thinkpool-pair 0.7.163 → 0.7.164

package/bridge.mjs

@@ -42,7 +42,7 @@ import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, providerNameMap } from './providers.mjs'
+import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -635,11 +635,15 @@ let yielding = false         // set once when standing down, so reclaim + revoke
       const { authedClient } = await import('./account.mjs')
       const refreshed = await authedClient(SUPABASE_URL, SUPABASE_ANON)
       if (refreshed?.session?.access_token) codeAuthToken = refreshed.session.access_token
-      // If the refresh FAILS (dead refresh token / offline), keep the stale token: an
-      // offline refresh must not strand a legit owner. A dead refresh token then yields a
-      // 401 at fetchServeRow → refuse (correct: the login is genuinely gone); a transient
-      // offline refresh yields a fetch reject → fail-open (correct: availability).
-    } catch { /* account module / refresh failed — proceed with the stored token */ }
+      // If refresh fails, DO NOT clear the token yet. Let the serve-consent gate below
+      // (lines 648-676) validate the token via getUser and handle auth-shaped errors
+      // vs network errors correctly. This fixes GAP 2 where a transient network error
+      // refused serving when the existing token might still be valid.
+    } catch {
+      // Refresh failed — but keep the existing token. Let serve-consent gate validate it.
+      // If it's an auth error, the gate will refuse (exit 0). If it's a network error,
+      // the gate will fail open and we can serve with the existing token.
+    }
   }
   try {
     if (codeAuthToken) {
@@ -920,6 +924,13 @@ const announce = () => {
     // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
     provider: PROVIDER_INFO.provider,
     providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
+    // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), used by the
+    // dashboard to seal a provider's API key so it reaches the bridge without ever
+    // crossing the wire in the clear. Computed once (the keypair is stable).
+    // providers: the name-only registry (id+name+model, NEVER the key or baseUrl)
+    // so the dashboard can list what's available. Both additive; older clients ignore.
+    providerPubKey: publicKeyB64(),
+    providers: announceProviders(),
     // pendingUpdate: a newer thinkpool-pair is out — drives the room's "update ready"
     // chip; re-sent per announce so reloads/late-joiners see it (Slice 3).
     pendingUpdate,
@@ -2628,6 +2639,66 @@ channel
   // Peer bridge announces (owner reclaim) — a grantee yields when the owner's bridge
   // reappears. broadcast self:false, so this only fires for OTHER bridges on the topic.
   .on('broadcast', { event: 'bridge' }, ({ payload }) => onPeerBridgeAnnounce(payload))
+  // ── Provider registry — the multi-BYOK wire contract (room mode). ─────────────
+  // AUTH: room mode serves a room the user may not own (post-#208 grant). We verify
+  // the sender is a participant of THIS room before ANY operation. List is open to
+  // any participant; add/remove mutate the HOST's registry, so gate to the BRIDGE
+  // HOST's own uid (the authed login). Anon is refused for all three.
+  .on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    // Auth: must be the bridge host (the authed login running this bridge)
+    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
+    try {
+      const { data } = await supabase.auth.getUser(payload?.jwt)
+      if (!data?.user || data.user.id !== myServeUid) {
+        return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+      }
+    } catch {
+      return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+    }
+    let fields
+    try { fields = unseal(payload?.sealed) } catch { return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'could not decrypt the sealed payload' } }) }
+    const r = addProvider(fields)
+    if (r.ok) { announce(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
+    channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined } })
+  })
+  // provider-remove {id, nonce, jwt} → remove, re-announce.
+  .on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    // Auth: must be the bridge host (the authed login running this bridge)
+    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
+    try {
+      const { data } = await supabase.auth.getUser(payload?.jwt)
+      if (!data?.user || data.user.id !== myServeUid) {
+        return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+      }
+    } catch {
+      return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+    }
+    const r = removeProvider(payload?.id)
+    if (r.ok) { announce(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
+    channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error } })
+  })
+  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
+  .on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const isParticipant = async (jwt) => {
+      if (!jwt || typeof jwt !== 'string') return false
+      try {
+        const { data } = await supabase.auth.getUser(jwt)
+        if (!data?.user) return false
+        const uid = data.user.id
+        // Verify the user is a participant of THIS room (owner OR granted OR joined).
+        // Room mode serves the room, so RLS returns participants; we just need to confirm
+        // the jwt's user is one of them. A simple existence check on code_sessions
+        // with the room code + the user's id in the participants array is enough.
+        const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.${uid}`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
+        return r.ok
+      } catch { return false }
+    }
+    if (!(await isParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
+    channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: true, providers: listProviders() } })
+  })
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.163",
+  "version": "0.7.164",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {