thinkpool-pair 0.7.162 → 0.7.164

package/bridge.mjs

@@ -42,7 +42,7 @@ import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv } from './providers.mjs'
+import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -635,11 +635,15 @@ let yielding = false         // set once when standing down, so reclaim + revoke
       const { authedClient } = await import('./account.mjs')
       const refreshed = await authedClient(SUPABASE_URL, SUPABASE_ANON)
       if (refreshed?.session?.access_token) codeAuthToken = refreshed.session.access_token
-      // If the refresh FAILS (dead refresh token / offline), keep the stale token: an
-      // offline refresh must not strand a legit owner. A dead refresh token then yields a
-      // 401 at fetchServeRow → refuse (correct: the login is genuinely gone); a transient
-      // offline refresh yields a fetch reject → fail-open (correct: availability).
-    } catch { /* account module / refresh failed — proceed with the stored token */ }
+      // If refresh fails, DO NOT clear the token yet. Let the serve-consent gate below
+      // (lines 648-676) validate the token via getUser and handle auth-shaped errors
+      // vs network errors correctly. This fixes GAP 2 where a transient network error
+      // refused serving when the existing token might still be valid.
+    } catch {
+      // Refresh failed — but keep the existing token. Let serve-consent gate validate it.
+      // If it's an auth error, the gate will refuse (exit 0). If it's a network error,
+      // the gate will fail open and we can serve with the existing token.
+    }
   }
   try {
     if (codeAuthToken) {
@@ -885,8 +889,12 @@ const termNames = loadNames(room)
 // a hardcoded shorthand set on other devices / after reload). Max 2026-07-02.
 let roomModels = null
 
-const announce = () =>
-  bcast('bridge', {
+const announce = () => {
+  // Per-lane provider projection: resolve the registry id→NAME once per announce
+  // (name-only, NEVER key/baseUrl) so a cross-device viewer can badge a lane opened
+  // on a custom provider without the owner's account-channel registry.
+  const provNames = providerNameMap()
+  return bcast('bridge', {
     v: 2, name, repo: repoLabel, branch: readBranch(),
     // sdkWarn: the auto-pulled agent SDK failed its boot compatibility smoke test —
     // surfaced so the room can show a banner (turns may misbehave; pin a good SDK).
@@ -916,6 +924,13 @@ const announce = () =>
     // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
     provider: PROVIDER_INFO.provider,
     providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
+    // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), used by the
+    // dashboard to seal a provider's API key so it reaches the bridge without ever
+    // crossing the wire in the clear. Computed once (the keypair is stable).
+    // providers: the name-only registry (id+name+model, NEVER the key or baseUrl)
+    // so the dashboard can list what's available. Both additive; older clients ignore.
+    providerPubKey: publicKeyB64(),
+    providers: announceProviders(),
     // pendingUpdate: a newer thinkpool-pair is out — drives the room's "update ready"
     // chip; re-sent per announce so reloads/late-joiners see it (Slice 3).
     pendingUpdate,
@@ -945,9 +960,15 @@ const announce = () =>
       // turnActive). Authoritative — the bridge owns the turn — so the /code
       // dashboard reads "N agents working" off the roster instead of sniffing
       // the live code-event stream (which a passive dashboard channel misses).
-      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}) })),
+      ...[...sessions.entries()].map(([id, s]) => ({ id, cmd: s.cmd, kind: 'structured', alive: true, busy: s.session?.turnActive ?? false, commands: s.commands, mode: s.mode || undefined, name: termNames[id] || undefined, model: s.model || undefined, ...(s.archiveOldestSeq != null ? { oldestSeq: s.archiveOldestSeq } : {}), ...(s.spawnedBy ? { spawned: true, spawnedBy: s.spawnedBy } : {}), ...(s.flowSessionId ? { flowId: s.flowSessionId, flowRole: s.flowTaskKey ? 'lane' : 'conductor' } : {}),
+        // provider: the registered LLM-provider this lane runs on, NAME-ONLY {id,name}
+        // (NEVER the key or baseUrl). Additive; older clients ignore it. Omitted for the
+        // built-in/default Claude path (no badge). Makes the lane's provider badge +
+        // /model honesty cross-device (was device-local via localStorage) and survives a
+        // bridge restart (entry.provider is persisted with the session).
+        ...(s.provider && s.provider !== 'anthropic' ? { provider: { id: s.provider, name: provNames[s.provider] || s.provider } } : {}) })),
     ],
-  })
+  }) }
 
 // Owner reclaim (Contract C-CODE-3 invariant 3): a grantee-served bridge that sees
 // the OWNER's bridge announce on this same room channel stands down — the owner's
@@ -2618,6 +2639,66 @@ channel
   // Peer bridge announces (owner reclaim) — a grantee yields when the owner's bridge
   // reappears. broadcast self:false, so this only fires for OTHER bridges on the topic.
   .on('broadcast', { event: 'bridge' }, ({ payload }) => onPeerBridgeAnnounce(payload))
+  // ── Provider registry — the multi-BYOK wire contract (room mode). ─────────────
+  // AUTH: room mode serves a room the user may not own (post-#208 grant). We verify
+  // the sender is a participant of THIS room before ANY operation. List is open to
+  // any participant; add/remove mutate the HOST's registry, so gate to the BRIDGE
+  // HOST's own uid (the authed login). Anon is refused for all three.
+  .on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    // Auth: must be the bridge host (the authed login running this bridge)
+    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
+    try {
+      const { data } = await supabase.auth.getUser(payload?.jwt)
+      if (!data?.user || data.user.id !== myServeUid) {
+        return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+      }
+    } catch {
+      return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+    }
+    let fields
+    try { fields = unseal(payload?.sealed) } catch { return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'could not decrypt the sealed payload' } }) }
+    const r = addProvider(fields)
+    if (r.ok) { announce(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
+    channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined } })
+  })
+  // provider-remove {id, nonce, jwt} → remove, re-announce.
+  .on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    // Auth: must be the bridge host (the authed login running this bridge)
+    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
+    try {
+      const { data } = await supabase.auth.getUser(payload?.jwt)
+      if (!data?.user || data.user.id !== myServeUid) {
+        return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+      }
+    } catch {
+      return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+    }
+    const r = removeProvider(payload?.id)
+    if (r.ok) { announce(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
+    channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error } })
+  })
+  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
+  .on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const isParticipant = async (jwt) => {
+      if (!jwt || typeof jwt !== 'string') return false
+      try {
+        const { data } = await supabase.auth.getUser(jwt)
+        if (!data?.user) return false
+        const uid = data.user.id
+        // Verify the user is a participant of THIS room (owner OR granted OR joined).
+        // Room mode serves the room, so RLS returns participants; we just need to confirm
+        // the jwt's user is one of them. A simple existence check on code_sessions
+        // with the room code + the user's id in the participants array is enough.
+        const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.${uid}`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
+        return r.ok
+      } catch { return false }
+    }
+    if (!(await isParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
+    channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: true, providers: listProviders() } })
+  })
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.162",
+  "version": "0.7.164",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/providers.mjs

@@ -211,6 +211,20 @@ export function announceProviders() {
   return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null }, ...custom]
 }
 
+/**
+ * id → name map for the ROOM announce's per-lane provider projection (name-only,
+ * NEVER key or baseUrl). Built once per announce so a cross-device viewer resolves
+ * a lane's provider badge without the owner's account-channel registry. Built-in
+ * `anthropic` is omitted (the default path shows no badge). A stale/removed id has
+ * no entry; the caller falls back to the bare id (a random UUID — not key material).
+ * @returns {Record<string,string>}
+ */
+export function providerNameMap() {
+  const m = {}
+  for (const p of loadProviders()) if (p?.id && p.id !== BUILTIN_ID) m[p.id] = p.name
+  return m
+}
+
 function keyHint(key) {
   const k = String(key || '')
   return k.length <= 4 ? k : k.slice(-4)