENT-executed only — it ran in whichever browser tab
+// caught the transient `term-exit` broadcast (room.jsx #205). Close a lane while no fresh
+// tab is listening (stale / asleep) → the broadcast evaporates → a permanent dormant ghost
+// row (three hand-deleted 2026-07-04/05). The bridge is the ONE authoritative witness of a
+// clean structured close, so it reaps the row ITSELF — the client reap is kept as the
+// fallback for old bridges and for the fast-tab case.
+//
+// Extracted from bridge.mjs (which has top-level side effects and can't be unit-imported)
+// so the reap DECISION + REST shape are testable with an injected fetch — same pattern as
+// serve-consent.mjs. bridge.mjs wraps this, closing over its live codeAuthToken /
+// shuttingDown state.
+//
+// RLS: `code_terminals_member_delete` permits DELETE to any member of the parent code
+// session; the bridge serves as the room owner or an authed grantee (codeAuthToken), so it
+// qualifies. Anon bridges (no token) skip — the client reap covers them.
+//
+// Scope guard: NEVER reap while shuttingDown — a late cleanupFlowLanes timer firing during
+// teardown / stand-down / restart must not delete rows. Dormant lanes across a restart are
+// the feature, not the leak.
+
+/**
+ * @returns {Promise<{reaped: boolean, reason: 'ok'|'shutdown'|'anon'|'no-id'|'error', error?: string}>}
+ *   Never throws — best-effort; the client reap (#205) is the fallback.
+ */
+export async function reapTerminalRow ({ id, token, supabaseUrl, anonKey, shuttingDown = false, fetchImpl = fetch }) {
+  if (shuttingDown) return { reaped: false, reason: 'shutdown' }
+  if (!token)       return { reaped: false, reason: 'anon' }
+  if (!id)          return { reaped: false, reason: 'no-id' }
+  try {
+    // Mirror of the client reap: DELETE code_terminals WHERE id = <terminal id>. The
+    // terminal id IS the code_terminals PK (client/bridge-minted uuid). RLS scopes the
+    // delete to this bridge's sessions, so id alone is sufficient + idempotent (a fast
+    // client tab may have reaped first — 204 / 0 rows is fine).
+    await fetchImpl(`${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}`, {
+      method: 'DELETE',
+      headers: { apikey: anonKey, Authorization: `Bearer ${token}` },
+    })
+    return { reaped: true, reason: 'ok' }
+  } catch (e) {
+    return { reaped: false, reason: 'error', error: e?.message }
+  }
+}