thinkpool-pair 0.7.186 → 0.7.188

package/bridge.mjs

@@ -94,16 +94,31 @@ const flowRedispatch = new Map()
 const flowBudgets = new Map()
 import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'
 import { turnInFlight } from './update-gate.mjs'
-import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'
+import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, hasDurableArchive, servesHistoryPage } from './session-store.mjs'
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
 import { planMeterLine } from './plan-meters.mjs'
 import { makeThrottledTrack } from './presence.mjs'
+import { resolveAnonKey, DEFAULT_SUPABASE_URL } from './supabase-key.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
 // Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.
-const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || 'https://daytvtakmlixpfbbqzjd.supabase.co'
+const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || DEFAULT_SUPABASE_URL
 const WEB_BASE      = process.env.TP_WEB_BASE      || 'https://thinkpool.io'
-const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
+
+// The anon key is RESOLVED, not baked. It used to be a string literal here, and
+// that literal now sits in 224 published tarballs on 224 users' laptops: disable
+// the key and every one of them dies at once, unfixable from our side. So we ask
+// thinkpool.io/api/config for it (cached on disk, 6h), and keep the literal only
+// as the offline fallback. A key rotation now repairs itself server-side, even
+// for a bridge that never updates. Order: env → cache → network → stale → baked.
+// See bridge/supabase-key.mjs and docs/specs/2026-07-10-supabase-key-migration.md §5.1.
+const { key: SUPABASE_ANON, source: ANON_KEY_SOURCE } = await resolveAnonKey({
+  supabaseUrl: SUPABASE_URL,
+  webBase: WEB_BASE,
+  log: (m) => { if (process.env.TP_DEBUG) console.error(`  ◇ ${m}`) },
+})
+// The SOURCE is diagnostic and safe to print; the KEY never is (C16).
+if (process.env.TP_DEBUG) console.error(`  ◇ supabase anon key source: ${ANON_KEY_SOURCE}`)
 
 // Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).
 // The room-bridge is anon by design; the account supervisor (account.mjs) owns the
@@ -2761,6 +2776,13 @@ channel
   .on('broadcast', { event: 'history-page-request' }, ({ payload }) => {
     const id = payload?.term
     if (!id) return
+    // Multi-bridge rooms (Max's two Macs; the account-supervisor path): only the bridge
+    // that HOLDS this terminal may answer. A foreign bridge used to reply with an empty
+    // page — the client reads the first empty page as "no older history", clears the gap
+    // and kills the load-earlier pill, so recoverable history reads as gone. Targeting
+    // (payload.host) is honoured too, matching term-open / file-put / code-open / flow-*,
+    // but no client stamps it yet — ownership is what actually closes the race.
+    if (!servesHistoryPage({ payloadHost: payload?.host, bridgeName: name, hasSession: sessions.has(id), hasArchive: hasDurableArchive(room, id) })) return
     const { events, hasMore } = readDurablePage(room, id, Number(payload?.beforeSeq) || null, 200)
     const to = payload?.to ?? null
     if (!events.length) { bcast('history-page', { to, term: id, events: [], hasMore: false }); return }
@@ -2856,7 +2878,15 @@ channel
     if (/^\/clear\s*$/.test(text)) {
       s.pendingRecap = null   // /clear means forget context — drop any un-fired carry recap
       s.session.sendTurn(text)
-      s.log = []; s.seq = makeSeqCounter(0); bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
+      // The seq reset is load-bearing on BOTH ends: the client's clear handler sets
+      // seqHi = 0 (room.jsx), so the counter must restart with it. The durable archive
+      // is append-only and keeps the pre-clear era under colliding seqs — session-store's
+      // epochStart() confines every read to the newest era, so the archive never splices
+      // two conversations. Drop the cached floor with it: the next pushLog re-seeds
+      // archiveOldestSeq from the FIRST post-clear event (the new epoch's floor), instead
+      // of leaving a stale pre-clear floor to mis-aim trimmedBeforeSeq's phantom-pill guard.
+      s.log = []; s.seq = makeSeqCounter(0); s.archiveOldestSeq = null
+      bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
       ctlLine('context cleared. You can continue with these answers in mind.')
       return

package/key-shape.mjs

@@ -0,0 +1,49 @@
+/* key-shape.mjs — classify a Supabase API key by its SHAPE, and decide whether
+   it is safe to hand to a client.
+
+   Deliberately dependency-free (not even node: builtins beyond Buffer) so it can
+   be imported from BOTH sides of the tarball boundary: the published
+   `thinkpool-pair` bridge and the Vercel serverless function api/config.js.
+
+   Supabase runs two key generations side by side (see
+   docs/specs/2026-07-10-supabase-key-migration.md §1a):
+
+     legacy   a JWT — `eyJ…` — whose `role` payload claim is `anon` or `service_role`
+     new      an opaque string — `sb_publishable_…` or `sb_secret_…`
+
+   Exactly two of those four are client-safe. The other two bypass RLS. Nothing
+   here VERIFIES a signature — that is Supabase's job, over the network, and we
+   have no key material to verify with (§4: nothing in this repo verifies a JWT).
+   We are reading a shape to answer one question: "could this possibly be a
+   secret?" A false "yes" costs a fallback. A false "no" costs the database. */
+
+/** @returns {'publishable'|'secret'|'anon-jwt'|'service-jwt'|'invalid'} */
+export function classifyKey(key) {
+  if (typeof key !== 'string') return 'invalid'
+  const k = key.trim()
+  if (!k) return 'invalid'
+
+  // New-generation keys are self-describing. Check `secret` first: a prefix
+  // test that fails open is exactly the bug this module exists to prevent.
+  if (k.startsWith('sb_secret_')) return 'secret'
+  if (k.startsWith('sb_publishable_')) return 'publishable'
+
+  // Legacy keys are unsigned-to-us JWTs; the role lives in the payload.
+  if (k.startsWith('eyJ')) {
+    const parts = k.split('.')
+    if (parts.length !== 3) return 'invalid'
+    try {
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'))
+      if (payload.role === 'anon') return 'anon-jwt'
+      if (payload.role === 'service_role') return 'service-jwt'
+      return 'invalid' // an unknown role is not a role we will trust
+    } catch { return 'invalid' }
+  }
+  return 'invalid'
+}
+
+/** Only a publishable key or a legacy anon JWT may ever reach a client. */
+export function isClientSafeKey(key) {
+  const c = classifyKey(key)
+  return c === 'publishable' || c === 'anon-jwt'
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.186",
+  "version": "0.7.188",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -42,6 +42,8 @@
     "presence.mjs",
     "account.mjs",
     "auth-store.mjs",
+    "key-shape.mjs",
+    "supabase-key.mjs",
     "provider.mjs",
     "providers.mjs",
     "README.md"

package/session-store.mjs

@@ -115,17 +115,75 @@ export function seedDurableEvents(room, id, events) {
   } catch { /* noop */ }
 }
 
-// The archive FLOOR: the lowest transcript seq durably stored for this terminal.
-// The client compares its oldest loaded seq against this — only OFFER "load earlier"
-// when there genuinely are older events in the archive (vs a fresh lane whose first
-// turn happens to land at seq > 1, or an evicted-but-unarchived gap). null = no archive.
+// Does this bridge hold a durable archive for `id`? The capability half of the
+// history-page-request guard (a foreign bridge in a multi-bridge room has no file).
+export function hasDurableArchive(room, id) {
+  try { return !!room && !!id && fs.existsSync(eventsLog(room, id)) } catch { return false }
+}
+
+// Should THIS bridge answer a history-page-request? (pure — tested in test-history-ab.mjs)
+//
+// Two independent gates, both required:
+//  · `payloadHost` — the same targeting guard every other broadcast handler carries
+//    (term-open, file-put, code-open, flow-*): a targeted request is for ONE machine.
+//  · ownership — no client build to date STAMPS a host on this event, so targeting
+//    alone leaves an untargeted request answerable by every bridge in the room. The
+//    bridge that doesn't serve the terminal has no archive, replies
+//    `{ events: [], hasMore: false }`, and the client reads that first empty page as
+//    "no older history" — the load-earlier pill dies and recoverable history looks
+//    gone. Only the bridge that actually HOLDS the terminal may speak: a live session,
+//    or (a closed lane whose transcript is still on screen) its durable archive.
+export function servesHistoryPage({ payloadHost, bridgeName, hasSession, hasArchive }) {
+  if (payloadHost && payloadHost !== bridgeName) return false
+  return !!(hasSession || hasArchive)
+}
+
+// ── Epochs: /clear resets the per-session seq counter (bridge.mjs) but the durable
+// archive is append-only and keeps every era. So one file can hold seq 1..500 (pre-clear)
+// followed by seq 1..30 (post-clear) — colliding keys. `findIndex(e.seq >= beforeSeq)`
+// then anchors in the WRONG era and a page splices two conversations together.
+//
+// A seq that does not strictly increase over its predecessor is, by construction, a
+// counter reset: within one bridge run the counter only climbs, and a restart reseeds it
+// from maxSeq(restored log). So the last regression marks the start of the CURRENT epoch,
+// and only that epoch is pageable. Everything older is a conversation the user explicitly
+// cleared — surfacing it under colliding seqs would be wrong twice over.
+//
+// This is read-side only: it needs no migration and fixes archives already on disk
+// (every user's, right now) as well as ones written from here on.
+function epochStart(all) {
+  let start = 0, last = -Infinity
+  for (let i = 0; i < all.length; i++) {
+    const s = all[i]?.seq
+    if (typeof s !== 'number') continue
+    if (s <= last) { start = i; last = s; continue }   // counter went backwards → new era
+    last = s
+  }
+  return start
+}
+
+function readArchive(room, id) {
+  const f = eventsLog(room, id)
+  if (!fs.existsSync(f)) return null
+  const all = []
+  for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
+    if (!line) continue
+    try { all.push(JSON.parse(line)) } catch { /* skip a torn line */ }
+  }
+  return all
+}
+
+// The archive FLOOR: the lowest transcript seq durably stored for this terminal *in the
+// current epoch*. The client compares its oldest loaded seq against this — only OFFER
+// "load earlier" when there genuinely are older events in the archive (vs a fresh lane
+// whose first turn happens to land at seq > 1, or an evicted-but-unarchived gap).
+// null = no archive.
 export function readDurableOldestSeq(room, id) {
   try {
-    const f = eventsLog(room, id)
-    if (!fs.existsSync(f)) return null
-    for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
-      if (!line) continue
-      try { const e = JSON.parse(line); if (e && e.seq != null) return e.seq } catch { /* skip torn line */ }
+    const all = readArchive(room, id)
+    if (!all) return null
+    for (let i = epochStart(all); i < all.length; i++) {
+      if (all[i] && all[i].seq != null) return all[i].seq
     }
     return null
   } catch { return null }
@@ -134,22 +192,19 @@ export function readDurableOldestSeq(room, id) {
 // Read a backward page: events with transcript seq < beforeSeq (newest `limit` of
 // them, no-seq chrome interleaved by file order preserved). Returns { events, hasMore }.
 // beforeSeq null → the newest `limit` events (the tail). hasMore = there is older still.
+// Never reads below the current epoch — see epochStart.
 export function readDurablePage(room, id, beforeSeq, limit = 200) {
   try {
-    const f = eventsLog(room, id)
-    if (!fs.existsSync(f)) return { events: [], hasMore: false }
-    const all = []
-    for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
-      if (!line) continue
-      try { all.push(JSON.parse(line)) } catch { /* skip a torn line */ }
-    }
+    const all = readArchive(room, id)
+    if (!all) return { events: [], hasMore: false }
+    const from = epochStart(all)
     let bound = all.length
     if (beforeSeq != null) {
-      const i = all.findIndex((e) => e && e.seq != null && e.seq >= beforeSeq)
+      const i = all.findIndex((e, idx) => idx >= from && e && e.seq != null && e.seq >= beforeSeq)
       if (i >= 0) bound = i
     }
-    const start = Math.max(0, bound - limit)
-    return { events: all.slice(start, bound), hasMore: start > 0 }
+    const start = Math.max(from, bound - limit)
+    return { events: all.slice(start, Math.max(start, bound)), hasMore: start > from }
   } catch { return { events: [], hasMore: false } }
 }
 

package/supabase-key.mjs

@@ -0,0 +1,176 @@
+/* supabase-key.mjs — resolve the bridge's client-safe Supabase key at RUNTIME.
+
+   THE PROBLEM THIS SOLVES (docs/specs/2026-07-10-supabase-key-migration.md §5.1)
+
+   `bridge.mjs` used to carry the legacy anon key as a string literal:
+
+       const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGci…'
+
+   and 224 published `thinkpool-pair` versions shipped with it. The comment above
+   it said "safe to embed" — true about CONFIDENTIALITY (the web bundle ships the
+   same value), silent about LIFECYCLE. Disable that key in the Supabase dashboard
+   and every installed bridge, on every user's laptop, dies at the same instant —
+   and no server-side change repairs it, because Vercel env vars do not reach a
+   program running on someone else's machine. It is the one failure in the repo
+   our deploy pipeline cannot fix.
+
+   THE FIX. The key becomes a value the SERVER controls. The bridge asks
+   thinkpool.io for it at boot, caches it on disk, and keeps the literal only as
+   a last resort. A rotation then repairs itself for bridges that never update.
+
+   RESOLUTION ORDER — each step exists for a reason:
+
+     1 env        TP_SUPABASE_ANON — the operator's explicit override. Always wins.
+     2 cache      A fresh (< TTL) on-disk record. Keeps boot fast and works offline.
+     3 network    GET {WEB_BASE}/api/config. The rotation-repair path.
+     4 stale      An expired cache beats the literal: it is strictly newer.
+     5 baked      The legacy literal. First-ever boot with no network. Never fails.
+
+   TWO INVARIANTS, both tested in supabase-key.test.mjs:
+
+     · A service-shaped key is NEVER adopted, from any source. The network is an
+       input we do not control; a compromised or misconfigured config surface
+       must not be able to hand a user's laptop an RLS-bypassing client.
+     · No key material is ever logged. We log the SOURCE and the SHAPE. (C16.) */
+
+import os from 'node:os'
+import fs from 'node:fs'
+import path from 'node:path'
+import { classifyKey, isClientSafeKey } from './key-shape.mjs'
+
+export { classifyKey, isClientSafeKey }
+
+/* The legacy anon key. Public by design (the web bundle ships it), but now a
+   FALLBACK rather than the source of truth. Do not add new readers. */
+export const BAKED_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
+
+export const DEFAULT_SUPABASE_URL = 'https://daytvtakmlixpfbbqzjd.supabase.co'
+export const DEFAULT_WEB_BASE = 'https://thinkpool.io'
+
+const CACHE_FILE = path.join(os.homedir(), '.thinkpool-pair', 'supabase-key.json')
+const CACHE_TTL_MS = 6 * 60 * 60 * 1000 // 6h — a rotation reaches a rebooting bridge same-day
+const FETCH_TIMEOUT_MS = 2000            // boot latency budget; the literal is right there
+
+// ── the on-disk cache ──────────────────────────────────────────────────────
+// Sits beside auth.json / dirs.json / served.json in ~/.thinkpool-pair.
+// Contains no secret (a publishable key), so no chmod dance — unlike auth.json.
+export function readCacheFile() {
+  try {
+    const rec = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'))
+    if (!rec || typeof rec.key !== 'string' || typeof rec.url !== 'string') return null
+    return { key: rec.key, url: rec.url, at: Number(rec.at) || 0 }
+  } catch { return null }
+}
+
+export function writeCacheFile(rec) {
+  // Atomic, for the same reason auth-store.mjs is: a kill mid-write must never
+  // leave a truncated file that reads as "no cache" — or worse, as half a key.
+  try {
+    fs.mkdirSync(path.dirname(CACHE_FILE), { recursive: true })
+    const tmp = `${CACHE_FILE}.${process.pid}.tmp`
+    fs.writeFileSync(tmp, JSON.stringify(rec))
+    fs.renameSync(tmp, CACHE_FILE)
+  } catch { /* a cache we cannot write is a cache we do without */ }
+}
+
+// ── the network step ───────────────────────────────────────────────────────
+// Returns a validated client-safe key, or null. NEVER throws: a bridge must
+// boot on a train. Never logs the value.
+async function fetchConfigKey({ webBase, supabaseUrl, fetchImpl, timeoutMs, log }) {
+  const ac = new AbortController()
+  const timer = setTimeout(() => ac.abort(), timeoutMs)
+  try {
+    const r = await fetchImpl(`${webBase}/api/config`, {
+      signal: ac.signal,
+      headers: { accept: 'application/json' },
+    })
+    if (!r || !r.ok) { log(`config: HTTP ${r?.status ?? '?'} — keeping current key`); return null }
+
+    // Until this endpoint is deployed, the SPA catch-all answers /api/config with
+    // 200 + index.html. That must read as "no config", not as a network outage —
+    // every bridge in the wild takes this path on the day before the deploy.
+    let body
+    try { body = await r.json() }
+    catch { log('config: response was not JSON (endpoint not deployed?) — keeping current key'); return null }
+
+    const key = body?.supabaseAnonKey
+
+    // The served key must be for OUR project. A config surface pointing at a
+    // different Supabase project would authenticate against the wrong database.
+    if (body?.supabaseUrl && body.supabaseUrl !== supabaseUrl) {
+      log('config: served a key for a different project — refused')
+      return null
+    }
+    // The invariant. A service-shaped key from the network is never adopted.
+    if (!isClientSafeKey(key)) {
+      log(`config: served a ${classifyKey(key)} key — refused`)
+      return null
+    }
+    return key
+  } catch (e) {
+    log(`config: unreachable (${e.name === 'AbortError' ? 'timeout' : 'network'}) — keeping current key`)
+    return null
+  } finally { clearTimeout(timer) }
+}
+
+// ── the resolver ───────────────────────────────────────────────────────────
+/**
+ * @returns {Promise<{key: string, source: 'env'|'cache'|'network'|'stale-cache'|'baked'}>}
+ * @throws if TP_SUPABASE_ANON is set to something that is not client-safe.
+ */
+export async function resolveAnonKey(opts = {}) {
+  const {
+    env = process.env,
+    supabaseUrl = env.TP_SUPABASE_URL || DEFAULT_SUPABASE_URL,
+    webBase = env.TP_WEB_BASE || DEFAULT_WEB_BASE,
+    fetchImpl = globalThis.fetch,
+    readCache = readCacheFile,
+    writeCache = writeCacheFile,
+    now = Date.now,
+    ttlMs = CACHE_TTL_MS,
+    timeoutMs = FETCH_TIMEOUT_MS,
+    log = () => {},
+  } = opts
+
+  // 1 · env — the operator said so. But an operator who exports a SECRET key
+  //     here would silently run an RLS-bypassing bridge, so this one throws
+  //     rather than falling through: a wrong explicit answer is worse than none.
+  const fromEnv = String(env.TP_SUPABASE_ANON || '').trim()
+  if (fromEnv) {
+    if (!isClientSafeKey(fromEnv)) {
+      throw new Error(
+        `TP_SUPABASE_ANON is not a client-safe key (looks like: ${classifyKey(fromEnv)}). ` +
+        'Use the project\'s publishable/anon key — never a secret or service_role key.',
+      )
+    }
+    log('key: source=env')
+    return { key: fromEnv, source: 'env' }
+  }
+
+  const cached = readCache()
+  const cacheUsable = !!cached && cached.url === supabaseUrl && isClientSafeKey(cached.key)
+
+  // 2 · a fresh cache — skip the network entirely
+  if (cacheUsable && (now() - cached.at) < ttlMs) {
+    log('key: source=cache')
+    return { key: cached.key, source: 'cache' }
+  }
+
+  // 3 · the network — the whole point of this module
+  const fetched = await fetchConfigKey({ webBase, supabaseUrl, fetchImpl, timeoutMs, log })
+  if (fetched) {
+    writeCache({ key: fetched, url: supabaseUrl, at: now() })
+    log(`key: source=network shape=${classifyKey(fetched)}`)
+    return { key: fetched, source: 'network' }
+  }
+
+  // 4 · a stale cache still beats the literal — it is strictly more recent
+  if (cacheUsable) {
+    log('key: source=stale-cache')
+    return { key: cached.key, source: 'stale-cache' }
+  }
+
+  // 5 · the literal. Offline first boot. Always works, until the day it doesn't.
+  log('key: source=baked')
+  return { key: BAKED_ANON_KEY, source: 'baked' }
+}