thinkpool-pair 0.7.163 → 0.7.165

package/bridge.mjs

@@ -42,7 +42,8 @@ import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, providerNameMap } from './providers.mjs'
+import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
+import { validateProviderSwitch, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -597,6 +598,24 @@ async function refreshOwnerPlan() {
 function reapTerminalRow(id) {
   return _reapTerminalRow({ id, token: codeAuthToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown })
 }
+// Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
+// serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
+// Pattern (per #218/#219): getUser + uid → REST existence check on code_sessions
+// (code=room, participants cs.{uid}) — NOT byte comparison of the jwt against codeAuthToken
+// (that bug already happened once tonight: a freshly-refreshed jwt has a new signature/iat/jti
+// per the grant cycle, so a byte compare rejects the legitimate sender). Hoisted to module
+// scope so provider-switch + providers-list-req share the ONE implementation. Returns false
+// for anon / missing / invalid jwt without throwing. Fails closed on any fetch error.
+const isRoomParticipant = async (jwt) => {
+  if (!jwt || typeof jwt !== 'string') return false
+  try {
+    const { data } = await supabase.auth.getUser(jwt)
+    if (!data?.user) return false
+    const uid = data.user.id
+    const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.${uid}`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
+    return r.ok
+  } catch { return false }
+}
 // ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
 // A room is served by its OWNER's bridge; a non-owner may serve only with the
 // owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
@@ -635,11 +654,15 @@ let yielding = false         // set once when standing down, so reclaim + revoke
       const { authedClient } = await import('./account.mjs')
       const refreshed = await authedClient(SUPABASE_URL, SUPABASE_ANON)
       if (refreshed?.session?.access_token) codeAuthToken = refreshed.session.access_token
-      // If the refresh FAILS (dead refresh token / offline), keep the stale token: an
-      // offline refresh must not strand a legit owner. A dead refresh token then yields a
-      // 401 at fetchServeRow → refuse (correct: the login is genuinely gone); a transient
-      // offline refresh yields a fetch reject → fail-open (correct: availability).
-    } catch { /* account module / refresh failed — proceed with the stored token */ }
+      // If refresh fails, DO NOT clear the token yet. Let the serve-consent gate below
+      // (lines 648-676) validate the token via getUser and handle auth-shaped errors
+      // vs network errors correctly. This fixes GAP 2 where a transient network error
+      // refused serving when the existing token might still be valid.
+    } catch {
+      // Refresh failed — but keep the existing token. Let serve-consent gate validate it.
+      // If it's an auth error, the gate will refuse (exit 0). If it's a network error,
+      // the gate will fail open and we can serve with the existing token.
+    }
   }
   try {
     if (codeAuthToken) {
@@ -920,6 +943,13 @@ const announce = () => {
     // host (e.g. openrouter.ai). Older web clients ignore unknown fields.
     provider: PROVIDER_INFO.provider,
     providerBaseUrl: PROVIDER_INFO.baseUrl || undefined,
+    // providerPubKey: the bridge's RSA-OAEP public key (SPKI base64), used by the
+    // dashboard to seal a provider's API key so it reaches the bridge without ever
+    // crossing the wire in the clear. Computed once (the keypair is stable).
+    // providers: the name-only registry (id+name+model, NEVER the key or baseUrl)
+    // so the dashboard can list what's available. Both additive; older clients ignore.
+    providerPubKey: publicKeyB64(),
+    providers: announceProviders(),
     // pendingUpdate: a newer thinkpool-pair is out — drives the room's "update ready"
     // chip; re-sent per announce so reloads/late-joiners see it (Slice 3).
     pendingUpdate,
@@ -2237,6 +2267,38 @@ function acceptEditsPending(s) {
   }
 }
 
+// Respawn a LIVE structured lane under a DIFFERENT LLM provider, keeping its
+// terminal id + visible transcript/history. Provider env is process-level, so a
+// switch = end the SDK session + reopen under the SAME id with the new provider's
+// env (resolveProviderEnv spreads into startClaudeSession's child env). The lane is
+// NOT closing — this mirrors how a BRIDGE RESTART preserves the row (#205/#208
+// durability): NO `term-exit` broadcast, NO reapTerminalRow, NO deleteSession. The
+// agent's conversational memory resets (cross-backend, no SDK resume across
+// providers) — accepted UX, the UI warns; the visible transcript persists via the
+// restored `log`. A no-op switch (same effective provider) is rejected by the
+// caller's validateProviderSwitch, so this fn always changes the env.
+//
+// Returns true if the lane was live + respawned; false if the id had no live
+// structured session (caller replies ok:false "no such live lane").
+function respawnStructured(id, provider) {
+  const s = sessions.get(id)
+  if (!s) return false
+  // Capture the lane's identity for re-open (NOT resume — fresh SDK session).
+  const { model, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  // Teardown WITHOUT the close side effects. drainPending denies any in-flight
+  // permission cards (the switch aborts the current turn, same as /model mid-turn).
+  drainPending(s)
+  try { s.session?.end() } catch { /* noop */ }
+  try { s.mockupWatcher?.close() } catch { /* noop */ }
+  sessions.delete(id)   // openStructured early-returns if the id is still mapped
+  // Re-open under the SAME id with the new provider env. openStructured persists
+  // sessionData() (provider included) synchronously on open, so a bridge restart
+  // restores the lane on its CURRENT provider, not the original — and its next
+  // announce carries the new provider badge (additive {id,name} projection).
+  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt })
+  return true
+}
+
 function endStructured(id) {
   if (!id) return
   const s = sessions.get(id)
@@ -2628,6 +2690,89 @@ channel
   // Peer bridge announces (owner reclaim) — a grantee yields when the owner's bridge
   // reappears. broadcast self:false, so this only fires for OTHER bridges on the topic.
   .on('broadcast', { event: 'bridge' }, ({ payload }) => onPeerBridgeAnnounce(payload))
+  // ── Provider registry — the multi-BYOK wire contract (room mode). ─────────────
+  // AUTH: room mode serves a room the user may not own (post-#208 grant). We verify
+  // the sender is a participant of THIS room before ANY operation. List is open to
+  // any participant; add/remove mutate the HOST's registry, so gate to the BRIDGE
+  // HOST's own uid (the authed login). Anon is refused for all three.
+  .on('broadcast', { event: 'provider-add' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    // Auth: must be the bridge host (the authed login running this bridge)
+    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
+    try {
+      const { data } = await supabase.auth.getUser(payload?.jwt)
+      if (!data?.user || data.user.id !== myServeUid) {
+        return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+      }
+    } catch {
+      return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+    }
+    let fields
+    try { fields = unseal(payload?.sealed) } catch { return channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: false, error: 'could not decrypt the sealed payload' } }) }
+    const r = addProvider(fields)
+    if (r.ok) { announce(); process.stderr.write(`\n  ◆ provider added (${String(fields?.name || '').slice(0, 40)}) — re-announced.\n`) }
+    channel.send({ type: 'broadcast', event: 'provider-add-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error, id: r.ok ? r.id : undefined } })
+  })
+  // provider-remove {id, nonce, jwt} → remove, re-announce.
+  .on('broadcast', { event: 'provider-remove' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    // Auth: must be the bridge host (the authed login running this bridge)
+    // Use the same pattern as providers-list-req: getUser + uid comparison, not byte comparison
+    try {
+      const { data } = await supabase.auth.getUser(payload?.jwt)
+      if (!data?.user || data.user.id !== myServeUid) {
+        return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+      }
+    } catch {
+      return channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: false, error: 'unauthorized' } })
+    }
+    const r = removeProvider(payload?.id)
+    if (r.ok) { announce(); process.stderr.write('\n  ◆ provider removed — re-announced.\n') }
+    channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error } })
+  })
+  // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
+  // Auth via the shared isRoomParticipant (hoisted; same pattern as provider-switch).
+  .on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    if (!(await isRoomParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
+    channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: true, providers: listProviders() } })
+  })
+  // ── Per-lane provider SWITCH (multi-BYOK slice 2). Switch a LIVE structured lane to a
+  // different LLM provider by restarting that lane's agent process under the SAME terminal
+  // id with the new provider's env. Visible transcript persists; the agent's conversational
+  // memory resets (cross-backend, no SDK resume) — accepted UX the UI warns about. Same-
+  // provider model changes keep using the EXISTING /model path (in-process setModel); the UI
+  // only sends provider-switch when the provider ACTUALLY changes.
+  //   provider-switch  {term, provider, nonce, jwt}  → bridge validates + respawns
+  //   provider-switch-res {nonce, ok, error?}        ← reply (NEVER key material)
+  // Auth: participant check via supabase.auth.getUser (isRoomParticipant) — NOT byte
+  // comparison of the jwt (a refreshed jwt has a new signature/iat/jti). Anon refused.
+  // After the respawn the lane's next announce reflects its new provider (additive {id,name}
+  // projection the client already renders from #219). Spec: docs/specs/2026-07-05-provider-switch.md.
+  .on('broadcast', { event: 'provider-switch' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}) } })
+    // AUTH first — anon / non-participant / bad jwt → ok:false 'unauthorized'. No lane
+    // state is touched for a rejected sender (fail closed before any lookup).
+    if (!(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
+    const term = payload?.term
+    const s = term ? sessions.get(term) : null
+    // The target must be a LIVE structured session this bridge serves.
+    if (!s) return reply(false, 'no such live lane')
+    // VALIDATE — pure: missing / unknown provider, or a no-op same-provider switch.
+    const v = validateProviderSwitch({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      registeredIds: listProviders().map((p) => p.id),
+    })
+    if (!v.ok) return reply(false, v.error)
+    if (v.noop) return reply(true)   // nothing to do; idempotent ok (UI guarantees a change)
+    const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
+    const done = respawnStructured(term, target)
+    if (!done) return reply(false, 'no such live lane')   // raced closed between the lookup + respawn
+    process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
+    reply(true)
+  })
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.163",
+  "version": "0.7.165",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -33,6 +33,7 @@
     "serve-dir.mjs",
     "serve-consent.mjs",
     "reap-terminal.mjs",
+    "switch-provider.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",

package/switch-provider.mjs

@@ -0,0 +1,57 @@
+/* ─────────────────────────────────────────────────────────────
+   switch-provider.mjs — validation for the per-lane provider-switch
+   wire request (`provider-switch` on the room channel).
+
+   The bridge handler (bridge.mjs) owns AUTH (supabase.getUser + room
+   participation) and the actual RESPAWN (teardown-without-reap +
+   reopen under the same terminal id with the new provider env). This
+   module owns the decidable part — pure, no bridge state, no supabase —
+   so the validation branches are unit-testable in isolation:
+
+     V1  missing provider id            → ok:false error:'missing provider'
+     V2  unknown id (not registered)    → ok:false error:'unknown provider'
+     V3  valid + actually changes       → ok:true  noop:false
+     V4  valid but same as current      → ok:true  noop:true  (UI guarantees a
+                                          change, but we stay correct + idempotent
+                                          if it ever sends a no-op)
+
+   The built-in Anthropic path is internally `provider: null` (omitted on
+   the announce), but the wire sends the literal `'anthropic'`. Both mean
+   the default Claude env, so `null` ↔ `'anthropic'` is a SAME-provider
+   (no-op) switch. resolveProviderEnv (providers.mjs) treats them the same.
+
+   Spec: docs/specs/2026-07-05-provider-switch.md (wire contract LOCKED;
+   this module must NOT change the request/reply field names or shapes).
+   ───────────────────────────────────────────────────────────── */
+
+export const BUILTIN_PROVIDER = 'anthropic'
+
+/**
+ * Normalize a provider id so the built-in default (`null`, undefined, or the
+ * literal 'anthropic') collapses to a single canonical value. Used by the
+ * no-op check: switching a lane whose current provider is null (the default
+ * path) to 'anthropic' is NOT a real change.
+ * @param {string|null|undefined} p
+ * @returns {string}
+ */
+export function effectiveProvider(p) {
+  return (!p || p === BUILTIN_PROVIDER) ? BUILTIN_PROVIDER : String(p)
+}
+
+/**
+ * Validate a provider-switch request's provider field.
+ *
+ * @param {{provider: string, currentProvider?: string|null, registeredIds?: string[]}} input
+ * @returns {{ok: true, noop: boolean} | {ok: false, error: string}}
+ */
+export function validateProviderSwitch({ provider, currentProvider, registeredIds }) {
+  const id = String(provider ?? '').trim()
+  if (!id) return { ok: false, error: 'missing provider' }
+
+  const known = id === BUILTIN_PROVIDER ||
+    (Array.isArray(registeredIds) && registeredIds.includes(id))
+  if (!known) return { ok: false, error: 'unknown provider' }
+
+  const noop = effectiveProvider(id) === effectiveProvider(currentProvider)
+  return { ok: true, noop }
+}