thinkpool-pair 0.7.217 → 0.7.218

package/bridge.mjs

@@ -65,7 +65,7 @@ import { writeLaneArtifact, digestSlice, appendDigest, resumeLane } from './flow
 import { createFlowWorktree, worktreeSpec } from './flow-worktree.mjs'
 import { startPreview, stopAllPreviews, previews } from './flow-preview.mjs'
 import { ViewportManager, createViewportTools, sharedViewportBrowser } from './viewport.mjs'
-import { designPrompt, resolveDesignSource, validateDesignRequest } from './design-edit.mjs'
+import { designPrompt, resolveDesignSource, syncRealtimeAuth, validateDesignRequest } from './design-edit.mjs'
 // FL-M9 — per-lane preview servers leak (one per done lane, never stopped until shutdown).
 // Lane previews are keyed `lane:<flowId>:<laneId>`; stop a whole flow's set when it assembles
 // (the assembled preview supersedes them) or when a lane is reverted.
@@ -739,6 +739,13 @@ let myServeUid = null        // this bridge's authed uid (null = anon)
   }
 }
 
+// Private realtime topics authorize the JWT carried by the socket at join time.
+// Supabase's REST auth helpers do not propagate codeAuthToken to Realtime, so pin
+// it before constructing any channel. A direct/anonymous bridge stays on anon.
+if (!await syncRealtimeAuth(supabase, codeAuthToken, SUPABASE_ANON) && codeAuthToken) {
+  process.stderr.write('\n  ⚠ realtime auth could not be initialized; private bridge features are unavailable.\n')
+}
+
 refreshOwnerPlan()   // fire-and-forget on boot (codeAuthToken now set from env OR the stored login)
 
 // ── Pre-flight budget caps — spec docs/specs/2026-07-01-budget-caps.md (nexos steal #1).
@@ -4014,7 +4021,13 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     if (m.t === 'update-available') surfaceUpdate(m.version)
     // Supervisor rotated the owner JWT (account.mjs scheduleTokenRefresh) — adopt
     // it so our authed writes (code-mockup) never go stale on a long session (L16).
-    else if (m.t === 'token') { codeAuthToken = m.accessToken || null; refreshOwnerPlan() }
+    else if (m.t === 'token') {
+      codeAuthToken = m.accessToken || null
+      syncRealtimeAuth(supabase, codeAuthToken, SUPABASE_ANON).then((ok) => {
+        if (!ok && codeAuthToken) process.stderr.write('\n  ⚠ realtime auth refresh failed; private bridge features may need a reconnect.\n')
+      })
+      refreshOwnerPlan()
+    }
   })
   setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), between: betweenTurns(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {

package/design-edit.mjs

@@ -8,6 +8,20 @@ const MAX_TEXT = 4_000
 
 const clean = (value, max) => String(value ?? '').replace(/\0/g, '').trim().slice(0, max)
 
+// supabase-js does not copy the Auth session into an already-created Realtime
+// client. Private tpdesign:* joins therefore need the bridge owner's JWT pinned
+// explicitly, both at boot and whenever the account supervisor rotates it.
+export async function syncRealtimeAuth(client, accessToken, fallbackToken = null) {
+  const token = accessToken || fallbackToken
+  if (!token || typeof client?.realtime?.setAuth !== 'function') return false
+  try {
+    await client.realtime.setAuth(token)
+    return true
+  } catch {
+    return false
+  }
+}
+
 export function sourceRevision(source) {
   return crypto.createHash('sha256').update(String(source)).digest('hex').slice(0, 24)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.217",
+  "version": "0.7.218",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {