thinkpool-pair 0.7.164 → 0.7.166

package/bridge.mjs

@@ -43,6 +43,7 @@ import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
 import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
+import { validateProviderSwitch, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -597,6 +598,30 @@ async function refreshOwnerPlan() {
 function reapTerminalRow(id) {
   return _reapTerminalRow({ id, token: codeAuthToken, supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, shuttingDown })
 }
+// Auth: is the sender a PARTICIPANT of THIS room (owner OR granted OR joined)? Room mode
+// serves the room, so RLS returns participants; we confirm the jwt's user is one of them.
+// Pattern (per #218/#219): getUser + uid → REST existence check on code_sessions
+// (code=room, participants cs.{uid}) — NOT byte comparison of the jwt against codeAuthToken
+// (that bug already happened once tonight: a freshly-refreshed jwt has a new signature/iat/jti
+// per the grant cycle, so a byte compare rejects the legitimate sender). Hoisted to module
+// scope so provider-switch + providers-list-req share the ONE implementation. Returns false
+// for anon / missing / invalid jwt without throwing. Fails closed on any fetch error.
+const isRoomParticipant = async (jwt) => {
+  if (!jwt || typeof jwt !== 'string') return false
+  try {
+    const { data } = await supabase.auth.getUser(jwt)
+    if (!data?.user) return false
+    const uid = data.user.id
+    // Query with the CALLER's jwt (not the bridge host's codeAuthToken) so RLS scopes
+    // the read to what THIS user may see, and require an actual matching row — `r.ok`
+    // alone is true for an empty [] result, which let ANY authenticated user pass.
+    // participants is a uuid[]; PostgREST array-contains is cs.{uid} (braces required).
+    const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.%7B${encodeURIComponent(uid)}%7D&select=code`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${jwt}` } })
+    if (!r.ok) return false
+    const rows = await r.json().catch(() => [])
+    return Array.isArray(rows) && rows.length > 0
+  } catch { return false }
+}
 // ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
 // A room is served by its OWNER's bridge; a non-owner may serve only with the
 // owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
@@ -2248,6 +2273,38 @@ function acceptEditsPending(s) {
   }
 }
 
+// Respawn a LIVE structured lane under a DIFFERENT LLM provider, keeping its
+// terminal id + visible transcript/history. Provider env is process-level, so a
+// switch = end the SDK session + reopen under the SAME id with the new provider's
+// env (resolveProviderEnv spreads into startClaudeSession's child env). The lane is
+// NOT closing — this mirrors how a BRIDGE RESTART preserves the row (#205/#208
+// durability): NO `term-exit` broadcast, NO reapTerminalRow, NO deleteSession. The
+// agent's conversational memory resets (cross-backend, no SDK resume across
+// providers) — accepted UX, the UI warns; the visible transcript persists via the
+// restored `log`. A no-op switch (same effective provider) is rejected by the
+// caller's validateProviderSwitch, so this fn always changes the env.
+//
+// Returns true if the lane was live + respawned; false if the id had no live
+// structured session (caller replies ok:false "no such live lane").
+function respawnStructured(id, provider) {
+  const s = sessions.get(id)
+  if (!s) return false
+  // Capture the lane's identity for re-open (NOT resume — fresh SDK session).
+  const { model, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  // Teardown WITHOUT the close side effects. drainPending denies any in-flight
+  // permission cards (the switch aborts the current turn, same as /model mid-turn).
+  drainPending(s)
+  try { s.session?.end() } catch { /* noop */ }
+  try { s.mockupWatcher?.close() } catch { /* noop */ }
+  sessions.delete(id)   // openStructured early-returns if the id is still mapped
+  // Re-open under the SAME id with the new provider env. openStructured persists
+  // sessionData() (provider included) synchronously on open, so a bridge restart
+  // restores the lane on its CURRENT provider, not the original — and its next
+  // announce carries the new provider badge (additive {id,name} projection).
+  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt })
+  return true
+}
+
 function endStructured(id) {
   if (!id) return
   const s = sessions.get(id)
@@ -2680,25 +2737,48 @@ channel
     channel.send({ type: 'broadcast', event: 'provider-remove-res', payload: { nonce, ok: r.ok, error: r.ok ? undefined : r.error } })
   })
   // providers-list-req {nonce, jwt} → the masked list (keyHint = last 4 chars only).
+  // Auth via the shared isRoomParticipant (hoisted; same pattern as provider-switch).
   .on('broadcast', { event: 'providers-list-req' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    const isParticipant = async (jwt) => {
-      if (!jwt || typeof jwt !== 'string') return false
-      try {
-        const { data } = await supabase.auth.getUser(jwt)
-        if (!data?.user) return false
-        const uid = data.user.id
-        // Verify the user is a participant of THIS room (owner OR granted OR joined).
-        // Room mode serves the room, so RLS returns participants; we just need to confirm
-        // the jwt's user is one of them. A simple existence check on code_sessions
-        // with the room code + the user's id in the participants array is enough.
-        const r = await fetch(`${SUPABASE_URL}/rest/v1/code_sessions?code=eq.${encodeURIComponent(room)}&participants=cs.${uid}`, { headers: { apikey: SUPABASE_ANON, Authorization: `Bearer ${codeAuthToken}` } })
-        return r.ok
-      } catch { return false }
-    }
-    if (!(await isParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
+    if (!(await isRoomParticipant(payload?.jwt))) return channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: false, error: 'unauthorized', providers: [] } })
     channel.send({ type: 'broadcast', event: 'providers-list-res', payload: { nonce, ok: true, providers: listProviders() } })
   })
+  // ── Per-lane provider SWITCH (multi-BYOK slice 2). Switch a LIVE structured lane to a
+  // different LLM provider by restarting that lane's agent process under the SAME terminal
+  // id with the new provider's env. Visible transcript persists; the agent's conversational
+  // memory resets (cross-backend, no SDK resume) — accepted UX the UI warns about. Same-
+  // provider model changes keep using the EXISTING /model path (in-process setModel); the UI
+  // only sends provider-switch when the provider ACTUALLY changes.
+  //   provider-switch  {term, provider, nonce, jwt}  → bridge validates + respawns
+  //   provider-switch-res {nonce, ok, error?}        ← reply (NEVER key material)
+  // Auth: participant check via supabase.auth.getUser (isRoomParticipant) — NOT byte
+  // comparison of the jwt (a refreshed jwt has a new signature/iat/jti). Anon refused.
+  // After the respawn the lane's next announce reflects its new provider (additive {id,name}
+  // projection the client already renders from #219). Spec: docs/specs/2026-07-05-provider-switch.md.
+  .on('broadcast', { event: 'provider-switch' }, async ({ payload }) => {
+    const nonce = payload?.nonce
+    const reply = (ok, error) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}) } })
+    // AUTH first — anon / non-participant / bad jwt → ok:false 'unauthorized'. No lane
+    // state is touched for a rejected sender (fail closed before any lookup).
+    if (!(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
+    const term = payload?.term
+    const s = term ? sessions.get(term) : null
+    // The target must be a LIVE structured session this bridge serves.
+    if (!s) return reply(false, 'no such live lane')
+    // VALIDATE — pure: missing / unknown provider, or a no-op same-provider switch.
+    const v = validateProviderSwitch({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      registeredIds: listProviders().map((p) => p.id),
+    })
+    if (!v.ok) return reply(false, v.error)
+    if (v.noop) return reply(true)   // nothing to do; idempotent ok (UI guarantees a change)
+    const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
+    const done = respawnStructured(term, target)
+    if (!done) return reply(false, 'no such live lane')   // raced closed between the lookup + respawn
+    process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
+    reply(true)
+  })
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.164",
-  "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
+  "version": "0.7.166",
+  "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, \u2026) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
     "thinkpool-pair": "bridge.mjs"
@@ -33,6 +33,7 @@
     "serve-dir.mjs",
     "serve-consent.mjs",
     "reap-terminal.mjs",
+    "switch-provider.mjs",
     "service.mjs",
     "presence.mjs",
     "account.mjs",

package/switch-provider.mjs

@@ -0,0 +1,57 @@
+/* ─────────────────────────────────────────────────────────────
+   switch-provider.mjs — validation for the per-lane provider-switch
+   wire request (`provider-switch` on the room channel).
+
+   The bridge handler (bridge.mjs) owns AUTH (supabase.getUser + room
+   participation) and the actual RESPAWN (teardown-without-reap +
+   reopen under the same terminal id with the new provider env). This
+   module owns the decidable part — pure, no bridge state, no supabase —
+   so the validation branches are unit-testable in isolation:
+
+     V1  missing provider id            → ok:false error:'missing provider'
+     V2  unknown id (not registered)    → ok:false error:'unknown provider'
+     V3  valid + actually changes       → ok:true  noop:false
+     V4  valid but same as current      → ok:true  noop:true  (UI guarantees a
+                                          change, but we stay correct + idempotent
+                                          if it ever sends a no-op)
+
+   The built-in Anthropic path is internally `provider: null` (omitted on
+   the announce), but the wire sends the literal `'anthropic'`. Both mean
+   the default Claude env, so `null` ↔ `'anthropic'` is a SAME-provider
+   (no-op) switch. resolveProviderEnv (providers.mjs) treats them the same.
+
+   Spec: docs/specs/2026-07-05-provider-switch.md (wire contract LOCKED;
+   this module must NOT change the request/reply field names or shapes).
+   ───────────────────────────────────────────────────────────── */
+
+export const BUILTIN_PROVIDER = 'anthropic'
+
+/**
+ * Normalize a provider id so the built-in default (`null`, undefined, or the
+ * literal 'anthropic') collapses to a single canonical value. Used by the
+ * no-op check: switching a lane whose current provider is null (the default
+ * path) to 'anthropic' is NOT a real change.
+ * @param {string|null|undefined} p
+ * @returns {string}
+ */
+export function effectiveProvider(p) {
+  return (!p || p === BUILTIN_PROVIDER) ? BUILTIN_PROVIDER : String(p)
+}
+
+/**
+ * Validate a provider-switch request's provider field.
+ *
+ * @param {{provider: string, currentProvider?: string|null, registeredIds?: string[]}} input
+ * @returns {{ok: true, noop: boolean} | {ok: false, error: string}}
+ */
+export function validateProviderSwitch({ provider, currentProvider, registeredIds }) {
+  const id = String(provider ?? '').trim()
+  if (!id) return { ok: false, error: 'missing provider' }
+
+  const known = id === BUILTIN_PROVIDER ||
+    (Array.isArray(registeredIds) && registeredIds.includes(id))
+  if (!known) return { ok: false, error: 'unknown provider' }
+
+  const noop = effectiveProvider(id) === effectiveProvider(currentProvider)
+  return { ok: true, noop }
+}