thinkpool-pair 0.7.187 → 0.7.188

package/bridge.mjs

@@ -98,12 +98,27 @@ import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId
 import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine, buildRecapFromLog, RECAP_CAP, trimmedBeforeSeq, firstSeq } from './event-id.mjs'
 import { planMeterLine } from './plan-meters.mjs'
 import { makeThrottledTrack } from './presence.mjs'
+import { resolveAnonKey, DEFAULT_SUPABASE_URL } from './supabase-key.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
 // Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.
-const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || 'https://daytvtakmlixpfbbqzjd.supabase.co'
+const SUPABASE_URL  = process.env.TP_SUPABASE_URL  || DEFAULT_SUPABASE_URL
 const WEB_BASE      = process.env.TP_WEB_BASE      || 'https://thinkpool.io'
-const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
+
+// The anon key is RESOLVED, not baked. It used to be a string literal here, and
+// that literal now sits in 224 published tarballs on 224 users' laptops: disable
+// the key and every one of them dies at once, unfixable from our side. So we ask
+// thinkpool.io/api/config for it (cached on disk, 6h), and keep the literal only
+// as the offline fallback. A key rotation now repairs itself server-side, even
+// for a bridge that never updates. Order: env → cache → network → stale → baked.
+// See bridge/supabase-key.mjs and docs/specs/2026-07-10-supabase-key-migration.md §5.1.
+const { key: SUPABASE_ANON, source: ANON_KEY_SOURCE } = await resolveAnonKey({
+  supabaseUrl: SUPABASE_URL,
+  webBase: WEB_BASE,
+  log: (m) => { if (process.env.TP_DEBUG) console.error(`  ◇ ${m}`) },
+})
+// The SOURCE is diagnostic and safe to print; the KEY never is (C16).
+if (process.env.TP_DEBUG) console.error(`  ◇ supabase anon key source: ${ANON_KEY_SOURCE}`)
 
 // Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).
 // The room-bridge is anon by design; the account supervisor (account.mjs) owns the

package/key-shape.mjs

@@ -0,0 +1,49 @@
+/* key-shape.mjs — classify a Supabase API key by its SHAPE, and decide whether
+   it is safe to hand to a client.
+
+   Deliberately dependency-free (not even node: builtins beyond Buffer) so it can
+   be imported from BOTH sides of the tarball boundary: the published
+   `thinkpool-pair` bridge and the Vercel serverless function api/config.js.
+
+   Supabase runs two key generations side by side (see
+   docs/specs/2026-07-10-supabase-key-migration.md §1a):
+
+     legacy   a JWT — `eyJ…` — whose `role` payload claim is `anon` or `service_role`
+     new      an opaque string — `sb_publishable_…` or `sb_secret_…`
+
+   Exactly two of those four are client-safe. The other two bypass RLS. Nothing
+   here VERIFIES a signature — that is Supabase's job, over the network, and we
+   have no key material to verify with (§4: nothing in this repo verifies a JWT).
+   We are reading a shape to answer one question: "could this possibly be a
+   secret?" A false "yes" costs a fallback. A false "no" costs the database. */
+
+/** @returns {'publishable'|'secret'|'anon-jwt'|'service-jwt'|'invalid'} */
+export function classifyKey(key) {
+  if (typeof key !== 'string') return 'invalid'
+  const k = key.trim()
+  if (!k) return 'invalid'
+
+  // New-generation keys are self-describing. Check `secret` first: a prefix
+  // test that fails open is exactly the bug this module exists to prevent.
+  if (k.startsWith('sb_secret_')) return 'secret'
+  if (k.startsWith('sb_publishable_')) return 'publishable'
+
+  // Legacy keys are unsigned-to-us JWTs; the role lives in the payload.
+  if (k.startsWith('eyJ')) {
+    const parts = k.split('.')
+    if (parts.length !== 3) return 'invalid'
+    try {
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'))
+      if (payload.role === 'anon') return 'anon-jwt'
+      if (payload.role === 'service_role') return 'service-jwt'
+      return 'invalid' // an unknown role is not a role we will trust
+    } catch { return 'invalid' }
+  }
+  return 'invalid'
+}
+
+/** Only a publishable key or a legacy anon JWT may ever reach a client. */
+export function isClientSafeKey(key) {
+  const c = classifyKey(key)
+  return c === 'publishable' || c === 'anon-jwt'
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.187",
+  "version": "0.7.188",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -42,6 +42,8 @@
     "presence.mjs",
     "account.mjs",
     "auth-store.mjs",
+    "key-shape.mjs",
+    "supabase-key.mjs",
     "provider.mjs",
     "providers.mjs",
     "README.md"

package/supabase-key.mjs

@@ -0,0 +1,176 @@
+/* supabase-key.mjs — resolve the bridge's client-safe Supabase key at RUNTIME.
+
+   THE PROBLEM THIS SOLVES (docs/specs/2026-07-10-supabase-key-migration.md §5.1)
+
+   `bridge.mjs` used to carry the legacy anon key as a string literal:
+
+       const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGci…'
+
+   and 224 published `thinkpool-pair` versions shipped with it. The comment above
+   it said "safe to embed" — true about CONFIDENTIALITY (the web bundle ships the
+   same value), silent about LIFECYCLE. Disable that key in the Supabase dashboard
+   and every installed bridge, on every user's laptop, dies at the same instant —
+   and no server-side change repairs it, because Vercel env vars do not reach a
+   program running on someone else's machine. It is the one failure in the repo
+   our deploy pipeline cannot fix.
+
+   THE FIX. The key becomes a value the SERVER controls. The bridge asks
+   thinkpool.io for it at boot, caches it on disk, and keeps the literal only as
+   a last resort. A rotation then repairs itself for bridges that never update.
+
+   RESOLUTION ORDER — each step exists for a reason:
+
+     1 env        TP_SUPABASE_ANON — the operator's explicit override. Always wins.
+     2 cache      A fresh (< TTL) on-disk record. Keeps boot fast and works offline.
+     3 network    GET {WEB_BASE}/api/config. The rotation-repair path.
+     4 stale      An expired cache beats the literal: it is strictly newer.
+     5 baked      The legacy literal. First-ever boot with no network. Never fails.
+
+   TWO INVARIANTS, both tested in supabase-key.test.mjs:
+
+     · A service-shaped key is NEVER adopted, from any source. The network is an
+       input we do not control; a compromised or misconfigured config surface
+       must not be able to hand a user's laptop an RLS-bypassing client.
+     · No key material is ever logged. We log the SOURCE and the SHAPE. (C16.) */
+
+import os from 'node:os'
+import fs from 'node:fs'
+import path from 'node:path'
+import { classifyKey, isClientSafeKey } from './key-shape.mjs'
+
+export { classifyKey, isClientSafeKey }
+
+/* The legacy anon key. Public by design (the web bundle ships it), but now a
+   FALLBACK rather than the source of truth. Do not add new readers. */
+export const BAKED_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'
+
+export const DEFAULT_SUPABASE_URL = 'https://daytvtakmlixpfbbqzjd.supabase.co'
+export const DEFAULT_WEB_BASE = 'https://thinkpool.io'
+
+const CACHE_FILE = path.join(os.homedir(), '.thinkpool-pair', 'supabase-key.json')
+const CACHE_TTL_MS = 6 * 60 * 60 * 1000 // 6h — a rotation reaches a rebooting bridge same-day
+const FETCH_TIMEOUT_MS = 2000            // boot latency budget; the literal is right there
+
+// ── the on-disk cache ──────────────────────────────────────────────────────
+// Sits beside auth.json / dirs.json / served.json in ~/.thinkpool-pair.
+// Contains no secret (a publishable key), so no chmod dance — unlike auth.json.
+export function readCacheFile() {
+  try {
+    const rec = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'))
+    if (!rec || typeof rec.key !== 'string' || typeof rec.url !== 'string') return null
+    return { key: rec.key, url: rec.url, at: Number(rec.at) || 0 }
+  } catch { return null }
+}
+
+export function writeCacheFile(rec) {
+  // Atomic, for the same reason auth-store.mjs is: a kill mid-write must never
+  // leave a truncated file that reads as "no cache" — or worse, as half a key.
+  try {
+    fs.mkdirSync(path.dirname(CACHE_FILE), { recursive: true })
+    const tmp = `${CACHE_FILE}.${process.pid}.tmp`
+    fs.writeFileSync(tmp, JSON.stringify(rec))
+    fs.renameSync(tmp, CACHE_FILE)
+  } catch { /* a cache we cannot write is a cache we do without */ }
+}
+
+// ── the network step ───────────────────────────────────────────────────────
+// Returns a validated client-safe key, or null. NEVER throws: a bridge must
+// boot on a train. Never logs the value.
+async function fetchConfigKey({ webBase, supabaseUrl, fetchImpl, timeoutMs, log }) {
+  const ac = new AbortController()
+  const timer = setTimeout(() => ac.abort(), timeoutMs)
+  try {
+    const r = await fetchImpl(`${webBase}/api/config`, {
+      signal: ac.signal,
+      headers: { accept: 'application/json' },
+    })
+    if (!r || !r.ok) { log(`config: HTTP ${r?.status ?? '?'} — keeping current key`); return null }
+
+    // Until this endpoint is deployed, the SPA catch-all answers /api/config with
+    // 200 + index.html. That must read as "no config", not as a network outage —
+    // every bridge in the wild takes this path on the day before the deploy.
+    let body
+    try { body = await r.json() }
+    catch { log('config: response was not JSON (endpoint not deployed?) — keeping current key'); return null }
+
+    const key = body?.supabaseAnonKey
+
+    // The served key must be for OUR project. A config surface pointing at a
+    // different Supabase project would authenticate against the wrong database.
+    if (body?.supabaseUrl && body.supabaseUrl !== supabaseUrl) {
+      log('config: served a key for a different project — refused')
+      return null
+    }
+    // The invariant. A service-shaped key from the network is never adopted.
+    if (!isClientSafeKey(key)) {
+      log(`config: served a ${classifyKey(key)} key — refused`)
+      return null
+    }
+    return key
+  } catch (e) {
+    log(`config: unreachable (${e.name === 'AbortError' ? 'timeout' : 'network'}) — keeping current key`)
+    return null
+  } finally { clearTimeout(timer) }
+}
+
+// ── the resolver ───────────────────────────────────────────────────────────
+/**
+ * @returns {Promise<{key: string, source: 'env'|'cache'|'network'|'stale-cache'|'baked'}>}
+ * @throws if TP_SUPABASE_ANON is set to something that is not client-safe.
+ */
+export async function resolveAnonKey(opts = {}) {
+  const {
+    env = process.env,
+    supabaseUrl = env.TP_SUPABASE_URL || DEFAULT_SUPABASE_URL,
+    webBase = env.TP_WEB_BASE || DEFAULT_WEB_BASE,
+    fetchImpl = globalThis.fetch,
+    readCache = readCacheFile,
+    writeCache = writeCacheFile,
+    now = Date.now,
+    ttlMs = CACHE_TTL_MS,
+    timeoutMs = FETCH_TIMEOUT_MS,
+    log = () => {},
+  } = opts
+
+  // 1 · env — the operator said so. But an operator who exports a SECRET key
+  //     here would silently run an RLS-bypassing bridge, so this one throws
+  //     rather than falling through: a wrong explicit answer is worse than none.
+  const fromEnv = String(env.TP_SUPABASE_ANON || '').trim()
+  if (fromEnv) {
+    if (!isClientSafeKey(fromEnv)) {
+      throw new Error(
+        `TP_SUPABASE_ANON is not a client-safe key (looks like: ${classifyKey(fromEnv)}). ` +
+        'Use the project\'s publishable/anon key — never a secret or service_role key.',
+      )
+    }
+    log('key: source=env')
+    return { key: fromEnv, source: 'env' }
+  }
+
+  const cached = readCache()
+  const cacheUsable = !!cached && cached.url === supabaseUrl && isClientSafeKey(cached.key)
+
+  // 2 · a fresh cache — skip the network entirely
+  if (cacheUsable && (now() - cached.at) < ttlMs) {
+    log('key: source=cache')
+    return { key: cached.key, source: 'cache' }
+  }
+
+  // 3 · the network — the whole point of this module
+  const fetched = await fetchConfigKey({ webBase, supabaseUrl, fetchImpl, timeoutMs, log })
+  if (fetched) {
+    writeCache({ key: fetched, url: supabaseUrl, at: now() })
+    log(`key: source=network shape=${classifyKey(fetched)}`)
+    return { key: fetched, source: 'network' }
+  }
+
+  // 4 · a stale cache still beats the literal — it is strictly more recent
+  if (cacheUsable) {
+    log('key: source=stale-cache')
+    return { key: cached.key, source: 'stale-cache' }
+  }
+
+  // 5 · the literal. Offline first boot. Always works, until the day it doesn't.
+  log('key: source=baked')
+  return { key: BAKED_ANON_KEY, source: 'baked' }
+}