thinkpool-pair 0.7.161 → 0.7.163

package/bridge.mjs

@@ -38,10 +38,11 @@ import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage, gateFailAction, GRANT_RECLAIM_EXIT } from './serve-consent.mjs'
+import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv } from './providers.mjs'
+import { resolveProviderEnv, providerNameMap } from './providers.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -574,6 +575,28 @@ async function refreshOwnerPlan() {
     if (rows?.[0]?.plan) ownerPlan = rows[0].plan === 'plus' ? 'plus' : 'free'
   } catch { /* DNS-flaky / offline — keep the safe default; the next token refresh retries */ }
 }
+
+// ── Bridge-side row reap (Contract §Bridge-side reap, 2026-07-04) ───────────────
+// A cleanly-closed structured lane's code_terminals row must be gone within seconds
+// REGARDLESS of any client tab being open. The client-side reap (#205, room.jsx's
+// `term-exit` handler) only runs in whichever browser tab happens to catch the transient
+// broadcast — close a lane while no fresh tab is listening (stale/asleep) and the broadcast
+// evaporates, leaving a permanent dormant ghost row (three hand-deleted 2026-07-04/05).
+// The bridge is the ONE authoritative witness of a clean structured close, so it reaps the
+// row itself. RLS: code_terminals_member_delete permits DELETE to any parent-session member;
+// this bridge serves as the room owner or an authed grantee (codeAuthToken), so it qualifies.
+// Anon bridges (no token) skip — the client reap covers them, as it does old bridges (#205
+// is kept as-is). Idempotent: a fast client tab may reap first (204 / 0 rows is fine).
+// Best-effort: any failure is swallowed and the client reap remains the fallback.
+// Suppressed while shuttingDown — a late cleanupFlowLanes timer firing during teardown /
+// stand-down / restart must NOT delete rows: dormant lanes across a restart are the feature.
+// Thin wrapper: close over the bridge's LIVE state (codeAuthToken + shuttingDown are
+// reassigned over the process life, so read them at call time) and delegate to the
+// unit-tested reap-terminal.mjs. Fire-and-forget from endStructured — the module never
+// throws (best-effort), so an unawaited promise can't reject.
+function reapTerminalRow(id) {
+  return _reapTerminalRow({ id, token: codeAuthToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown })
+}
 // ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
 // A room is served by its OWNER's bridge; a non-owner may serve only with the
 // owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
@@ -862,8 +885,12 @@ const termNames = loadNames(room)
 // a hardcoded shorthand set on other devices / after reload). Max 2026-07-02.
 let roomModels = null
 
-const announce = () =>
-  bcast('bridge', {
+const announce = () => {
+  // Per-lane provider projection: resolve the registry id→NAME once per announce
+  // (name-only, NEVER key/baseUrl) so a cross-device viewer can badge a lane opened
+  // on a custom provider without the owner's account-channel registry.
+  const provNames = providerNameMap()
+  return bcast('bridge', {
     v: 2, name, repo: repoLabel, branch: readBranch(),
     // sdkWarn: the auto-pulled agent SDK failed its boot compatibility smoke test —
     // surfaced so the room can show a banner (turns may misbehave; pin a good SDK).
@@ -922,9 +949,15 @@ const announce = () =>
       // turnActive). Authoritative — the bridge owns the turn — so the /code
       // dashboard reads "N agents working" off the roster instead of sniffing
       // the live code-event stream (which a passive dashboard channel misses).
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}) })),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+        // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
+        // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
+        // built-in/default Claude path (no badge). Makes the lane's provider badge +
+        // /model honesty cross-device (was device-local via localStorage) and survives a
+        // bridge restart (entry.provider is persisted with the session).
+        ...(s.provider && s.provider !== 'anthropic' ? { provider: { id: s.provider, name: provNames[s.provider] || s.provider } } : {}) })),
     ],
-  })
+  }) }
 
 // Owner reclaim (Contract C-CODE-3 invariant 3): a grantee-served bridge that sees
 // the OWNER's bridge announce on this same room channel stands down — the owner's
@@ -2213,6 +2246,8 @@ function endStructured(id) {
     try { s.mockupWatcher?.close() } catch { /* noop */ }
     sessions.delete(id)
     bcast('term-exit', { id })
+    reapTerminalRow(id)    // bridge-side reap: delete the code_terminals row ourselves — the
+                           // client reap (#205) evaporates if no fresh tab caught the broadcast
     fireImageCleanup(id)   // drop this term's screenshots from Storage (COGS)
     // EN-m3 — closing a spawner ORPHANS the lanes it spawned (only that spawner could
     // close_terminal them; they can never be closed otherwise + keep occupying the caps).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.161",
+  "version": "0.7.163",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -32,6 +32,7 @@
     "flow-skill-registry.mjs",
     "serve-dir.mjs",
     "serve-consent.mjs",
+    "reap-terminal.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",

package/providers.mjs

@@ -211,6 +211,20 @@ export function announceProviders() {
   return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null }, ...custom]
 }
 
+/**
+ * id → name map for the ROOM announce's per-lane provider projection (name-only,
+ * NEVER key or baseUrl). Built once per announce so a cross-device viewer resolves
+ * a lane's provider badge without the owner's account-channel registry. Built-in
+ * `anthropic` is omitted (the default path shows no badge). A stale/removed id has
+ * no entry; the caller falls back to the bare id (a random UUID — not key material).
+ * @returns {Record<string,string>}
+ */
+export function providerNameMap() {
+  const m = {}
+  for (const p of loadProviders()) if (p?.id && p.id !== BUILTIN_ID) m[p.id] = p.name
+  return m
+}
+
 function keyHint(key) {
   const k = String(key || '')
   return k.length <= 4 ? k : k.slice(-4)

package/reap-terminal.mjs

@@ -0,0 +1,47 @@
+// Bridge-side reap of a cleanly-closed structured lane's code_terminals row.
+//
+// Spec: docs/specs/2026-07-04-structured-terminal-durability.md §Bridge-side reap.
+//
+// WHY this exists: the row-reap on a clean structured close (endStructured / MCP
+// close_terminal) used to be CLIENT-executed only — it ran in whichever browser tab
+// caught the transient `term-exit` broadcast (room.jsx #205). Close a lane while no fresh
+// tab is listening (stale / asleep) → the broadcast evaporates → a permanent dormant ghost
+// row (three hand-deleted 2026-07-04/05). The bridge is the ONE authoritative witness of a
+// clean structured close, so it reaps the row ITSELF — the client reap is kept as the
+// fallback for old bridges and for the fast-tab case.
+//
+// Extracted from bridge.mjs (which has top-level side effects and can't be unit-imported)
+// so the reap DECISION + REST shape are testable with an injected fetch — same pattern as
+// serve-consent.mjs. bridge.mjs wraps this, closing over its live codeAuthToken /
+// shuttingDown state.
+//
+// RLS: `code_terminals_member_delete` permits DELETE to any member of the parent code
+// session; the bridge serves as the room owner or an authed grantee (codeAuthToken), so it
+// qualifies. Anon bridges (no token) skip — the client reap covers them.
+//
+// Scope guard: NEVER reap while shuttingDown — a late cleanupFlowLanes timer firing during
+// teardown / stand-down / restart must not delete rows. Dormant lanes across a restart are
+// the feature, not the leak.
+
+/**
+ * @returns {Promise<{reaped: boolean, reason: 'ok'|'shutdown'|'anon'|'no-id'|'error', error?: string}>}
+ *   Never throws — best-effort; the client reap (#205) is the fallback.
+ */
+export async function reapTerminalRow ({ id, token, supabaseUrl, anonKey, shuttingDown = false, fetchImpl = fetch }) {
+  if (shuttingDown) return { reaped: false, reason: 'shutdown' }
+  if (!token)       return { reaped: false, reason: 'anon' }
+  if (!id)          return { reaped: false, reason: 'no-id' }
+  try {
+    // Mirror of the client reap: DELETE code_terminals WHERE id = <terminal id>. The
+    // terminal id IS the code_terminals PK (client/bridge-minted uuid). RLS scopes the
+    // delete to this bridge's sessions, so id alone is sufficient + idempotent (a fast
+    // client tab may have reaped first — 204 / 0 rows is fine).
+    await fetchImpl(`${supabaseUrl}/rest/v1/code_terminals?id=eq.${encodeURIComponent(id)}`, {
+      method: 'DELETE',
+      headers: { apikey: anonKey, Authorization: `Bearer ${token}` },
+    })
+    return { reaped: true, reason: 'ok' }
+  } catch (e) {
+    return { reaped: false, reason: 'error', error: e?.message }
+  }
+}