thinkpool-pair 0.7.181 → 0.7.182

package/bridge.mjs

@@ -744,18 +744,11 @@ let myServeUid = null        // this bridge's authed uid (null = anon)
 refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken now set from env OR the stored login)
 
 // ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
-// The bridge calls the durable ledger RPCs as the OWNER (codeAuthToken); is_session_member
-// passes for this room, so the room-scope cap enforces. Member-scope attribution needs the
-// SENDER's uid (not available here — a turn carries a display label + cid, not a uuid), so
-// the baseline records/enforces ROOM scope only; per-member caps wait on the quota-fairness
-// work. TP_BUDGET_OFF disables the whole path. `roomCapped` caches whether a cap exists so a
-// transient ledger error fails CLOSED only for a room we KNOW is capped, and open otherwise.
+// TP_BUDGET_OFF disables the spend-ledger path entirely (record_spend). The per-room output-
+// token CAP was removed (2026-07) — redundant for BYOK (the provider enforces spend limits),
+// a per-turn check_budget round-trip on every authed turn, and a fail-closed hazard. The
+// spend LEDGER stays: it powers the Session-info "Session tokens" stat.
 const BUDGET_OFF = process.env.TP_BUDGET_OFF === '1'
-let roomCapped = false
-function monthResetLabel () {
-  const d = new Date()
-  return new Date(d.getFullYear(), d.getMonth() + 1, 1).toISOString().slice(0, 10)
-}
 async function budgetRpc (fn, args) {
   const r = await fetch(`${SUPABASE_URL}/rest/v1/rpc/${fn}`, {
     method: 'POST',
@@ -828,36 +821,6 @@ function recordCodeUsage (model, usage) {
   budgetRpc('record_code_usage', { p_room: room, p_model: model, p_input: input, p_output: output, p_cached: cached })
     .catch(() => { /* best-effort — usage accounting is not load-bearing for the turn */ })
 }
-// Pre-flight gate. Returns true if the turn must be REFUSED (room cap reached). Refusal is
-// legible (a ◆ control line both readers + late-joiners see), never a silent stall.
-async function budgetBlocked (s, term) {
-  if (BUDGET_OFF || !codeAuthToken) return false
-  const refuse = (text) => {
-    const evt = { kind: 'control', text }
-    try { pushLog(s, evt) } catch { /* no session log */ }
-    bcast('code-event', { term, evt })
-    return true
-  }
-  try {
-    const rows = await budgetRpc('check_budget', { p_room: room })
-    const r = Array.isArray(rows) ? rows[0] : rows
-    roomCapped = !!(r && r.remaining_tokens != null)
-    if (r && r.ok === false) {
-      process.stderr.write(`\n  ${A.yel}◆ turn refused — ${r.tightest_scope} budget cap reached (room ${room}).${A.rst}\n`)
-      return refuse(`◆ Turn blocked — this room hit its ${r.tightest_scope || 'budget'} cap. Resets ${monthResetLabel()}, or raise the cap.`)
-    }
-    return false
-  } catch (e) {
-    // Fail-closed ONLY where we know a cap exists — a transient ledger/DNS blip must never
-    // brick an UNCAPPED room (that would be a worse outage than the cap it's guarding).
-    if (roomCapped) {
-      process.stderr.write(`\n  ${A.yel}◆ turn refused — budget check failed, room is capped (fail-closed).${A.rst}\n`)
-      return refuse('◆ Turn blocked — budget check is unavailable and this room has a cap set. Try again in a moment.')
-    }
-    process.stderr.write(`\n  ${A.dim}◆ budget check skipped (${e.message}) — room uncapped, proceeding.${A.rst}\n`)
-    return false
-  }
-}
 // Throttled presence track() (presence.mjs) — a reconnect storm re-fires SUBSCRIBED and
 // the handler re-track()s; without throttle that spirals into the per-client presence
 // rate limit (ClientPresenceRateLimitReached). Lazy so it binds `channel` (the chain
@@ -2244,8 +2207,9 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         const b = flowBudgets.get(entry.flowSessionId)
         if (b) flowBudgets.set(entry.flowSessionId, recordSpend(b, evt.usage.output_tokens || 0))
       }
-      // Budget caps — fold EVERY completed turn's output tokens into the room's durable
-      // monthly ledger (lanes + normal turns), so check_budget can pre-flight the next one.
+      // Fold EVERY completed turn's output tokens into the room's durable monthly ledger
+      // (lanes + normal turns) — powers the Session-info "Session tokens" stat. (The cap that
+      // consumed this ledger was removed; the accounting stays.)
       if (evt.kind === 'result' && evt.usage) { recordRoomSpend(evt.usage.output_tokens || 0); recordCodeUsage(evt.model, evt.usage) }
       // FL-B1 (lane) — a flow lane that ENDS ITS TURN is done: a bypass lane runs its slice
       // to completion in one turn, then narrates "done" and stops. Models often skip the
@@ -2870,10 +2834,6 @@ channel
     // control lines (like /model) so both members AND late-joiners see it. Scope is honest —
     // the Agent SDK exposes tokens + cost, not plan/rate-limit meters, and the card says so.
     if (/^\/usage\s*$/.test(text)) { ctlLine(usageReportLine(s.model, s.log)); return }
-    // Pre-flight budget gate (room scope) — refuse the billable agent turn if the room hit
-    // its cap. The slash controls above (/model, /clear, /compact) are intentionally exempt:
-    // they let a user manage or REDUCE spend even when capped. Legible refusal, no silent stall.
-    if (await budgetBlocked(s, payload.term)) return
     // Context-carry (2026-07-08) point 4: a real human turn arrived BEFORE the post-switch/
     // restore recap fired on init-`system`. Prepend the recap to THIS turn (one turn, not two
     // — a separate recap turn would race + double-fire) and clear the flag so the init handler

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.181",
+  "version": "0.7.182",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {