thinkpool-pair 0.7.166 → 0.7.168

package/account.mjs

@@ -17,7 +17,7 @@ import { saveAuth, loadAuth, loadDirs, bindDir, loadServed, rememberServed, load
 import { isSafeToRestart } from './update-gate.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 import { publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal } from './providers.mjs'
-import { supervisorServes, shouldCooldownOnExit, roomInCooldown } from './serve-consent.mjs'
+import { supervisorServes } from './serve-consent.mjs'
 import { resolveServeDir } from './serve-dir.mjs'
 import { pairKeyFor, pairTopic, CROSSROOM_BUS } from './cross-terminal.mjs'
 
@@ -232,13 +232,6 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   process.stderr.write(`\n  ◆ thinkpool-pair — account mode · ${email}\n    New sessions auto-serve from ${_effDefault}${loadDefaultDir() ? ' (your default)' : (claudeRecentProjectDir() ? ' (your most-recent Claude Code project)' : '')}\n    (change it: npx thinkpool-pair set-default-dir <dir>  ·  one room: npx thinkpool-pair bind <code> <dir>)\n${svcHint}`)
 
   const children = new Map()   // room -> child process
-  // grantCooldown: room -> wall-clock ms deadline. A grantee child that yielded to the
-  // owner's returning bridge (exit 75) parks its room here so discovery does NOT re-spawn a
-  // child that would only yield again — the owner-serves/grantee-stands-by coexistence state
-  // must not thrash-churn every 15s tick (DEFECT 2, 2026-07-05). Expires after TP_GRANT_COOLDOWN_MS;
-  // after that discovery retries once — serving normally if the owner has since gone.
-  const grantCooldown = new Map()
-  const GRANT_COOLDOWN_MS = Math.max(15_000, parseInt(process.env.TP_GRANT_COOLDOWN_MS, 10) || 120_000)
   const childIdle = new Map()    // room -> bool (last idle report: in the quiet window)
   const childBetween = new Map() // room -> bool (between turns now — safe to restart per Contract #1)
   const childPeer = new Map()  // room -> bool (a web client is watching this room)
@@ -271,6 +264,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   // account without per-room probing. We TRACK this machine (name + served room
   // codes + version) on a per-account channel; the dashboard subscribes read-only.
   const machine = os.hostname().replace(/\.local$/, '')
+
+  // ── supervisor logging (cascade brg-instrument, supervisor-log lane) ─────────
+  const SUP_ID = (randomUUID?.() || '').slice(0, 8)
+  let lastClaimHeld = null // track state changes for claim_tick logging
+  console.log(`◇ supervisor boot sup=${SUP_ID} host=${machine} pid=${process.pid} npx=${VERSION || 'dev'}`)
+
   const acct = sb.channel(`tpacct:${session.user.id}`, { config: { presence: { key: machine }, broadcast: { self: false } } })
   let restarting = false   // set by the "restart" broadcast → stop() exits non-zero so a supervisor respawns us
   // Web "attach this session" card → bind an unbound/new room to a local dir (and
@@ -463,6 +462,13 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       else if (!held && standbyHost !== host) process.stderr.write(`\n  ◇ another device (${host}) is serving this account — standing by.\n    (this Mac takes over automatically if that device goes offline.)\n`)
       claimHeld = held
       standbyHost = held ? null : host
+
+      // ── supervisor claim_tick logging (cascade brg-instrument) ─────────────────
+      if (lastClaimHeld !== held) {
+        console.log(`claim_tick sup=${SUP_ID} held=${held} holder=${held ? machine : host}`)
+        lastClaimHeld = held
+      }
+
       return held
     } catch {
       // Transient claim error: keep serving if we already hold; never START
@@ -589,17 +595,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     let rooms = []
     const me = session.user.id
     try {
-      // Discovery (Contract C-CODE-2, evolved owner-only → owner-OR-granted): a host
-      // bridges the sessions it OWNS *plus* any it has been explicitly granted to serve
-      // (code_sessions.serve_grant_uid = me — the owner-consent grant, #206/#208). RLS
-      // returns owned OR participant rooms, and a grantee is ALWAYS a participant
-      // (set_serve_grant requires it), so a granted row is visible to this login. Without
-      // a filter the supervisor would auto-serve rooms you merely JOINED as a guest —
-      // spawning your machine into another owner's session that already runs its own
-      // bridge; the .or keeps un-granted joins out while letting a consented grant IN.
-      // The web watches tpacct:<session-owner>; a granted bridge serves on the owner's
-      // behalf (the grant IS the consent), so it is wanted duplication, not stray.
-      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,serve_grant_uid,participants').or(`owner_id.eq.${me},serve_grant_uid.eq.${me}`).order('last_active_at', { ascending: false }).limit(20)
+      // Discovery (Contract C-CODE-2, owner-only since 2026-07-06): a host bridges ONLY
+      // the sessions it OWNS. RLS returns owned OR participant rooms; the owner filter
+      // keeps rooms you merely JOINED as a guest out of auto-serve — your machine never
+      // spawns into another owner's session (cross-person serving removed; pairing is
+      // read-only peer peek, not hosting). The web watches tpacct:<session-owner>.
+      const { data } = await sb.from('code_sessions').select('code,name,last_active_at,owner_id,participants').eq('owner_id', me).order('last_active_at', { ascending: false }).limit(20)
       rooms = data || []
       // Prune refused entries for rooms we can no longer serve — owned OR granted (only
       // on a SUCCESSFUL fetch, so a transient query error never wipes the set).
@@ -611,15 +612,8 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
     for (const r of rooms) {
       const room = r.code
       if (!room || children.has(room)) { if (room) refused.delete(room); continue }   // served → not refused
-      // Grant-reclaim cooldown (DEFECT 2): this room's grantee child recently yielded to the
-      // owner's bridge (exit 75). Skip re-serving it until the window elapses so we don't
-      // thrash-respawn a child that will only yield again. refused already reads 'owner-serves'
-      // (set on that exit below), so presence stays honest while we stand by.
-      const cdUntil = grantCooldown.get(room)
-      if (roomInCooldown(cdUntil, Date.now())) continue
-      if (cdUntil) grantCooldown.delete(room)   // window elapsed — allow one fresh attempt (owner may have gone)
-      // Defense-in-depth behind the .or above: serve iff we OWN the room or hold its grant.
-      if (!supervisorServes({ ownerId: r.owner_id, grantUid: r.serve_grant_uid, myUid: me })) continue
+      // Defense-in-depth behind the owner-only query above: serve iff we OWN the room.
+      if (!supervisorServes({ ownerId: r.owner_id, myUid: me })) continue
       // Resolve the serve dir: explicit bind > last-served memory > launch dir. REFUSE
       // to auto-serve an unbound room from $HOME — that strips the agent's resume context
       // (cwd-keyed SDK sessions) and shows your home folder as the repo (FVIHV1DE).
@@ -660,7 +654,12 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       delete env.THINKPOOL_PAIR_AUTOUPDATE
       // Hand the child the owner JWT for authed web writes (code-mockup, L16).
       if (currentAccessToken) env.TP_ACCESS_TOKEN = currentAccessToken
+
+      // ── supervisor child_spawn logging (cascade brg-instrument) ─────────────────
+      const alreadyHad = children.has(room)
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
+      console.log(`child_spawn sup=${SUP_ID} room=${room} pid=${child.pid} dir=${dir} had_prior=${alreadyHad}`)
+
       children.set(room, child)
       childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
       childBetween.set(room, false)
@@ -738,16 +737,10 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
         }
       })
       const dropRoom = (code) => {
+        // ── supervisor child_exit logging (cascade brg-instrument) ─────────────────
+        console.log(`child_exit sup=${SUP_ID} room=${room} pid=${child?.pid || '?'} code=${code || '?'}`)
+
         children.delete(room); childIdle.delete(room); childBetween.delete(room); childPeer.delete(room); roomNames.delete(room); roomPartner.delete(room)   // re-served on the next tick
-        // Owner-reclaim SENTINEL (75): the grantee child stood down because the owner's bridge
-        // returned. Park the room on a cooldown so discovery doesn't respawn it into another
-        // immediate yield (DEFECT 2), and mark refused 'owner-serves' so presence is honest.
-        // A revoke-yield exits 0 (discovery drops a revoked room anyway); owner-owned rooms
-        // never yield, so neither cools down. `code` is undefined on the 'error' path — fine.
-        if (shouldCooldownOnExit(code)) {
-          grantCooldown.set(room, Date.now() + GRANT_COOLDOWN_MS)
-          refused.set(room, 'owner-serves')
-        }
         // Fail any in-flight cross-room peeks/posts this dead room had ASKED (bus-origin
         // entries have askerRoom null and just time out on their own).
         for (const [reqId, w] of pairPending) { if (w?.askerRoom === room) pairPending.delete(reqId) }
@@ -790,6 +783,9 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   const stop = (sig) => {
     if (stopping) return; stopping = true
     const code = restarting ? 1 : 0
+
+    // ── supervisor stand-down logging (cascade brg-instrument) ─────────────────
+    console.log(`supervisor_stop sup=${SUP_ID} reason=${sig || 'unknown'} restarting=${restarting} children=${children.size}`)
     clearInterval(iv)
     for (const t of updateTimers) { try { clearInterval(t) } catch { /* noop */ } }   // clearInterval clears Timeouts too
     keepFresh.cancel()

package/bridge.mjs

@@ -37,7 +37,7 @@ import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
-import { serveDecision, amGrantee, standDownOnPeerAnnounce, standDownOnGrantChange, fetchServeRow, refusalMessage, gateFailAction, GRANT_RECLAIM_EXIT } from './serve-consent.mjs'
+import { serveDecision, fetchServeRow, refusalMessage, gateFailAction } from './serve-consent.mjs'
 import { reapTerminalRow as _reapTerminalRow } from './reap-terminal.mjs'
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
@@ -397,7 +397,7 @@ if (_superOwn.includes('--supervise') || _superOwn.includes('--keep-alive')) {
     child.on('error', () => { /* spawn failure → exit handler retries */ })
   }
   for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stopping = true; try { child?.kill(sig) } catch { /* noop */ } setTimeout(() => process.exit(0), 400) })
-  process.stderr.write(`\n  ◆ supervisor up — keeping the bridge for room ${room} alive (auto-restart on crash).\n`)
+  process.stderr.write(`\n  [b:${BRIDGE_ID} r:${room}] ◆ supervisor up — keeping the bridge for room ${room} alive (auto-restart on crash).\n`)
   spawnChild()
   await new Promise(() => {})   // block forever; the child IS the bridge
 }
@@ -505,14 +505,15 @@ if (process.stdin.isTTY && !headless && process.env.THINKPOOL_PAIR_AUTOUPDATE !=
     const yes = await askYesNo(`\n  Run as a background service instead? It survives reboot + auto-updates,\n  but runs detached — you'd stop it with 'uninstall-service', not Ctrl-C.\n  Install background service? [y/N] `, false)
     if (yes) {
       svc.installService(room, attachedCmd ? [attachedCmd, ...attachedArgs] : [])
-      process.stderr.write(`\n  ◆ the background service is handling room ${room} now — you can close this terminal.\n  ◆ STOP IT with:  npx thinkpool-pair@latest uninstall-service ${room}\n     (closing the terminal does NOT stop it — it's detached under launchd/systemd.)\n\n`)
+      process.stderr.write(`\n  [b:${BRIDGE_ID} r:${room}] ◆ the background service is handling room ${room} now — you can close this terminal.\n  ◆ STOP IT with:  npx thinkpool-pair@latest uninstall-service ${room}\n     (closing the terminal does NOT stop it — it's detached under launchd/systemd.)\n\n`)
       process.exit(0)   // hand off to the supervised service (no double bridge)
     }
     try { fs.mkdirSync(path.dirname(declineFile), { recursive: true }); fs.writeFileSync(declineFile, new Date().toISOString()) } catch { /* noop */ }
-    process.stderr.write(`  ◆ running in this terminal. (Auto-update service anytime: npx thinkpool-pair@latest install-service ${room})\n`)
+    process.stderr.write(`  [b:${BRIDGE_ID} r:${room}] ◆ running in this terminal. (Auto-update service anytime: npx thinkpool-pair@latest install-service ${room})\n`)
   }
 }
 const name = process.env.TP_NAME || os.userInfo().username || 'host'
+const BRIDGE_ID = (randomUUID?.().slice(0,8)) || 'bridgexx'
 // host: this machine's short label — os.hostname() with any DNS/domain suffix
 // stripped and capped ~24 chars. A /code room can be served by different bridges
 // over time (Max's Mac vs Conrad's Linux box); the client uses this to show WHICH
@@ -528,6 +529,48 @@ const repoLabel = path.basename(cwd)
 // thinkpool-pair's own version — surfaced in the room's welcome banner.
 let VERSION = null
 try { VERSION = JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { /* unknown — banner omits it */ }
+
+// Stale npx cache check — warn if the running bridge is older than the newest installed.
+// Uses proper semver comparison (not string compare) to avoid false positives like "0.7.150" < "0.7.99".
+try {
+  const npxCacheRoot = path.join(os.homedir(), '.npm', '_npx')
+  const npxEntries = fs.readdirSync(npxCacheRoot, { withFileTypes: true })
+    .filter(dirent => dirent.isDirectory())
+    .map(dirent => dirent.name)
+    .filter(name => name !== 'cache')
+
+  // Parse semver into [major, minor, patch] with missing segments as 0
+  const parseSemver = (v) => {
+    if (!v) return [0, 0, 0]
+    return v.split('.').map(p => parseInt(p, 10) || 0)
+  }
+
+  // Compare two semver versions: return true if a < b
+  const semverLess = (a, b) => {
+    const pa = parseSemver(a)
+    const pb = parseSemver(b)
+    for (let i = 0; i < 3; i++) {
+      if (pa[i] < pb[i]) return true
+      if (pa[i] > pb[i]) return false
+    }
+    return false // equal
+  }
+
+  let newestVersion = null
+  for (const entry of npxEntries) {
+    const pkgPath = path.join(npxCacheRoot, entry, 'node_modules', 'thinkpool-pair', 'package.json')
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+      if (pkg.version) {
+        if (!newestVersion || semverLess(newestVersion, pkg.version)) newestVersion = pkg.version
+      }
+    } catch { /* skip unreadable entries */ }
+  }
+
+  if (newestVersion && VERSION && semverLess(VERSION, newestVersion)) {
+    process.stderr.write(`  ⚠ stale-cache: running ${VERSION}, newest ${newestVersion}\n`)
+  }
+} catch { /* skip on any error — this is a lint, not a hard gate */ }
 // Read the CURRENT branch LIVE (not once at boot) so the room's mode row reflects a
 // branch switch instead of showing whatever branch the dir was on when the bridge spawned
 // (the stale-branch bug). Handles a .git dir (normal checkout) AND a .git FILE (linked
@@ -622,18 +665,16 @@ const isRoomParticipant = async (jwt) => {
     return Array.isArray(rows) && rows.length > 0
   } catch { return false }
 }
-// ── Room-serve owner consent (Contract C-CODE-3) ──────────────────────────────
-// A room is served by its OWNER's bridge; a non-owner may serve only with the
-// owner's explicit grant (code_sessions.serve_grant_uid). Enforced HERE — before the
-// realtime channel is even built — so a refused bridge never dials the room. Owner
-// reclaim (a grantee yields when the owner's bridge reappears) + grant revocation are
-// wired below on the EXISTING room channel / REST row — no new topic
-// (feedback_no_duplicate_realtime_channel, H41). LIMITATION: enforcement is in-bridge;
-// an OLDER bridge bypasses it (no wire-level lock). Spec: docs/specs/2026-07-04-room-serve-owner-consent.md.
-let roomOwnerId = null       // code_sessions.owner_id, learned at the gate
+// ── Room-serve owner consent (Contract C-CODE-3, owner-only since 2026-07-06) ──
+// A room is served by its OWNER's bridge ONLY — no cross-person grantee path
+// (removed 2026-07-06; see docs/specs/2026-07-06-remove-cross-person-serve.md).
+// Enforced HERE — before the realtime channel is even built — so a non-owner bridge
+// never dials the room. Same-account second-machine coexistence is handled by the
+// per-account claim_bridge, not here. LIMITATION: enforcement is in-bridge; an OLDER
+// bridge may still honor a grant — but the serve_grant_uid column was dropped server-side
+// in the same migration, so an old bridge can no longer READ a grant and refuses as a
+// non-owner. That closes the bypass.
 let myServeUid = null        // this bridge's authed uid (null = anon)
-let iServeAsGrantee = false  // serving by grant, not as owner → the only bridge that yields
-let yielding = false         // set once when standing down, so reclaim + revoke don't double-fire
 {
   // Standalone room mode ran anon unless TP_ACCESS_TOKEN was in env; load the stored
   // login so `npx thinkpool-pair <CODE>` authenticates AS the signed-in user (the
@@ -675,17 +716,14 @@ let yielding = false         // set once when standing down, so reclaim + revoke
       const { data } = await supabase.auth.getUser(codeAuthToken)
       myServeUid = data?.user?.id || null
     }
-    const { ownerId, grantUid, name } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
-    roomOwnerId = ownerId
-    const decision = serveDecision({ ownerId, grantUid, myUid: myServeUid })
+    const { ownerId, name } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
+    const decision = serveDecision({ ownerId, myUid: myServeUid })
     if (!decision.serve) {
       process.stderr.write(refusalMessage({ room, name, reason: decision.reason }))
       // exit 0 — an intentional stand-down, not a crash, so a supervisor does not
       // thrash-restart it (matches the machine-lock stand-down at the top of boot).
       process.exit(0)
     }
-    iServeAsGrantee = amGrantee({ ownerId, grantUid, myUid: myServeUid })
-    if (iServeAsGrantee) process.stderr.write(`\n  ◆ serving room ${room} by the owner's grant — will yield if the owner's bridge returns or the grant is revoked.\n`)
   } catch (e) {
     // A THROWN fetchServeRow error is either a definitively-bad auth (401/403) or an
     // availability failure (5xx / transport reject). Only the latter fails OPEN — a stale
@@ -995,26 +1033,8 @@ const announce = () => {
     ],
   }) }
 
-// Owner reclaim (Contract C-CODE-3 invariant 3): a grantee-served bridge that sees
-// the OWNER's bridge announce on this same room channel stands down — the owner's
-// bridge always wins. Reuses the existing `bridge` announce (its additive `uid`) — no
-// new topic (feedback_no_duplicate_realtime_channel). The owner's own bridge never
-// yields (standDownOnPeerAnnounce returns false for it). Clean shutdown(0): shuttingDown
-// suppresses the term-exit broadcast, so no structured terminal row is reaped
-// (docs/specs/2026-07-04-structured-terminal-durability.md — a handover must not delete rows).
-function onPeerBridgeAnnounce (payload) {
-  if (yielding) return
-  if (!standDownOnPeerAnnounce({ myUid: myServeUid, ownerId: roomOwnerId, peerUid: payload?.uid })) return
-  yielding = true
-  process.stderr.write(`\n  ◆ owner's bridge reconnected — yielding room ${room}.\n`)
-  // Exit with the grant-reclaim SENTINEL (not a clean 0). A supervisor that spawned this
-  // grantee child reads the code and puts the room on a cooldown, so it does NOT respawn a
-  // child that will only yield again — the owner-serves/grantee-stands-by coexistence state
-  // must not thrash-churn every discovery tick (DEFECT 2, 2026-07-05). shutdown() still sets
-  // shuttingDown FIRST, so the term-exit broadcast stays suppressed and structured terminal
-  // rows survive the stand-down (#205/#208 durability — a handover must not delete rows).
-  shutdown(GRANT_RECLAIM_EXIT)
-}
+// (cross-person grantee yield removed 2026-07-06 — owner-only serving now; the owner's
+//  bridge never stands down. See docs/specs/2026-07-06-remove-cross-person-serve.md.)
 
 // ── Thinkpool Ensemble — cross-ROOM reach (Tier 1: same-machine pair peek) ────
 // The in-room Ensemble (read_terminal over sibling terminals) expanded ACROSS the
@@ -2693,9 +2713,6 @@ channel
     announce()
   })
   .on('broadcast', { event: 'who' }, announce)
-  // Peer bridge announces (owner reclaim) — a grantee yields when the owner's bridge
-  // reappears. broadcast self:false, so this only fires for OTHER bridges on the topic.
-  .on('broadcast', { event: 'bridge' }, ({ payload }) => onPeerBridgeAnnounce(payload))
   // ── Provider registry — the multi-BYOK wire contract (room mode). ─────────────
   // AUTH: room mode serves a room the user may not own (post-#208 grant). We verify
   // the sender is a participant of THIS room before ANY operation. List is open to
@@ -2782,7 +2799,7 @@ channel
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
       realtimeHealthy = true; brokenSince = 0
-      trackPresence({ name, role: 'bridge' })
+      trackPresence({ name, role: 'bridge', bridge_id: BRIDGE_ID })
       const startCmd = attachedCmd || autoAgent   // autoAgent: account-mode auto-open (headless)
       if (startCmd && !terms.size && !sessions.size) {
         // Claude + structured mode → Agent SDK session; everything else → PTY.
@@ -3145,26 +3162,6 @@ setInterval(() => {
   }
 }, 15000).unref()
 
-// Grant revocation mid-serve (Contract C-CODE-3 invariant 3): a grantee re-checks the
-// row on a slow cadence — a cheap poll on the EXISTING REST endpoint, no new realtime
-// subscription (the owner-reclaim announce path above is the fast one). If the grant no
-// longer names this bridge (cleared or reassigned), stand down. Owner bridges never poll
-// (iServeAsGrantee is false for them). A flaky fetch never yields — next tick re-checks.
-if (iServeAsGrantee) {
-  const RECHECK_MS = Math.max(15000, parseInt(process.env.TP_SERVE_RECHECK_MS, 10) || 30000)
-  setInterval(async () => {
-    if (yielding) return
-    try {
-      const { grantUid } = await fetchServeRow({ supabaseUrl: SUPABASE_URL, anonKey: SUPABASE_ANON, token: codeAuthToken, room })
-      if (standDownOnGrantChange({ myUid: myServeUid, ownerId: roomOwnerId, grantUid })) {
-        yielding = true
-        process.stderr.write(`\n  ◆ serve grant revoked — yielding room ${room}.\n`)
-        shutdown(0)
-      }
-    } catch { /* transient — never yield on a flaky fetch; next tick re-checks */ }
-  }, RECHECK_MS).unref()
-}
-
 // ── auto-update (OS-service tier only) ─────────────────────────────────
 // launchd (KeepAlive) and systemd (Restart=always) re-run
 // `npx -y thinkpool-pair@latest` on every (re)start, so a clean exit here makes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.166",
+  "version": "0.7.168",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, \u2026) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/serve-consent.mjs

@@ -1,81 +1,52 @@
 // Room-serve owner consent — decision core (pure) + row fetch.
 //
-// Spec: docs/specs/2026-07-04-room-serve-owner-consent.md (Contract C-CODE-3).
-// A room is served by its OWNER's bridge; a non-owner bridge may serve only with
-// the owner's explicit grant (`code_sessions.serve_grant_uid`); the owner's bridge
-// always wins reclaim, the grantee stands down.
+// Spec: docs/specs/2026-07-06-remove-cross-person-serve.md (Contract C-CODE-3, evolved).
+// A room is served by its OWNER's bridge ONLY. No cross-person serving, no grantee
+// path (removed 2026-07-06 — the cross-person grant was a recipe for the wrong-session
+// fuckery). The owner's own bridge on a second machine is handled by the per-account
+// claim_bridge, not here. Pairing stays read-only (peer peek across the pair).
 //
 // This module holds ONLY pure, order-independent decisions (unit-tested in
-// bridge/test-serve-consent.mjs) plus a single network helper. The wiring —
-// where the gate runs, when a grantee yields — lives in bridge.mjs. Keeping the
-// logic pure is the feedback_code_seed_order_independent discipline: no decision
-// depends on live channel/session state, so every branch is testable off-wire.
+// bridge/test-serve-consent.mjs) plus a single network helper. The wiring — where the
+// gate runs — lives in bridge.mjs. Keeping the logic pure is the
+// feedback_code_seed_order_independent discipline: no decision depends on live
+// channel/session state, so every branch is testable off-wire.
 //
-// LIMITATION (documented, spec Contract C-CODE-3 invariant 1): enforcement is
-// in-bridge. A bridge OLDER than this version never reads the column and bypasses
-// the check — there is no server-side wire-level lock. The grant is a coordination
-// signal honored by compliant bridges, not a serve token. Out of scope here.
+// LIMITATION (documented): enforcement is in-bridge. A bridge OLDER than this version
+// may still honor a grant — there is no server-side wire-level lock. The set_serve_grant
+// RPC + serve_grant_uid column were dropped server-side in the same 2026-07-06 migration,
+// so even an old bridge can no longer READ a grant (the column is gone) and will refuse
+// as a non-owner. That closes the bypass.
 
 // serveDecision — may THIS bridge serve THIS room?
-//   ownerId  : code_sessions.owner_id (uuid | null)
-//   grantUid : code_sessions.serve_grant_uid (uuid | null)  — the one granted non-owner
+//   ownerId : code_sessions.owner_id (uuid | null)
 //   myUid    : this bridge's authed user id (uuid | null)   — null when the bridge is anon
 // Returns { serve, reason }:
-//   reason 'owner'       — myUid owns the room (always serves)
-//   reason 'grant'       — myUid is the granted non-owner
-//   reason 'no-identity' — bridge has no authed uid, so it can be neither owner nor
-//                          grantee → refuse (the new model has no anon serve path)
-//   reason 'not-granted' — authed, but neither owner nor the current grantee → refuse
+//   reason 'owner'       — myUid owns the room (the only serve path)
+//   reason 'no-identity' — bridge has no authed uid → refuse (no anon serve path)
+//   reason 'not-owner'   — authed, but not the owner → refuse
 //   reason 'unknown-room'— no owner_id resolved (row missing / RLS-hidden) → refuse
-export function serveDecision ({ ownerId, grantUid, myUid }) {
+export function serveDecision ({ ownerId, myUid }) {
   if (!myUid) return { serve: false, reason: 'no-identity' }
   if (!ownerId) return { serve: false, reason: 'unknown-room' }
   if (myUid === ownerId) return { serve: true, reason: 'owner' }
-  if (grantUid && myUid === grantUid) return { serve: true, reason: 'grant' }
-  return { serve: false, reason: 'not-granted' }
+  return { serve: false, reason: 'not-owner' }
 }
 
 // supervisorServes — the account supervisor's per-row discovery decision: may this
-// login auto-serve THIS discovered room? True iff the login OWNS the room or HOLDS its
-// serve grant. This is the defense-in-depth per-row check behind the supervisor's
-// `.or(owner_id.eq.me,serve_grant_uid.eq.me)` query — a broad RLS row (owned OR merely
-// participant) must still resolve to owned-or-granted before a child is spawned. Mirrors
-// serveDecision's owner|grant serve set, evaluated against a discovery row rather than a
-// gate fetch (Contract C-CODE-2, evolved owner-only → owner-or-granted).
-export function supervisorServes ({ ownerId, grantUid, myUid }) {
+// login auto-serve THIS discovered room? True iff the login OWNS the room. This is the
+// defense-in-depth per-row check behind the supervisor's owner-only `.eq(owner_id, me)`
+// query — a broad RLS row (owned OR merely participant) must still resolve to OWNED
+// before a child is spawned. Contract C-CODE-2 (owner-only).
+export function supervisorServes ({ ownerId, myUid }) {
   if (!myUid) return false
-  return ownerId === myUid || grantUid === myUid
+  return ownerId === myUid
 }
 
-// amGrantee — this bridge serves by grant (not as owner). Grantees are the only
-// bridges that ever stand down; the owner's bridge never yields.
-export function amGrantee ({ ownerId, grantUid, myUid }) {
-  return !!(myUid && myUid !== ownerId && grantUid && myUid === grantUid)
-}
-
-// standDownOnPeerAnnounce — a grantee-served bridge saw ANOTHER bridge announce on
-// the room channel. Yield iff that peer is the OWNER's bridge (peerUid === ownerId)
-// and I am not the owner. The owner's own bridge (myUid === ownerId) never yields —
-// serveDecision already refused any second non-owner, so a peer that isn't the owner
-// is either a stale duplicate of me or nothing to cede to.
-export function standDownOnPeerAnnounce ({ myUid, ownerId, peerUid }) {
-  if (!myUid || !ownerId) return false
-  if (myUid === ownerId) return false          // owner never stands down
-  return !!peerUid && peerUid === ownerId       // owner's bridge reclaimed → yield
-}
-
-// standDownOnGrantChange — a grantee re-checked the row and the grant no longer
-// names it (revoked, or reassigned to a third party). Yield. The owner never yields
-// on a grant change (the grant does not govern the owner).
-export function standDownOnGrantChange ({ myUid, ownerId, grantUid }) {
-  if (!myUid || myUid === ownerId) return false
-  return grantUid !== myUid
-}
-
-// fetchServeRow — read the room's consent columns with whatever identity the bridge
-// holds (authed token → RLS returns the row if the user is a member; anon → empty).
-// THROWS on a non-OK response or a transport error. The thrown error carries `.authHard`
-// so the caller can tell the two apart (Contract C-CODE-3 invariant 2, hardened 2026-07-05):
+// fetchServeRow — read the room's owner with whatever identity the bridge holds
+// (authed token → RLS returns the row if the user is a member; anon → empty). THROWS on
+// a non-OK response or a transport error. The thrown error carries `.authHard` so the
+// caller can tell the two apart (Contract C-CODE-3 invariant 2, hardened 2026-07-05):
 //   - 401/403 (authHard === true) → auth is DEFINITIVELY bad (dead/expired token). The
 //     caller REFUSES: a stale access token must never fail OPEN into serving, or the gate
 //     is bypassed in the common case (stored tokens expire ~1h). The caller refreshes the
@@ -88,7 +59,7 @@ export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
   const headers = { apikey: anonKey }
   if (token) headers.Authorization = `Bearer ${token}`
   const r = await fetch(
-    `${supabaseUrl}/rest/v1/code_sessions?select=owner_id,serve_grant_uid,name&code=eq.${encodeURIComponent(room)}`,
+    `${supabaseUrl}/rest/v1/code_sessions?select=owner_id,name&code=eq.${encodeURIComponent(room)}`,
     { headers },
   )
   if (!r.ok) {
@@ -101,7 +72,6 @@ export async function fetchServeRow ({ supabaseUrl, anonKey, token, room }) {
   const row = Array.isArray(rows) ? rows[0] : null
   return {
     ownerId: row?.owner_id ?? null,
-    grantUid: row?.serve_grant_uid ?? null,
     name: row?.name ?? null,
   }
 }
@@ -114,36 +84,13 @@ export function gateFailAction (err) {
   return err?.authHard ? 'refuse' : 'fail-open'
 }
 
-// ── supervisor grant-reclaim cooldown (DEFECT 2, 2026-07-05) ──────────────────
-// A grantee child that yields to the owner's returning bridge exits with this SENTINEL
-// code (distinct from a clean 0 / a crash 1). The supervisor reads the exit code and puts
-// the room on a cooldown so it does NOT thrash-respawn a child that will only yield again —
-// the feature's INTENDED coexistence state (owner serves, grantee stands by) must not churn.
-// A revoke-yield keeps exit 0 (discovery drops a revoked room anyway); owner-owned rooms
-// never yield, so they never cool down.
-export const GRANT_RECLAIM_EXIT = 75
-
-// shouldCooldownOnExit — did this child exit BECAUSE the owner reclaimed the room (75)?
-// Only that exit arms the cooldown; a clean stop (0), a crash (1), or a signal (null) do not.
-export function shouldCooldownOnExit (code) {
-  return code === GRANT_RECLAIM_EXIT
-}
-
-// roomInCooldown — is a room still inside its grant-reclaim cooldown window? The supervisor
-// discovery tick skips re-serving while this is true. `until` is a wall-clock ms deadline
-// (Date.now() + window); a null/expired deadline means serve again (owner may have gone).
-export function roomInCooldown (until, now) {
-  return !!(until && now < until)
-}
-
 // refusalMessage — the human-facing stderr line when a bridge refuses to serve.
 export function refusalMessage ({ room, name, reason }) {
   const label = name ? `"${name}"` : '(unnamed)'
   if (reason === 'no-identity') {
     return `\n  ◇ Refusing to serve room ${room} — this bridge is not signed in.\n` +
-      `    A room is served by its owner's bridge. Sign in first:  npx thinkpool-pair login\n`
+      `    A room is served only by its owner's bridge. Sign in first:  npx thinkpool-pair login\n`
   }
-  return `\n  ◇ Refusing to serve room ${room} ${label} — it is owned by another person; their bridge serves it.\n` +
-    `    Ask them to grant your machine hosting rights in the room (bridge status card),\n` +
-    `    then re-run. The grant is the only way in — there is no override flag.\n`
+  return `\n  ◇ Refusing to serve room ${room} ${label} — it is owned by another person; only their bridge serves it.\n` +
+    `    Pairing gives you a read-only view across the pair, not hosting rights. There is no override.\n`
 }