thinkpool-pair 0.7.184 → 0.7.186

package/bridge.mjs

@@ -95,7 +95,8 @@ const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
-import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
+import { planMeterLine } from './plan-meters.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
@@ -928,10 +929,23 @@ const defendFrame = (event, payload) => {
   if (Array.isArray(p.events)) {
     p.events = p.events.map((e) => boundEventForBroadcast(e, 100000))
     // …and if a frame is STILL over the limit, drop the OLDEST events until it fits —
-    // keep the newest so the client's seqHi still advances to current. classifyReplay
-    // accepts the resulting seq jump; older events are covered by the DB transcript snapshot.
-    let guard = 0
-    while (p.events.length > 1 && JSON.stringify(p).length > FRAME_SOFT_LIMIT && guard++ < 10000) p.events.shift()
+    // keep the newest so the client's seqHi still advances to current.
+    //
+    // C-RG1 (2026-07-10): STAMP what we dropped. This used to end with "classifyReplay
+    // accepts the resulting seq jump; older events are covered by the DB transcript
+    // snapshot" — both halves were wrong. classifyReplay accepting the jump IS the bug
+    // (the client leapt over a hole it couldn't see, and its "load earlier" gate only
+    // detects a LEADING gap, never a middle one). And the tx: snapshot never covered
+    // this; the durable JSONL archive does. So say what we trimmed and let the client
+    // fetch it back. Events dropped here were about to be broadcast, so by construction
+    // they're in the archive — the stamp is always recoverable. Raise, never lower: the
+    // send site may have already stamped a chunk-cap trim below this one.
+    let guard = 0, dropped = 0
+    while (p.events.length > 1 && JSON.stringify(p).length > FRAME_SOFT_LIMIT && guard++ < 10000) { p.events.shift(); dropped++ }
+    if (dropped) {
+      const lo = firstSeq(p.events)
+      if (typeof lo === 'number') p.trimmedBefore = Math.max(p.trimmedBefore ?? 0, lo)
+    }
   }
   return p
 }
@@ -2701,17 +2715,30 @@ channel
       // Chunk the tail into ORDERED under-budget frames (A): the full log on a fresh reload
       // (empty cursor) is multi-MB and a single frame would be dropped by Realtime, freezing
       // the terminal. chunkReplayEvents splits it so nothing in the recent window is lost;
-      // classifyReplay applies the chunks in arrival order. Older history beyond the chunk
-      // budget is covered by the client's DB transcript snapshot.
+      // classifyReplay applies the chunks in arrival order.
+      //
+      // C-RG1 (2026-07-10): chunkReplayEvents keeps only the newest REPLAY_MAX_CHUNKS —
+      // a fat lane (measured: 1.7MB / 12 chunks) drops its OLDEST chunks. That hole used
+      // to travel unannounced; the client absorbed the seq jump and could never fetch the
+      // missing stretch back (its "load earlier" gate only sees a LEADING gap). Tell it.
+      // `cursor` is what the client holds — an `ahead` reset replay is a full rebuild, so
+      // it holds nothing (0). The floor keeps a fresh lane whose first turn lands at seq>1
+      // from being stamped (the 2026-07-02 phantom-pill regression).
+      const chunks = chunkReplayEvents(tail)
+      const cursor = ahead ? 0 : from
+      const trimmedBefore = trimmedBeforeSeq(firstSeq(chunks[0] || []), cursor, s.archiveOldestSeq)
       // Attach the terminal's last usage/ctx meter to the FIRST replay chunk. usage is
       // chrome (filtered out of `events` by both bridge + client), so without this a
       // (re)joiner's ctx meter is empty ("—") until the terminal's next turn. The client
       // applies `payload.lastUsage` in its code-replay handler (which is `to`-targeted, so
       // only the joiner gets it). Gated on `.ctx` — a suppressed meter (correctContext
       // nulled it for an unknown non-Claude model) replays nothing, never a misleading %.
+      // trimmedBefore rides the FIRST (oldest) chunk only — the later chunks are contiguous
+      // with it, so a stamp there would read as a second, phantom gap. Same rule as
+      // lastUsage above and hasMore on history-page below.
       let firstChunk = true
-      for (const events of chunkReplayEvents(tail)) {
-        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
+      for (const events of chunks) {
+        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && trimmedBefore != null ? { trimmedBefore } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
         firstChunk = false
       }
     }
@@ -2848,9 +2875,16 @@ channel
     // Computed by REPLAYING the session's own retained result events (each completed turn
     // persists kind:'result' with usage + costUsd + model — see onEvent). No new accumulator
     // state: the log is durable, so this survives a bridge restart for free. Reported as ◆
-    // control lines (like /model) so both members AND late-joiners see it. Scope is honest —
-    // the Agent SDK exposes tokens + cost, not plan/rate-limit meters, and the card says so.
-    if (/^\/usage\s*$/.test(text)) { ctlLine(usageReportLine(s.model, s.log)); return }
+    // control lines (like /model) so both members AND late-joiners see it. Two lines: the
+    // token/cost report (instant, from the retained log), then the plan meters (5h + weekly
+    // utilization + server-authoritative resets) once the OAuth usage endpoint answers. The
+    // meter line is fired-and-forgotten so a slow/unreachable endpoint never stalls /usage;
+    // it degrades to "plan meters unavailable" rather than printing an inferred reset.
+    if (/^\/usage\s*$/.test(text)) {
+      ctlLine(usageReportLine(s.model, s.log))
+      planMeterLine().then((l) => { if (l) ctlLine(l) }).catch(() => { /* meters are never load-bearing */ })
+      return
+    }
     // Context-carry (2026-07-08) point 4: a real human turn arrived BEFORE the post-switch/
     // restore recap fired on init-`system`. Prepend the recap to THIS turn (one turn, not two
     // — a separate recap turn would race + double-fire) and clear the flag so the init handler

package/event-id.mjs

@@ -139,6 +139,39 @@ export function chunkReplayEvents(events, budget = REPLAY_BYTE_BUDGET, maxChunks
   return chunksRev.reverse().map((c) => c.reverse())
 }
 
+// ── C-RG1/C-RG4 (2026-07-10): the bridge stamps what it trimmed. ──────────────
+// chunkReplayEvents keeps only the newest maxChunks — on a fat lane the OLDEST chunks
+// are dropped. Until now that hole was unannounced: classifyReplay accepted the seq
+// jump, seqHi leapt past it, and because the client's "load earlier" gate compares its
+// OLDEST loaded seq against the archive floor, a hole in the MIDDLE (client holds
+// 1..50 ∪ 900..2000) never surfaced a pill and was unrecoverable — silently, forever.
+//
+// The bridge is the only party that knows. Return the lowest seq we are ACTUALLY
+// sending when events below it were withheld AND are recoverable from the durable
+// JSONL archive; null when nothing was withheld.
+//
+// Floor-aware on purpose. The seq counter is per-SESSION, not per-terminal, so a fresh
+// lane's first turn legitimately lands at seq > 1 — stamping that would resurrect the
+// 2026-07-02 phantom "load earlier" pill (a button that fetches nothing). `cursor` is
+// what the client already holds (0 = nothing, and an `ahead` cursor-reset replay must
+// pass 0). `archiveOldestSeq` is the durable floor (bridge.mjs entry.archiveOldestSeq).
+// Anything at or below max(cursor, floor-1) is not missing: either the client has it,
+// or the archive never had it and no affordance could ever fetch it.
+export function trimmedBeforeSeq(sentFromSeq, cursor = 0, archiveOldestSeq = null) {
+  if (typeof sentFromSeq !== 'number') return null
+  const floor = typeof archiveOldestSeq === 'number' ? archiveOldestSeq : 1
+  const known = Math.max(cursor || 0, floor - 1)
+  return sentFromSeq > known + 1 ? sentFromSeq : null
+}
+
+// The lowest transcript seq in an event list (nulls sort out). Chrome events are
+// seq-less (NO_SEQ_KINDS) and must not anchor the stamp.
+export function firstSeq(events) {
+  if (!Array.isArray(events)) return null
+  for (const e of events) if (e && typeof e.seq === 'number') return e.seq
+  return null
+}
+
 // Bound a SINGLE event so it can never overflow a broadcast frame on its own. The worst
 // offenders are tool_results carrying inline base64 IMAGES (a 592KB screenshot block) —
 // these can't ride a size-capped Realtime broadcast at all (live OR replay). Truncate
@@ -264,7 +297,10 @@ export function usageReportLine (sessionModel, logEvents) {
   const total = rows.length > 1 ? ` · total ${fmtTok(sum.totalIn)} in / ${fmtTok(sum.totalOut)} out` : ''
   const cost = sum.haveCost ? ` · ~$${sum.totalCost.toFixed(2)} est` : ''
   const turns = `${sum.turns} turn${sum.turns === 1 ? '' : 's'}`
-  return `usage · ${turns} · ${perStr}${total}${cost} · tokens + cost only (no plan/rate-limit meters)`
+  // No "(no plan/rate-limit meters)" tail any more — the handler appends a second control
+  // line from bridge/plan-meters.mjs carrying the real 5h/weekly utilization + resets, or
+  // an explicit "plan meters unavailable". Neither claim belongs on this token/cost line.
+  return `usage · ${turns} · ${perStr}${total}${cost}`
 }
 
 /* The context-carry recap moved to ./recap.mjs (ADR-0010 / S4, 2026-07-09).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.184",
+  "version": "0.7.186",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -17,6 +17,7 @@
     "update-gate.mjs",
     "agent-notify.mjs",
     "event-id.mjs",
+    "plan-meters.mjs",
     "recap.mjs",
     "transcript-sanitize.mjs",
     "session-store.mjs",

package/plan-meters.mjs

@@ -0,0 +1,144 @@
+/* Plan / rate-limit meters for the /usage report.
+ *
+ * WHERE THE NUMBERS COME FROM. `GET https://api.anthropic.com/api/oauth/usage`
+ * with the Claude Code OAuth access token — the SAME endpoint the CLI's own /usage
+ * screen reads. So the percentages and, critically, the RESET TIMES are the
+ * server's, not ours. We never infer a 5-hour block boundary from transcript
+ * timestamps (the ccusage approach): an inferred reset is a number that looks
+ * authoritative and is wrong, which is exactly the bug this module exists to avoid.
+ *
+ * READ-ONLY, AND DELIBERATELY SO. We read the access token and we never refresh it.
+ * Refreshing rotates the refresh token; two processes rotating against one credential
+ * store is how the bridge's login died before (memory: thinkpool_bridge_login_headless_recovery).
+ * An expired token therefore degrades to "plan meters unavailable" rather than
+ * quietly re-authenticating behind the user's back.
+ *
+ * DEGRADE HONESTLY. Every failure — no token, non-Claude provider, network error,
+ * 401, shape change, a reset timestamp in the past — returns null, and the caller
+ * prints "plan meters unavailable". A stale or invented meter is worse than no meter.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+const USAGE_URL = 'https://api.anthropic.com/api/oauth/usage'
+const CACHE_MS = 45_000
+const FETCH_TIMEOUT_MS = 4_000
+
+// ── token ────────────────────────────────────────────────────────────────────
+// macOS keeps Claude Code's credentials in the login keychain; Linux writes
+// ~/.claude/.credentials.json. Same JSON shape either way: { claudeAiOauth: { accessToken } }.
+// Any failure here is a normal, expected state (BYOK lane, API-key auth, logged out).
+export function readOAuthToken (deps = {}) {
+  const {
+    platform = process.platform,
+    env = process.env,
+    exec = execFileSync,
+    read = readFileSync,
+    home = homedir()
+  } = deps
+  if (env.THINKPOOL_OAUTH_TOKEN) return env.THINKPOOL_OAUTH_TOKEN // test/override seam
+  let raw = null
+  try {
+    if (platform === 'darwin') {
+      raw = exec('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'],
+        { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'] })
+    } else {
+      raw = read(join(home, '.claude', '.credentials.json'), 'utf8')
+    }
+    const tok = JSON.parse(raw)?.claudeAiOauth?.accessToken
+    return (typeof tok === 'string' && tok.startsWith('sk-ant-oat')) ? tok : null
+  } catch { return null }
+}
+
+// ── fetch ────────────────────────────────────────────────────────────────────
+export async function fetchPlanUsage (token, fetchImpl = globalThis.fetch) {
+  if (!token) return null
+  const ac = new AbortController()
+  const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS)
+  try {
+    const res = await fetchImpl(USAGE_URL, {
+      method: 'GET',
+      headers: { authorization: `Bearer ${token}`, 'anthropic-beta': 'oauth-2025-04-20' },
+      signal: ac.signal
+    })
+    if (!res.ok) return null // 401 (expired) / 403 / 5xx → unavailable, never a guess
+    return await res.json()
+  } catch { return null } finally { clearTimeout(timer) }
+}
+
+// ── format (pure) ────────────────────────────────────────────────────────────
+const DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat']
+
+// A reset renders in LOCAL time. Beyond ~20h out (the weekly meter) a bare HH:MM is
+// ambiguous, so it carries a weekday. Returns null for an unparseable timestamp OR one
+// already in the past — a past reset means the payload is stale, and printing "resets
+// 10:10" when 10:10 has been and gone is precisely the lie we refuse to tell.
+export function fmtReset (iso, now) {
+  const t = new Date(iso).getTime()
+  if (!Number.isFinite(t) || t <= now.getTime()) return null
+  // ROUND to the nearest minute, don't floor. The endpoint stamps `resets_at` with
+  // sub-second jitter around the true boundary — two calls seconds apart returned
+  // 10:10:00.355Z and 10:09:59.873Z for the same reset. Flooring renders those as
+  // 12:10 and 12:09, so the meter visibly flickers a minute back and forth on a
+  // surface whose whole job is to be the trustworthy number. Observed 2026-07-10.
+  const d = new Date(Math.round(t / 60000) * 60000)
+  const hhmm = `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`
+  return (t - now.getTime()) > 20 * 3600 * 1000 ? `${DAYS[d.getDay()]} ${hhmm}` : hhmm
+}
+
+const fmtIn = (ms) => {
+  const m = Math.max(0, Math.round(ms / 60000))
+  return m >= 60 ? `${Math.floor(m / 60)}h${String(m % 60).padStart(2, '0')}m` : `${m}m`
+}
+
+// Render one block ("5h" / "week") or null if it can't be stated truthfully.
+function block (label, node, now, withRelative) {
+  const pct = node && typeof node.utilization === 'number' ? Math.round(node.utilization) : null
+  if (pct == null) return null
+  const at = fmtReset(node.resets_at, now)
+  if (!at) return `${label}: ${pct}%` // percent is still true even if the reset isn't usable
+  const rel = withRelative ? ` (${fmtIn(new Date(node.resets_at).getTime() - now.getTime())})` : ''
+  return `${label}: ${pct}% · resets ${at}${rel}`
+}
+
+// json → "plan · 5h: 10% · resets 12:10 (1h04m) · week: 26% · resets Tue 11:00"
+// Returns null when nothing truthful can be said, so the caller prints the honest
+// "plan meters unavailable" instead of a half-line.
+export function formatPlanMeters (json, now = new Date()) {
+  if (!json || typeof json !== 'object') return null
+  const parts = [block('5h', json.five_hour, now, true), block('week', json.seven_day, now, false)]
+  // A scoped weekly cap (e.g. a per-model ceiling) only matters while it's the binding
+  // one — surface it, named, so a lane that's about to hit a model-specific wall sees it.
+  const scoped = Array.isArray(json.limits)
+    ? json.limits.find((l) => l && l.is_active && l.kind === 'weekly_scoped' && typeof l.percent === 'number')
+    : null
+  if (scoped) {
+    const name = scoped.scope?.model?.display_name
+    parts.push(`${name ? `week ${name}` : 'week scoped'}: ${Math.round(scoped.percent)}%`)
+  }
+  const live = parts.filter(Boolean)
+  return live.length ? `plan · ${live.join(' · ')}` : null
+}
+
+// ── cached entry point ───────────────────────────────────────────────────────
+let cache = { at: 0, line: null }
+
+// The ONE line bridge.mjs appends under the token/cost line. Cached ~45s so a user
+// spamming /usage doesn't hammer the endpoint. Never throws.
+export async function planMeterLine (deps = {}) {
+  const { now = () => Date.now(), clock = () => new Date(), token = readOAuthToken, fetchUsage = fetchPlanUsage } = deps
+  const t = now()
+  if (cache.line !== null && (t - cache.at) < CACHE_MS) return cache.line
+  let line = 'plan meters unavailable'
+  try {
+    const json = await fetchUsage(token())
+    line = formatPlanMeters(json, clock()) || 'plan meters unavailable'
+  } catch { /* stays unavailable */ }
+  cache = { at: t, line }
+  return line
+}
+
+export function _resetCache () { cache = { at: 0, line: null } } // test seam